Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider,…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid access tokens because the OAuth2 server never authenticates a resource owner. Attackers can register a client, request a code from /authorize, and exchange it at /token…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid encrypted EntAcctId values using the…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Improper input validation at one of the endpoints of Eaton xComfort ECI's
web interface, could lead into an attacker with network access to the device executing privileged user commands. As cybersecurity
standards continue to evolve and to meet our requirements today, Eaton has decided to…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
JGroupsEndpoint.createExchange(Message), which CamelJGroupsReceiver calls for every message the jgroups consumer…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
greybus: audio: bound the topology section sizes against the fetched size
gb_audio_gb_get_topology() fetches a topology blob of a module-supplied
size, and gbaudio_tplg_parse_data() then walks it by adding the
module-supplied…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
dma-direct: return struct page from dma_direct_alloc_from_pool()
Commit 5b138c534fda ("dma-direct: factor out a dma_direct_alloc_from_pool
helper") changed dma_direct_alloc_from_pool() to return the CPU address
from…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
When peer delete failed in a disconnect operation, use-after-free
detected by KFENCE in below log. It is because for each vdev_id and
address, it has only…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider,…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid access tokens because the OAuth2 server never authenticates a resource owner. Attackers can register a client, request a code from /authorize, and exchange it at /token…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid encrypted EntAcctId values using the…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Improper input validation at one of the endpoints of Eaton xComfort ECI's
web interface, could lead into an attacker with network access to the device executing privileged user commands. As cybersecurity
standards continue to evolve and to meet our requirements today, Eaton has decided to…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
JGroupsEndpoint.createExchange(Message), which CamelJGroupsReceiver calls for every message the jgroups consumer…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
greybus: audio: bound the topology section sizes against the fetched size
gb_audio_gb_get_topology() fetches a topology blob of a module-supplied
size, and gbaudio_tplg_parse_data() then walks it by adding the
module-supplied…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
dma-direct: return struct page from dma_direct_alloc_from_pool()
Commit 5b138c534fda ("dma-direct: factor out a dma_direct_alloc_from_pool
helper") changed dma_direct_alloc_from_pool() to return the CPU address
from…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
When peer delete failed in a disconnect operation, use-after-free
detected by KFENCE in below log. It is because for each vdev_id and
address, it has only…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,32 % · rekomendacja wg zapisanej polityki