Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
The Goodix GT9xx input driver in drivers/input/input_gt911.c reads the touch point count from the controller's status register and masks it with GT911_TOUCH_POINTS_MSK (0x0F), yielding a value of 0..15. In gt911_process() that value is used directly as the loop bound for filling point_reg[], a…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
In meta, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID:…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
The Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly sanitize and escape a value before using it in a SQL statement, which could allow users with the author role and above to perform SQL injection attacks.
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host.
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, and watch permissions on all Secret resources without resourceNames scoping. The operator only requires access to the pull-secret Secret. If the…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates arrays sized by unvalidated extended section and program header counts. Attackers can supply a crafted 128-byte ELF file that triggers an OutOfMemoryError during load-spec…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Netskope was notified about a potential gap in its Netskope Client for Windows systems where a malicious insider with administrative privileges can potentially tamper with the customer IOCTL by sending crafted IOCTL requests to the driver. A successful exploit can result in the bypassing of all…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Use of an insecure cryptographic algorithm in the cashless payment system using NFC wristbands from CasfID Servicios Tecnológicos S.L.U. (version used at Resurrection Fest 2025), which employs cards based on MIFARE Classic technology (FM11RF08S). The cryptographic weakness of the authentication…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
LINE client for iOS prior to 15.4 allows man-in-the-middle attacks due to improper SSL/TLS certificate validation in an integrated financial SDK. The SDK interfered with the application's network processing, causing server certificate verification to be disabled for a significant portion of…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed,…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and `GX_BINRES_DATA_INFO` has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
`_gx_binres_pixelmap_table_load()` in the GUIX binary resource (theme) loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table.
The overflowed…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
CVSS
6,8
EPSS
0,16 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
The Goodix GT9xx input driver in drivers/input/input_gt911.c reads the touch point count from the controller's status register and masks it with GT911_TOUCH_POINTS_MSK (0x0F), yielding a value of 0..15. In gt911_process() that value is used directly as the loop bound for filling point_reg[], a…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
In meta, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID:…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
The Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly sanitize and escape a value before using it in a SQL statement, which could allow users with the author role and above to perform SQL injection attacks.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, and watch permissions on all Secret resources without resourceNames scoping. The operator only requires access to the pull-secret Secret. If the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates arrays sized by unvalidated extended section and program header counts. Attackers can supply a crafted 128-byte ELF file that triggers an OutOfMemoryError during load-spec…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Netskope was notified about a potential gap in its Netskope Client for Windows systems where a malicious insider with administrative privileges can potentially tamper with the customer IOCTL by sending crafted IOCTL requests to the driver. A successful exploit can result in the bypassing of all…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Use of an insecure cryptographic algorithm in the cashless payment system using NFC wristbands from CasfID Servicios Tecnológicos S.L.U. (version used at Resurrection Fest 2025), which employs cards based on MIFARE Classic technology (FM11RF08S). The cryptographic weakness of the authentication…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
LINE client for iOS prior to 15.4 allows man-in-the-middle attacks due to improper SSL/TLS certificate validation in an integrated financial SDK. The SDK interfered with the application's network processing, causing server certificate verification to be disabled for a significant portion of…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and `GX_BINRES_DATA_INFO` has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
`_gx_binres_pixelmap_table_load()` in the GUIX binary resource (theme) loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table.
The overflowed…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
6,8
0,16 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjeOpóźnione lub nieustalone
NVD · aktualizacjeOpóźnione lub nieustalone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOpóźnione lub nieustaloneData modelu znajduje się przy rekordzie.