Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port might allow, under certain conditions, an unprivileged task on MPU-enabled builds to read or write privileged kernel memory beyond…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,12 % · rekomendacja wg zapisanej polityki
openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted (attacker with physical write access). USBDriveCreator._verify_integrity_file only validates files listed in the…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,12 % · rekomendacja wg zapisanej polityki
Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,61 % · rekomendacja wg zapisanej polityki
Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a crafted Origin header and attacker-controlled host and…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,61 % · rekomendacja wg zapisanej polityki
CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache user. An attacker with uhcapache privileges can modify these…
Opis źródłowy NVD · ENalert CERT.pl · CVSS 9,3 · EPSS 0,1 % · rekomendacja wg zapisanej polityki
General Industrial Controls Lynx+ Gateway
is missing critical authentication in the embedded web server which could allow an attacker to remotely reset the device.
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,6 % · rekomendacja wg zapisanej polityki
A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,6 % · rekomendacja wg zapisanej polityki
boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can use these privileges to escalate to root.
This issue was fixed in version 1.6.0: the…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,09 % · rekomendacja wg zapisanej polityki
OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,59 % · rekomendacja wg zapisanej polityki
CVSS
9,2
EPSS
0,59 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port might allow, under certain conditions, an unprivileged task on MPU-enabled builds to read or write privileged kernel memory beyond…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,12 % · rekomendacja wg zapisanej polityki
openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted (attacker with physical write access). USBDriveCreator._verify_integrity_file only validates files listed in the…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,12 % · rekomendacja wg zapisanej polityki
Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,61 % · rekomendacja wg zapisanej polityki
Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a crafted Origin header and attacker-controlled host and…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,61 % · rekomendacja wg zapisanej polityki
CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache user. An attacker with uhcapache privileges can modify these…
Opis źródłowy NVD · EN
Pilne działanie
alert CERT.pl · CVSS 9,3 · EPSS 0,1 % · rekomendacja wg zapisanej polityki
General Industrial Controls Lynx+ Gateway
is missing critical authentication in the embedded web server which could allow an attacker to remotely reset the device.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,6 % · rekomendacja wg zapisanej polityki
A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,6 % · rekomendacja wg zapisanej polityki
boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can use these privileges to escalate to root.
This issue was fixed in version 1.6.0: the…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,09 % · rekomendacja wg zapisanej polityki
OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,59 % · rekomendacja wg zapisanej polityki
9,2
0,59 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.