Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix out-of-bounds read in ext4_read_inline_dir()
ext4_read_inline_dir() can read a dirent header past the end of its inline
buffer, triggering a slab-out-of-bounds read during getdents64():
BUG: KASAN:…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,7 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: validate ef->size covers the record's name and value
When an EA record has a non-zero ef->size, ntfs_read_ea() only checks
that the record fits in the remaining buffer (ea_size > bytes), not that
ef->size is large…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,7 % · rekomendacja wg zapisanej polityki
A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing…
Opis źródłowy NVD · ENCVSS 9,0 · EPSS 1,19 % · rekomendacja wg zapisanej polityki
InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509 credential to a LeafNode's signature_key. LeafNode.verify() checked a leaf's signature against the signature_key carried in the leaf itself, while the credential's X.509…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,68 % · rekomendacja wg zapisanej polityki
When using ambient user credentials, an HTTP request directed to one origin
may be dispatched over a connection previously authenticated via Negotiate for
a different origin, leaving the request's intended credentials unused.
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,68 % · rekomendacja wg zapisanej polityki
An HTTP proxy can trick libcurl into sending the origin's credentials (Basic
password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering
the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the
expected 407 `Proxy-Authenticate:`.
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,68 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix out-of-bounds read in ext4_read_inline_dir()
ext4_read_inline_dir() can read a dirent header past the end of its inline
buffer, triggering a slab-out-of-bounds read during getdents64():
BUG: KASAN:…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,7 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: validate ef->size covers the record's name and value
When an EA record has a non-zero ef->size, ntfs_read_ea() only checks
that the record fits in the remaining buffer (ea_size > bytes), not that
ef->size is large…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,7 % · rekomendacja wg zapisanej polityki
A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,0 · EPSS 1,19 % · rekomendacja wg zapisanej polityki
InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509 credential to a LeafNode's signature_key. LeafNode.verify() checked a leaf's signature against the signature_key carried in the leaf itself, while the credential's X.509…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,68 % · rekomendacja wg zapisanej polityki
When using ambient user credentials, an HTTP request directed to one origin
may be dispatched over a connection previously authenticated via Negotiate for
a different origin, leaving the request's intended credentials unused.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,68 % · rekomendacja wg zapisanej polityki
An HTTP proxy can trick libcurl into sending the origin's credentials (Basic
password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering
the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the
expected 407 `Proxy-Authenticate:`.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,68 % · rekomendacja wg zapisanej polityki