KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Luka w Oracle WebCenter Content pozwala na przejęcie systemu przez nieautoryzowanego atakującego.
Luka w Oracle WebCenter Content pozwala na przejęcie kontroli przez nieautoryzowanego atakującego.
Luka w Oracle WebCenter Content umożliwia przejęcie kontroli przez nieautoryzowanego atakującego.
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an…
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event…
Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by…
SOEM version 2.0.0 and earlier contains a vulnerability in multi-segment data transfers where a malicious device can overflow memory buffers. The software checks the total size only once at the beginning, but doesn't track the cumulative size as multiple segments arrive. An attacker can declare a…
Wykorzystanie po zwolnieniu pamięci w BrowserTag w Google Chrome umożliwia atakującemu potencjalne usunięcie pamięci.
Luka w WP Captcha PRO pozwala na zdalne wykonanie kodu przez nieautoryzowane przesyłanie plików.
Obejście ograniczeń ECI w Docker Desktop umożliwia lokalnemu atakującemu dostęp do silnika Docker.
Błąd w gopls pozwala na zdalne wykonanie kodu przez nieautoryzowane osoby w tej samej sieci.
Przepełnienie bufora w usłudze P2P API w BS Producten Petcam umożliwia zdalne wykonanie kodu.
Niski poziom uprawnień atakującego zdalnie pozwala na zastąpienie aplikacji startowej w systemie CODESYS, co umożliwia nieautoryzowane wykonanie kodu.
Moduł PrestaShop totadministrativemandate umożliwia atak CSRF, co pozwala na potwierdzenie zamówienia.
A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with network access to the service can instruct the…
Brak limitów w DivvyPayHQ pozwala atakującemu na zdalne zablokowanie VM Erlang.
Brak uwierzytelnienia w Ground Station pozwala na zdalne wywołanie ataku typu denial-of-service.
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in NCP-HG100 1.4.48.16 and earlier. If exploited, a remote attacker who has obtained the authentication information to log in to the management page of the product may execute an arbitrary OS…
openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob(), which in CPython does not descend into symlinked directories and treats the symlink as an ordinary directory, while O_NOFOLLOW on…
CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit…
A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion…
Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in administrator into visiting a phishing website, causing the router to execute arbitrary commands with root…
JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copilot standard mode. Attackers can self-register, select standard mode in the WebSocket chat.start extension, and have the…
The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes replies from a Peripheral Device into a stack-allocated struct osdp_event. For the REPLY_KEYPPAD and REPLY_RAW reply types, the payload length is taken from the received frame and the only validation…
Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Luka w Oracle WebCenter Content pozwala na przejęcie systemu przez nieautoryzowanego atakującego. | Luka w Oracle WebCenter Content pozwala na przejęcie systemu przez nieautoryzowanego atakującego. |
Obserwuj | 8,8 | 0,21 % | ||
| Luka w Oracle WebCenter Content pozwala na przejęcie kontroli przez nieautoryzowanego atakującego. | Luka w Oracle WebCenter Content pozwala na przejęcie kontroli przez nieautoryzowanego atakującego. |
Obserwuj | 8,8 | 0,21 % | ||
| Luka w Oracle WebCenter Content umożliwia przejęcie kontroli przez nieautoryzowanego atakującego. | Luka w Oracle WebCenter Content umożliwia przejęcie kontroli przez nieautoryzowanego atakującego. |
Obserwuj | 8,8 | 0,21 % | ||
| Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes… | Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an… |
Obserwuj | 8,7 | 0,71 % | ||
| Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape… | Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event… |
Obserwuj | 8,7 | 0,71 % | ||
| Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the… | Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by… |
Obserwuj | 8,7 | 0,71 % | ||
| SOEM version 2.0.0 and earlier contains a vulnerability in multi-segment data transfers where a malicious device can overflow memory… | SOEM version 2.0.0 and earlier contains a vulnerability in multi-segment data transfers where a malicious device can overflow memory buffers. The software checks the total size only once at the beginning, but doesn't track the cumulative size as multiple segments arrive. An attacker can declare a… |
Obserwuj | 8,8 | 0,21 % | ||
| Wykorzystanie po zwolnieniu pamięci w BrowserTag w Google Chrome umożliwia atakującemu potencjalne usunięcie pamięci. | Wykorzystanie po zwolnieniu pamięci w BrowserTag w Google Chrome umożliwia atakującemu potencjalne usunięcie pamięci. |
Obserwuj | 8,8 | 0,21 % | ||
| Luka w WP Captcha PRO pozwala na zdalne wykonanie kodu przez nieautoryzowane przesyłanie plików. | Luka w WP Captcha PRO pozwala na zdalne wykonanie kodu przez nieautoryzowane przesyłanie plików. |
Obserwuj | 8,8 | 0,21 % | ||
| Obejście ograniczeń ECI w Docker Desktop umożliwia lokalnemu atakującemu dostęp do silnika Docker. | Obejście ograniczeń ECI w Docker Desktop umożliwia lokalnemu atakującemu dostęp do silnika Docker. |
Obserwuj | 8,8 | 0,21 % | ||
| Błąd w gopls pozwala na zdalne wykonanie kodu przez nieautoryzowane osoby w tej samej sieci. | Błąd w gopls pozwala na zdalne wykonanie kodu przez nieautoryzowane osoby w tej samej sieci. |
Obserwuj | 8,8 | 0,21 % | ||
| Przepełnienie bufora w usłudze P2P API w BS Producten Petcam umożliwia zdalne wykonanie kodu. | Przepełnienie bufora w usłudze P2P API w BS Producten Petcam umożliwia zdalne wykonanie kodu. |
Obserwuj | 8,8 | 0,21 % | ||
| Niski poziom uprawnień atakującego zdalnie pozwala na zastąpienie aplikacji startowej w systemie CODESYS, co umożliwia nieautoryzowane… | Niski poziom uprawnień atakującego zdalnie pozwala na zastąpienie aplikacji startowej w systemie CODESYS, co umożliwia nieautoryzowane wykonanie kodu. |
Obserwuj | 8,8 | 0,21 % | ||
| Moduł PrestaShop totadministrativemandate umożliwia atak CSRF, co pozwala na potwierdzenie zamówienia. | Moduł PrestaShop totadministrativemandate umożliwia atak CSRF, co pozwala na potwierdzenie zamówienia. |
Obserwuj | 8,8 | 0,21 % | ||
| A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. | A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with network access to the service can instruct the… |
Obserwuj | 8,8 | 0,21 % | ||
| Brak limitów w DivvyPayHQ pozwala atakującemu na zdalne zablokowanie VM Erlang. | Brak limitów w DivvyPayHQ pozwala atakującemu na zdalne zablokowanie VM Erlang. |
Obserwuj | 8,7 | 0,71 % | ||
| Brak uwierzytelnienia w Ground Station pozwala na zdalne wywołanie ataku typu denial-of-service. | Brak uwierzytelnienia w Ground Station pozwala na zdalne wywołanie ataku typu denial-of-service. |
Obserwuj | 8,7 | 0,71 % | ||
| Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in NCP-HG100 1.4.48.16 and earlier. | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in NCP-HG100 1.4.48.16 and earlier. If exploited, a remote attacker who has obtained the authentication information to log in to the management page of the product may execute an arbitrary OS… |
Obserwuj | 8,6 | 1,21 % | ||
| openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. | openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob(), which in CPython does not descend into symlinked directories and treats the symlink as an ordinary directory, while O_NOFOLLOW on… |
Obserwuj | 8,7 | 0,71 % | ||
| CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated… | CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit… |
Obserwuj | 8,7 | 0,71 % | ||
| A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. | A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion… |
Obserwuj | 8,8 | 0,21 % | ||
| Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an… | Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in administrator into visiting a phishing website, causing the router to execute arbitrary commands with root… |
Obserwuj | 8,6 | 1,21 % | ||
| JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands… | JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copilot standard mode. Attackers can self-register, select standard mode in the WebSocket chat.start extension, and have the… |
Obserwuj | 8,7 | 0,71 % | ||
| The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes replies from a Peripheral Device into a… | The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes replies from a Peripheral Device into a stack-allocated struct osdp_event. For the REPLY_KEYPPAD and REPLY_RAW reply types, the payload length is taken from the received frame and the only validation… |
Obserwuj | 8,8 | 0,2 % | ||
| Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes… | Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service… |
Obserwuj | 8,8 | 0,2 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.