KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Wstrzyknięcie SQL w Media Library Assistant umożliwia atakującym manipulację bazą danych.
The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors.
An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform. An unauthenticated, network-adjacent attacker can exploit an unauthenticated endpoint within the Single Sign-On (SSO) workflow to gain…
Dereferencja nieufnego wskaźnika w WibuKey umożliwia lokalną eskalację uprawnień.
Przepełnienie bufora w IBM AIX i PowerVM VIOS umożliwia lokalnemu atakującemu wykonanie dowolnego kodu.
Błąd zapisu poza granicami w IBM i umożliwia lokalnemu atakującemu wykonanie dowolnego kodu.
Brak egzekwowania silnych polityk haseł w routerze Quantum Networks umożliwia nieautoryzowany dostęp.
Cross-site request forgery w IBM DataPower Gateway pozwala na wykonanie nieautoryzowanych działań.
Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps AI Engine ai-engine allows Cross Site Request Forgery.This issue affects AI Engine: from n/a through 3.8.8.
Cross-Site Request Forgery (CSRF) vulnerability in InstaWP InstaWP Connect instawp-connect allows Cross Site Request Forgery.This issue affects InstaWP Connect: from n/a through 0.1.4.2.
Dell SmartFabric Manager, versions prior to 2.2.1, contains an Insufficient Verification of Data Authenticity vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
Przepełnienie bufora w IBM AIX i PowerVM VIOS umożliwia lokalnemu atakującemu wykonanie dowolnego kodu.
Luka w Cilium umożliwia lokalnemu atakującemu dostęp do poufnych danych Envoy.
Błąd w OpenSIPS umożliwia zdalne wywołanie awarii serwera przez złośliwe SDP.
Błąd logiczny w stoatchat umożliwia zdalne pobranie całej historii wiadomości, co prowadzi do odmowy usługi.
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: fix mismatched DMA unmap size for large folios Device-private THP migration maps migration buffers with page_size() and records that length in dma_info->size. For a compound folio page_size() is PAGE_SIZE <<…
In the Linux kernel, the following vulnerability has been resolved: nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush nh_rt_cache_flush() walks nh->f6i_list during an RTNL-serialized nexthop replace without holding nh->lock, racing the unlocked IPv6 route add/delete that mutate the list…
In the Linux kernel, the following vulnerability has been resolved: nexthop: take nh->lock for f6i_list walks in replace check and notify fib6_check_nh_list() and __nexthop_replace_notify() walk nh->f6i_list during an RTNL-serialized nexthop replace without holding nh->lock.…
In the Linux kernel, the following vulnerability has been resolved: iommufd: Destroy the pages content after detaching from dmabuf Sashiko points out this has gotten out of order, the mutex could still be in use through the dmabuf invalidation callbacks. Don't destroy any of the pages content…
In the Linux kernel, the following vulnerability has been resolved: net: Stop leased rxq before uninstalling its memory provider netif_rxq_cleanup_unlease() tears down the memory provider that was installed on a physical RX queue through a netkit queue lease. It currently revokes the provider's…
Zephyr's dynamic kernel-object disposal path unref_check() in kernel/userspace/userspace.c frees an object's storage (k_free(dyn->data)) once its reference count reaches zero, after running a per-object-type cleanup. The cleanup switch handled only K_OBJ_MSGQ and K_OBJ_STACK; there was no…
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets The VCPU BO contains the actual FW at an offset, but it was not calculated into the VCPU BO size. Subtract this from the FW size to make sure there is no out of bounds…
Uszkodzenie pamięci podczas dekodowania uszkodzonych plików danych satelitarnych może prowadzić do zdalnego wykonania kodu.
In the Linux kernel, the following vulnerability has been resolved: namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE open_tree(OPEN_TREE_NAMESPACE) creates a new mount namespace from a copy of the tree at the given path. The caller needs to be privileged over its current user…
In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink(), rmdir() and rename() remove the entry from the filesystem, call detach_mounts() on the entry with the inode locked and then call d_delete() once the inode is…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Wstrzyknięcie SQL w Media Library Assistant umożliwia atakującym manipulację bazą danych. | Wstrzyknięcie SQL w Media Library Assistant umożliwia atakującym manipulację bazą danych. |
Obserwuj | 8,5 | 1,67 % | ||
| The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape… | The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors. |
Obserwuj | 8,8 | 0,17 % | ||
| An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the… | An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform. An unauthenticated, network-adjacent attacker can exploit an unauthenticated endpoint within the Single Sign-On (SSO) workflow to gain… |
Obserwuj | 8,8 | 0,17 % | ||
| Dereferencja nieufnego wskaźnika w WibuKey umożliwia lokalną eskalację uprawnień. | Dereferencja nieufnego wskaźnika w WibuKey umożliwia lokalną eskalację uprawnień. |
Obserwuj | 8,8 | 0,17 % | ||
| Przepełnienie bufora w IBM AIX i PowerVM VIOS umożliwia lokalnemu atakującemu wykonanie dowolnego kodu. | Przepełnienie bufora w IBM AIX i PowerVM VIOS umożliwia lokalnemu atakującemu wykonanie dowolnego kodu. |
Obserwuj | 8,8 | 0,17 % | ||
| Błąd zapisu poza granicami w IBM i umożliwia lokalnemu atakującemu wykonanie dowolnego kodu. | Błąd zapisu poza granicami w IBM i umożliwia lokalnemu atakującemu wykonanie dowolnego kodu. |
Obserwuj | 8,8 | 0,17 % | ||
| Brak egzekwowania silnych polityk haseł w routerze Quantum Networks umożliwia nieautoryzowany dostęp. | Brak egzekwowania silnych polityk haseł w routerze Quantum Networks umożliwia nieautoryzowany dostęp. |
Obserwuj | 8,8 | 0,17 % | ||
| Cross-site request forgery w IBM DataPower Gateway pozwala na wykonanie nieautoryzowanych działań. | Cross-site request forgery w IBM DataPower Gateway pozwala na wykonanie nieautoryzowanych działań. |
Obserwuj | 8,8 | 0,17 % | ||
| Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps AI Engine ai-engine allows Cross Site Request Forgery.This issue affects AI… | Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps AI Engine ai-engine allows Cross Site Request Forgery.This issue affects AI Engine: from n/a through 3.8.8. |
Obserwuj | 8,8 | 0,17 % | ||
| Cross-Site Request Forgery (CSRF) vulnerability in InstaWP InstaWP Connect instawp-connect allows Cross Site Request Forgery.This issue… | Cross-Site Request Forgery (CSRF) vulnerability in InstaWP InstaWP Connect instawp-connect allows Cross Site Request Forgery.This issue affects InstaWP Connect: from n/a through 0.1.4.2. |
Obserwuj | 8,8 | 0,17 % | ||
| Dell SmartFabric Manager, versions prior to 2.2.1, contains an Insufficient Verification of Data Authenticity vulnerability. | Dell SmartFabric Manager, versions prior to 2.2.1, contains an Insufficient Verification of Data Authenticity vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. |
Obserwuj | 8,8 | 0,17 % | ||
| Przepełnienie bufora w IBM AIX i PowerVM VIOS umożliwia lokalnemu atakującemu wykonanie dowolnego kodu. | Przepełnienie bufora w IBM AIX i PowerVM VIOS umożliwia lokalnemu atakującemu wykonanie dowolnego kodu. |
Obserwuj | 8,8 | 0,17 % | ||
| Luka w Cilium umożliwia lokalnemu atakującemu dostęp do poufnych danych Envoy. | Luka w Cilium umożliwia lokalnemu atakującemu dostęp do poufnych danych Envoy. |
Obserwuj | 8,8 | 0,17 % | ||
| Błąd w OpenSIPS umożliwia zdalne wywołanie awarii serwera przez złośliwe SDP. | Błąd w OpenSIPS umożliwia zdalne wywołanie awarii serwera przez złośliwe SDP. |
Obserwuj | 8,7 | 0,67 % | ||
| Błąd logiczny w stoatchat umożliwia zdalne pobranie całej historii wiadomości, co prowadzi do odmowy usługi. | Błąd logiczny w stoatchat umożliwia zdalne pobranie całej historii wiadomości, co prowadzi do odmowy usługi. |
Obserwuj | 8,7 | 0,67 % | ||
| In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: fix mismatched DMA unmap size for large… | In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: fix mismatched DMA unmap size for large folios Device-private THP migration maps migration buffers with page_size() and records that length in dma_info->size. For a compound folio page_size() is PAGE_SIZE <<… |
Obserwuj | 8,8 | 0,17 % | ||
| In the Linux kernel, the following vulnerability has been resolved: nexthop: avoid unlocked f6i_list walk in… | In the Linux kernel, the following vulnerability has been resolved: nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush nh_rt_cache_flush() walks nh->f6i_list during an RTNL-serialized nexthop replace without holding nh->lock, racing the unlocked IPv6 route add/delete that mutate the list… |
Obserwuj | 8,8 | 0,17 % | ||
| In the Linux kernel, the following vulnerability has been resolved: nexthop: take nh->lock for f6i_list walks in replace check and… | In the Linux kernel, the following vulnerability has been resolved: nexthop: take nh->lock for f6i_list walks in replace check and notify fib6_check_nh_list() and __nexthop_replace_notify() walk nh->f6i_list during an RTNL-serialized nexthop replace without holding nh->lock.… |
Obserwuj | 8,8 | 0,17 % | ||
| In the Linux kernel, the following vulnerability has been resolved: iommufd: Destroy the pages content after detaching from… | In the Linux kernel, the following vulnerability has been resolved: iommufd: Destroy the pages content after detaching from dmabuf Sashiko points out this has gotten out of order, the mutex could still be in use through the dmabuf invalidation callbacks. Don't destroy any of the pages content… |
Obserwuj | 8,8 | 0,17 % | ||
| In the Linux kernel, the following vulnerability has been resolved: net: Stop leased rxq before uninstalling its memory… | In the Linux kernel, the following vulnerability has been resolved: net: Stop leased rxq before uninstalling its memory provider netif_rxq_cleanup_unlease() tears down the memory provider that was installed on a physical RX queue through a netkit queue lease. It currently revokes the provider's… |
Obserwuj | 8,8 | 0,17 % | ||
| Zephyr's dynamic kernel-object disposal path unref_check() in kernel/userspace/userspace.c frees an object's storage (k_free(dyn->data))… | Zephyr's dynamic kernel-object disposal path unref_check() in kernel/userspace/userspace.c frees an object's storage (k_free(dyn->data)) once its reference count reaches zero, after running a per-object-type cleanup. The cleanup switch handled only K_OBJ_MSGQ and K_OBJ_STACK; there was no… |
Obserwuj | 8,8 | 0,17 % | ||
| In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets The VCPU BO… | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets The VCPU BO contains the actual FW at an offset, but it was not calculated into the VCPU BO size. Subtract this from the FW size to make sure there is no out of bounds… |
Obserwuj | 8,8 | 0,17 % | ||
| Uszkodzenie pamięci podczas dekodowania uszkodzonych plików danych satelitarnych może prowadzić do zdalnego wykonania kodu. | Uszkodzenie pamięci podczas dekodowania uszkodzonych plików danych satelitarnych może prowadzić do zdalnego wykonania kodu. |
Obserwuj | 8,8 | 0,17 % | ||
| In the Linux kernel, the following vulnerability has been resolved: namespace: keep covered mounts covered in… | In the Linux kernel, the following vulnerability has been resolved: namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE open_tree(OPEN_TREE_NAMESPACE) creates a new mount namespace from a copy of the tree at the given path. The caller needs to be privileged over its current user… |
Obserwuj | 8,8 | 0,16 % | ||
| In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on… | In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink(), rmdir() and rename() remove the entry from the filesystem, call detach_mounts() on the entry with the inode locked and then call d_delete() once the inode is… |
Obserwuj | 8,8 | 0,16 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.