KATALOG INFORMACJI
Chronologiczny przegląd publikacji. Ostatnie modyfikacje są w osobnym widoku.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS URL can be…
A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution.
A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled.
A vulnerability in the bulk port configuration functionality could allow an unauthenticated attacker to crash the service.
A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution.
A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution.
A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.
A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the on_disconnected callback function.
A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function.
A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function when msglen is set to 0.
An integer overflow vulnerability in the license manager service could allow an unauthenticated attacker to crash the service.
A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.
A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.
It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure an authenticated administrator into…
A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.
Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in the ‘ListAlmacen’ endpoint. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary…
Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log in with a valid username compared to an invalid one. An unauthenticated attacker could systematically identify valid usernames by examining variations in the…
A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.
A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of out-of-bounds read.
A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code execution.
A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device permanently.
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.
A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS.
A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. | Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS URL can be… |
Do weryfikacji | Nieustalone | 0,22 % | ||
| A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution. | A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution. |
Obserwuj | 8,6 | 0,34 % | ||
| A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even… | A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled. |
Obserwuj | 8,2 | 0,22 % | ||
| A vulnerability in the bulk port configuration functionality could allow an unauthenticated attacker to crash the service. | A vulnerability in the bulk port configuration functionality could allow an unauthenticated attacker to crash the service. |
Do wiadomości | 6,9 | 0,27 % | ||
| A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve… | A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution. |
Obserwuj | 7,5 | 0,37 % | ||
| A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution. | A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution. |
W tym tygodniu | 9,2 | 0,31 % | ||
| A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service. | A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service. |
Obserwuj | 8,7 | 0,27 % | ||
| A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via… | A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the on_disconnected callback function. |
Do wiadomości | 6,9 | 0,27 % | ||
| A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via… | A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function. |
Do wiadomości | 6,9 | 0,27 % | ||
| A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via… | A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function when msglen is set to 0. |
Do wiadomości | 6,9 | 0,27 % | ||
| An integer overflow vulnerability in the license manager service could allow an unauthenticated attacker to crash the service. | An integer overflow vulnerability in the license manager service could allow an unauthenticated attacker to crash the service. |
Do wiadomości | 6,9 | 0,27 % | ||
| A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism. | A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism. |
W tym tygodniu | 9,3 | 0,41 % | ||
| A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism. | A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism. |
W tym tygodniu | 9,2 | 0,34 % | ||
| It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. | It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure an authenticated administrator into… |
Do wiadomości | 6,6 | 0,18 % | ||
| A failure has been identified in the SNS during dynamic data files signature check. | A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine. |
Obserwuj | 7,5 | 0,16 % | ||
| Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user… | Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in the ‘ListAlmacen’ endpoint. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary… |
Do wiadomości | 6,9 | 0,23 % | ||
| Enumeration of unauthenticated users in FacturaScripts, version 2025.61. | Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log in with a valid username compared to an invalid one. An unauthenticated attacker could systematically identify valid usernames by examining variations in the… |
Do wiadomości | 6,9 | 0,26 % | ||
| A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges. | A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges. |
W tym tygodniu | 9,3 | 0,62 % | ||
| A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of out-of-bounds read. | A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of out-of-bounds read. |
Do wiadomości | 4,3 | 0,13 % | ||
| A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code… | A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code execution. |
Obserwuj | 7,5 | 0,3 % | ||
| A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file,… | A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device permanently. |
Obserwuj | 8,6 | 0,15 % | ||
| BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. | BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents. |
Obserwuj | 8,7 | 0,37 % | ||
| BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. | BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents. |
Obserwuj | 8,7 | 0,37 % | ||
| A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is… | A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS. |
Obserwuj | 7,8 | 0,12 % | ||
| A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. | A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted… |
Obserwuj | 7,3 | 0,26 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.