Podatności

A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with `txm_module_object_deallocate`. The manager released it whatever was in it, including a control block the kernel was still using. Deallocation…

CVSS 8,5 · EPSS 0,15 % · rekomendacja wg zapisanej polityki

The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte. The common Module Manager hands its range check the module instance, the start address and the complete byte size; the Cortex-A7 implementation discarded the instance and the size and…

CVSS 8,5 · EPSS 0,15 % · rekomendacja wg zapisanej polityki

An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link library (DLL) that is later loaded by a high-privilege process. Refer to the ' Security Update for Armoury Crate App '…

CVSS 8,5 · EPSS 0,12 % · rekomendacja wg zapisanej polityki

Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Partner…

CVSS 8,4 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface). The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to…

CVSS 8,4 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.20. Easily exploitable vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the…

CVSS 8,4 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside…

CVSS 8,4 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has already supplied transparency, but nothing prevents an IHDR being read a second time. A PNG carries exactly one IHDR and it is the first chunk. A file that places a second one…

CVSS 8,4 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD…

CVSS 8,4 · EPSS 0,15 % · rekomendacja wg zapisanej polityki

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise…

CVSS 8,4 · EPSS 0,15 % · rekomendacja wg zapisanej polityki

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). Supported versions that are affected are 11.3 and 11.4. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle…

CVSS 8,4 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork()'s and calls execl("/vendor/bin/sh", "sh", "-c", cmd, NULL) with a caller-supplied command string. The only authorization check is…

CVSS 8,4 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to…

CVSS 8,4 · EPSS 0,11 % · rekomendacja wg zapisanej polityki

IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management.

CVSS 8,4 · EPSS 0,09 % · rekomendacja wg zapisanej polityki

Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to…

CVSS 8,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.…

CVSS 8,3 · EPSS 0,39 % · rekomendacja wg zapisanej polityki

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to…

CVSS 8,3 · EPSS 0,39 % · rekomendacja wg zapisanej polityki

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable…

CVSS 8,3 · EPSS 0,38 % · rekomendacja wg zapisanej polityki

Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations. Attackers holding any secret API key can supply a victim run ID with their own waitpoint, causing that…

CVSS 8,3 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session…

CVSS 8,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical…

CVSS 8,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki

MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit…

CVSS 8,2 · EPSS 0,56 % · rekomendacja wg zapisanej polityki

libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is…

CVSS 8,2 · EPSS 0,47 % · rekomendacja wg zapisanej polityki

A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system.

CVSS 8,2 · EPSS 0,47 % · rekomendacja wg zapisanej polityki

A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system.

CVSS 8,2 · EPSS 0,47 % · rekomendacja wg zapisanej polityki