KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised.
Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a fix has been released in 5.4.8. For…
Luka w Windows Event Tracing umożliwia eskalację uprawnień.
Luka XSS w Zimbra Classic UI umożliwia wykonanie dowolnego JavaScriptu w sesji użytkownika.
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process.
Niedostateczna autoryzacja w WhatsApp pozwala na przetwarzanie treści z dowolnego URL na urządzeniu ofiary.
Win32k Elevation of Privilege Vulnerability
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its…
Wstrzyknięcie skryptów w Microsoft Exchange Server umożliwia oszustwa sieciowe.
An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A local user may be able to view sensitive user information.
Błąd w Arm Trusted Firmware M umożliwia nieautoryzowane wywołanie funkcji zabezpieczających.
This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to modify sensitive kernel state. Apple is aware of a…
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Mark of the Web Security Feature Bypass Vulnerability
Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper…
Microsoft DWM Core Library Elevation of Privilege Vulnerability
Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.
Obejście zabezpieczeń Mark of the Web w Windows umożliwia uruchomienie złośliwego kodu.
Błąd w jądrze Linuxa pozwalał na nieprzewidywalne przeplatanie danych przy równoczesnych zapisach w gnieździe af_alg.
Obejście zabezpieczeń Mark of the Web w Windows umożliwia uruchomienie złośliwego kodu.
An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macOS Monterey 12.3.1, Security Update 2022-004 Catalina, macOS Big Sur 11.6.6. A local user may be able to read kernel memory.
A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.
An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace.
Brak inicjalizacji bufora raportu w jądrze Linux umożliwia wyciek pamięci jądra.
<p>A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio… | A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised. |
Pilne działanie | 6,4 | 0,37 % | ||
| Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. | Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a fix has been released in 5.4.8. For… |
Pilne działanie | 6,1 | 1,86 % | ||
| Luka w Windows Event Tracing umożliwia eskalację uprawnień. | Luka w Windows Event Tracing umożliwia eskalację uprawnień. |
Pilne działanie | 4,6 | 9,25 % | ||
| Luka XSS w Zimbra Classic UI umożliwia wykonanie dowolnego JavaScriptu w sesji użytkownika. | Luka XSS w Zimbra Classic UI umożliwia wykonanie dowolnego JavaScriptu w sesji użytkownika. |
Pilne działanie | 6,1 | 1,71 % | ||
| VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. | VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process. |
Pilne działanie | 6,0 | 1,77 % | ||
| Niedostateczna autoryzacja w WhatsApp pozwala na przetwarzanie treści z dowolnego URL na urządzeniu ofiary. | Niedostateczna autoryzacja w WhatsApp pozwala na przetwarzanie treści z dowolnego URL na urządzeniu ofiary. |
Pilne działanie | 5,4 | 4,73 % | ||
| Win32k Elevation of Privilege Vulnerability | Win32k Elevation of Privilege Vulnerability |
Pilne działanie | 4,6 | 8,4 % | ||
| An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its… |
Pilne działanie | 5,4 | 4,06 % | ||
| Wstrzyknięcie skryptów w Microsoft Exchange Server umożliwia oszustwa sieciowe. | Wstrzyknięcie skryptów w Microsoft Exchange Server umożliwia oszustwa sieciowe. |
Pilne działanie | 6,1 | 0,52 % | ||
| An issue existed in the handling of environment variables. | An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A local user may be able to view sensitive user information. |
Pilne działanie | 5,5 | 3,21 % | ||
| Błąd w Arm Trusted Firmware M umożliwia nieautoryzowane wywołanie funkcji zabezpieczających. | Błąd w Arm Trusted Firmware M umożliwia nieautoryzowane wywołanie funkcji zabezpieczających. |
Pilne działanie | 5,5 | 3,09 % | ||
| This issue was addressed with improved state management. | This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to modify sensitive kernel state. Apple is aware of a… |
Pilne działanie | 5,5 | 2,9 % | ||
| Windows Common Log File System Driver Elevation of Privilege Vulnerability | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
Pilne działanie | 4,6 | 7,08 % | ||
| Windows Mark of the Web Security Feature Bypass Vulnerability | Windows Mark of the Web Security Feature Bypass Vulnerability |
Pilne działanie | 5,4 | 3,06 % | ||
| Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. | Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper… |
Pilne działanie | 5,3 | 3,45 % | ||
| Microsoft DWM Core Library Elevation of Privilege Vulnerability | Microsoft DWM Core Library Elevation of Privilege Vulnerability |
Pilne działanie | 4,6 | 6,56 % | ||
| Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. | Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. |
Pilne działanie | 5,5 | 2,02 % | ||
| Obejście zabezpieczeń Mark of the Web w Windows umożliwia uruchomienie złośliwego kodu. | Obejście zabezpieczeń Mark of the Web w Windows umożliwia uruchomienie złośliwego kodu. |
Pilne działanie | 5,4 | 2,49 % | ||
| Błąd w jądrze Linuxa pozwalał na nieprzewidywalne przeplatanie danych przy równoczesnych zapisach w gnieździe af_alg. | Błąd w jądrze Linuxa pozwalał na nieprzewidywalne przeplatanie danych przy równoczesnych zapisach w gnieździe af_alg. |
Pilne działanie | 5,5 | 1,36 % | ||
| Obejście zabezpieczeń Mark of the Web w Windows umożliwia uruchomienie złośliwego kodu. | Obejście zabezpieczeń Mark of the Web w Windows umożliwia uruchomienie złośliwego kodu. |
Pilne działanie | 5,4 | 1,81 % | ||
| An out-of-bounds read issue existed that led to the disclosure of kernel memory. | An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macOS Monterey 12.3.1, Security Update 2022-004 Catalina, macOS Big Sur 11.6.6. A local user may be able to read kernel memory. |
Pilne działanie | 5,5 | 1,13 % | ||
| A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory. | A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory. |
Pilne działanie | 5,5 | 1,1 % | ||
| An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace. | An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace. |
Pilne działanie | 5,5 | 1,08 % | ||
| Brak inicjalizacji bufora raportu w jądrze Linux umożliwia wyciek pamięci jądra. | Brak inicjalizacji bufora raportu w jądrze Linux umożliwia wyciek pamięci jądra. |
Pilne działanie | 5,5 | 0,81 % | ||
| <p>A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. | <p>A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the… |
Pilne działanie | 5,1 | 2,7 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.