KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Use after free in DNS Server allows an unauthorized attacker to execute code over a network.
Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges over a network.
Double free in Windows Libarchive allows an unauthorized attacker to execute code over a network.
Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.
Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.
Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network.
Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and trigger deletion…
Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the…
Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network.
Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
Out-of-bounds write in Windows Schannel allows an unauthorized attacker to execute code over a network.
Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values…
MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/storage endpoints in StorageController. Low-privilege or self-registered users can supply arbitrary bucket and objectName…
Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the login temp token. Attackers can present the temp token from the jwt/apply endpoint as a bearer JWT, refresh it, or use HTTP Basic login to…
Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege via network access.
IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.
NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component where a remote attacker may cause an improper limitation of a pathname to a restricted directory by supplying crafted archive member names to a dSort job. A successful exploit may lead to…
NVIDIA AIStore for Linux contains a path traversal vulnerability in the target-side object rename handler, where an unauthenticated remote attacker could cause an improper limitation of a pathname to a restricted directory by submitting a crafted rename destination directly to an AIStore target,…
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a…
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow.
Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. When Vault uses Shamir seals and has an external plugin directory configured, a privileged operator able to restore an Integrated Storage (Raft)…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Use after free in DNS Server allows an unauthorized attacker to execute code over a network. | Use after free in DNS Server allows an unauthorized attacker to execute code over a network. |
Obserwuj | 8,1 | Nieustalone | ||
| Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges over a network. | Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges over a network. |
Obserwuj | 8,1 | Nieustalone | ||
| Double free in Windows Libarchive allows an unauthorized attacker to execute code over a network. | Double free in Windows Libarchive allows an unauthorized attacker to execute code over a network. |
Obserwuj | 8,1 | Nieustalone | ||
| Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network. | Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network. |
Obserwuj | 8,1 | Nieustalone | ||
| Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network. | Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network. |
Obserwuj | 8,1 | Nieustalone | ||
| Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network. | Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network. |
Obserwuj | 8,1 | Nieustalone | ||
| Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network. | Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network. |
Obserwuj | 8,1 | Nieustalone | ||
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DHCP Server allows an unauthorized… | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DHCP Server allows an unauthorized attacker to execute code over a network. |
Obserwuj | 8,1 | Nieustalone | ||
| iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete… | iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and trigger deletion… |
Obserwuj | 8,1 | Nieustalone | ||
| Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because… | Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the… |
Obserwuj | 8,1 | Nieustalone | ||
| Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network. | Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network. |
Obserwuj | 8,1 | Nieustalone | ||
| Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network. | Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network. |
Obserwuj | 8,1 | Nieustalone | ||
| Out-of-bounds write in Windows Schannel allows an unauthorized attacker to execute code over a network. | Out-of-bounds write in Windows Schannel allows an unauthorized attacker to execute code over a network. |
Obserwuj | 8,1 | Nieustalone | ||
| Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over… | Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network. |
Obserwuj | 8,1 | Nieustalone | ||
| Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network. | Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network. |
Obserwuj | 8,1 | Nieustalone | ||
| FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated… | FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values… |
Obserwuj | 8,1 | Nieustalone | ||
| MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by… | MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/storage endpoints in StorageController. Low-privilege or self-registered users can supply arbitrary bucket and objectName… |
Obserwuj | 8,1 | Nieustalone | ||
| Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP… | Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the login temp token. Attackers can present the temp token from the jwt/apply endpoint as a bearer JWT, refresh it, or use HTTP Basic login to… |
Obserwuj | 8,1 | Nieustalone | ||
| Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated… | Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege via network access. |
Obserwuj | 8,1 | Nieustalone | ||
| IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2… | IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler. |
Obserwuj | 8,1 | Nieustalone | ||
| NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component where a remote attacker may… | NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component where a remote attacker may cause an improper limitation of a pathname to a restricted directory by supplying crafted archive member names to a dSort job. A successful exploit may lead to… |
Obserwuj | 8,1 | Nieustalone | ||
| NVIDIA AIStore for Linux contains a path traversal vulnerability in the target-side object rename handler, where an unauthenticated remote… | NVIDIA AIStore for Linux contains a path traversal vulnerability in the target-side object rename handler, where an unauthenticated remote attacker could cause an improper limitation of a pathname to a restricted directory by submitting a crafted rename destination directly to an AIStore target,… |
Obserwuj | 8,1 | Nieustalone | ||
| MariaDB server is a community developed fork of MySQL server. | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a… |
Obserwuj | 8,0 | 0,48 % | ||
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could… | IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow. |
Obserwuj | 8,0 | 0,38 % | ||
| Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin… | Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. When Vault uses Shamir seals and has an external plugin directory configured, a privileged operator able to restore an Integrated Storage (Raft)… |
Obserwuj | 8,0 | 0,34 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.