Podatności

PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in __PHYSFS_utf8codepoint() that allows attackers to read past name buffers via an off-by-one cursor advance on six-octet UTF-8 sequences. Attackers can supply a crafted archive with entry names ending in six-octet sequences,…

CVSS 4,8 · EPSS 0,17 % · rekomendacja wg zapisanej polityki

libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in tta_decoder_process_stream() and tta_decoder_process_frame() because header checks never reject a zero channel count. Attackers can supply a crafted .tta file declaring zero channels so decorrelation accesses…

CVSS 4,8 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this…

CVSS 4,8 · EPSS 0,1 % · rekomendacja wg zapisanej polityki

libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the 78-entry kLatinSpecialTable without an upper bound check. Attackers can supply crafted captions designating the Latin special set with ESC 28 4C followed by bytes 0x6F-0x7E to…

CVSS 4,8 · rekomendacja wg zapisanej polityki

Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a…

CVSS 4,8 · rekomendacja wg zapisanej polityki

Improper Authentication vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.1. The security processor validated the issuer of an introspected token only when the introspection response actually carried an iss…

CVSS 4,8 · rekomendacja wg zapisanej polityki

Improper Input Validation vulnerability in Apache Camel Core component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The saga processor consulted a header named Long-Running-Action to decide which saga an exchange belonged to. The name carries no Camel…

CVSS 4,8 · rekomendacja wg zapisanej polityki

Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The component decided whether an endpoint ran in proxy mode by testing whether its configured path started with…

CVSS 4,8 · rekomendacja wg zapisanej polityki

MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names…

CVSS 4,8 · rekomendacja wg zapisanej polityki

MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity…

CVSS 4,8 · rekomendacja wg zapisanej polityki

Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.

CVSS 4,7 · EPSS 0,38 % · rekomendacja wg zapisanej polityki

Exposure of sensitive system information to an unauthorized control sphere in Windows Shell allows an authorized attacker to disclose information locally.

CVSS 4,7 · EPSS 0,38 % · rekomendacja wg zapisanej polityki

Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.

CVSS 4,7 · EPSS 0,38 % · rekomendacja wg zapisanej polityki

Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.

CVSS 4,7 · EPSS 0,38 % · rekomendacja wg zapisanej polityki

Exposure of sensitive system information to an unauthorized control sphere in Windows Installer allows an authorized attacker to disclose information locally.

CVSS 4,7 · EPSS 0,38 % · rekomendacja wg zapisanej polityki

Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.

CVSS 4,7 · EPSS 0,36 % · rekomendacja wg zapisanej polityki

Generation of error message containing sensitive information in Windows NTFS allows an authorized attacker to disclose information locally.

CVSS 4,7 · EPSS 0,36 % · rekomendacja wg zapisanej polityki

Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to disclose information locally.

CVSS 4,7 · EPSS 0,33 % · rekomendacja wg zapisanej polityki

Use after free in Windows Graphics Kernel allows an authorized attacker to disclose information locally.

CVSS 4,7 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Use after free in Windows Kernel allows an authorized attacker to disclose information locally.

CVSS 4,7 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Out-of-bounds read in Windows Kernel allows an authorized attacker to disclose information locally.

CVSS 4,7 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally.

CVSS 4,7 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally.

CVSS 4,7 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Out-of-bounds read in Desktop Window Manager allows an authorized attacker to disclose information locally.

CVSS 4,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

Exposure of sensitive system information to an unauthorized control sphere in Windows ALPC allows an authorized attacker to disclose information locally.

CVSS 4,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki