KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a client without a timeout. An authenticated user who can start a repository migration can direct it to an attacker-controlled OneDev-compatible server returning an oversized or…
Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry counts. An authenticated user with package-publish permission can upload a small, highly compressed archive that causes disproportionately…
Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory. An authenticated user with package-publish permission can upload a highly compressed archive containing many manifests, causing…
libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERY_INFO reply,…
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::EventManager loqQueue_internalInterfaceHandler packetization is vulnerable because EventManager accepts up to the framework LogBuffer maximum, but…
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Use after free in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file helpers that allows malicious cluster workers to delete arbitrary files via an unvalidated filename parameter. Attackers holding the cluster key can invoke these helpers through…
A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image,…
A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tricking a user into mounting a crafted storage…
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station…
Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite RepoAdminChangeTeamAccess being disabled. The endpoint does not enforce the organization's restriction on repository administrators changing…
Missing authorization in WebDAV allows an authorized attacker to bypass a security feature over a network.
Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network.
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command…
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From 2.2.7 until 2.2.11, ServiceSentinel.worker in service/singleton/servicesentinel.go checked an owned service under servicesLock and later dereferenced pointer-valued serviceStatusToday and…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. |
Do wiadomości | 6,5 | 0,55 % | ||
| Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. |
Do wiadomości | 6,5 | 0,55 % | ||
| Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. |
Do wiadomości | 6,5 | 0,55 % | ||
| Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. |
Do wiadomości | 6,5 | 0,55 % | ||
| Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a client without a… | Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a client without a timeout. An authenticated user who can start a repository migration can direct it to an attacker-controlled OneDev-compatible server returning an oversized or… |
Do wiadomości | 6,5 | 0,55 % | ||
| Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its… | Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry counts. An authenticated user with package-publish permission can upload a small, highly compressed archive that causes disproportionately… |
Do wiadomości | 6,5 | 0,55 % | ||
| Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before… | Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory. An authenticated user with package-publish permission can upload a highly compressed archive containing many manifests, causing… |
Do wiadomości | 6,5 | 0,55 % | ||
| libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap… | libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERY_INFO reply,… |
Do wiadomości | 6,5 | 0,55 % | ||
| F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. | F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::EventManager loqQueue_internalInterfaceHandler packetization is vulnerable because EventManager accepts up to the framework LogBuffer maximum, but… |
Do wiadomości | 6,5 | 0,54 % | ||
| Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. |
Do wiadomości | 6,5 | 0,53 % | ||
| Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. |
Do wiadomości | 6,5 | 0,51 % | ||
| Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. |
Do wiadomości | 6,5 | 0,51 % | ||
| Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. |
Do wiadomości | 6,5 | 0,51 % | ||
| Use after free in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | Use after free in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. |
Do wiadomości | 6,5 | 0,51 % | ||
| Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. |
Do wiadomości | 6,5 | 0,51 % | ||
| Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. |
Do wiadomości | 6,5 | 0,51 % | ||
| Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file helpers that allows… | Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file helpers that allows malicious cluster workers to delete arbitrary files via an unvalidated filename parameter. Attackers holding the cluster key can invoke these helpers through… |
Do wiadomości | 6,5 | 0,51 % | ||
| A flaw was found in parted. | A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image,… |
Do wiadomości | 6,6 | Nieustalone | ||
| A flaw was found in Nautilus. | A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tricking a user into mounting a crafted storage… |
Do wiadomości | 6,6 | Nieustalone | ||
| A path traversal vulnerability has been reported to affect Video Station. | A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station… |
Do wiadomości | 6,5 | 0,49 % | ||
| Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a… | Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite RepoAdminChangeTeamAccess being disabled. The endpoint does not enforce the organization's restriction on repository administrators changing… |
Do wiadomości | 6,5 | 0,47 % | ||
| Missing authorization in WebDAV allows an authorized attacker to bypass a security feature over a network. | Missing authorization in WebDAV allows an authorized attacker to bypass a security feature over a network. |
Do wiadomości | 6,5 | 0,46 % | ||
| Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network. | Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network. |
Do wiadomości | 6,5 | 0,43 % | ||
| WeGIA is a web manager for charitable institutions. | WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command… |
Do wiadomości | 6,5 | 0,43 % | ||
| Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From 2.2.7 until 2.2.11, ServiceSentinel.worker in service/singleton/servicesentinel.go checked an owned service under servicesLock and later dereferenced pointer-valued serviceStatusToday and… |
Do wiadomości | 6,5 | 0,42 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.