KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
4MOSAn developed by 4MOSAn Security Technology Co., Ltd. has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit a Relative Path Traversal flaw to download arbitrary system files.
In the Linux kernel, the following vulnerability has been resolved: namei: don't reveal overmounted entries in refwalk In rcuwalk the dentry is validated before it is accepted. step_into() step_into() rechecks d_seq and __follow_mount_rcu() rechecks mount_lock. An entry that gets unlinked in…
In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY kvm_arch_prepare_memory_region() computes new->arch.flags, i.e. whether a memslot is KVM_MEM_HUGEPAGE_CAPABLE or KVM_MEM_HUGEPAGE_INCAPABLE, only for KVM_MR_CREATE…
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add TLB flush after MES queue eviction/suspension MES (Micro Engine Scheduler) does not perform heavy-weight TLB invalidation after unmapping queues, unlike HWS which does this automatically. This causes a race…
Użycie pożyczonego uchwytu w IOMMUFD prowadzi do wykorzystania po zwolnieniu pamięci.
In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: fix TX DMA buffer flush When transmit flushing a qcom-geni UART during an ongoing TX DMA, the UART gets stuck infinitely repeating corrupted TX DMA frames. The DMA-mode uart_ops does not provide a…
In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopf_group_alloc() links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufd_fault_iopf_handler() also queued an accepted…
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Add a max slot check for SQ The variable WQE mode must be validated against the maximum slots supported by HW. The max supported value is 64K. Adding a max and min check and fail if user supplied value is more than…
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Free CQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxt_qplib_destroy_cq() won't write the toggle value to an…
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxt_qplib_destroy_srq() won't write the toggle values to an…
In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt() Function kvm_vcpu_ioctl_interrupt() can be called from userspace, here add irq validility cheking in kvm_vcpu_ioctl_interrupt().
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs The intra-host migration/mirroring feature is not fully implemented for SEV-SNP VMs. The proper migration requires additional SNP-specific state such as…
Błędne domyślne uprawnienia w ArubaSign umożliwiają zdalne wykonanie kodu przez nieuprawnionych użytkowników.
Wykorzystanie po zwolnieniu pamięci w rozszerzeniach Google Chrome na Mac umożliwia zdalne wykonanie kodu.
Luka w walidacji certyfikatów w Palo Alto umożliwia zdalne wykonanie kodu z uprawnieniami SYSTEM.
OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the password reset workflow does not enforce that the username submitted in the final reset request matches the account for which the reset process was originally initiated. After obtaining a valid reset…
`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing…
Obejście kontroli dostępu w WSO2 APIM pozwala na nieautoryzowane operacje przez użytkowników.
In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID tegra241_vintf_init_vsid() maps a guest vSID to a single physical Stream ID taken from master->streams[0], and only warns when the device does not have exactly one…
In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Validate MSI data before routing it to EIOINTC pch_msi_set_irq() passes e->msi.data straight into eiointc_set_irq() as the irq number. The MSI data comes from userspace, that either via a KVM_IRQ_ROUTING_MSI…
Przepełnienie bufora w jądrze Linuxa umożliwia odczyt i zapis poza przydzieloną pamięcią.
In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: reject feature changes after endpoint vhost_scsi_setup_vq_cmds() runs from VHOST_SCSI_SET_ENDPOINT and allocates each command's protection scatterlist array (prot_sgl) according to the acknowledged…
W Glances przed wersją 4.5.6 wstrzyknięcie złośliwych danych może prowadzić do wykonania poleceń.
In the Linux kernel, the following vulnerability has been resolved: iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path In iommu_dma_map_sg(), when handling PCI P2PDMA cases, the DMA length of the current scatterlist segment `s` is incorrectly assigned from the head entry…
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race in unix socket mediation when peer_path is used The holding a reference to the peer_sk is not enough to ensure access to the peer sk path. Accessing the path outside of the state lock allows for a race with…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| 4MOSAn developed by 4MOSAn Security Technology Co., Ltd. | 4MOSAn developed by 4MOSAn Security Technology Co., Ltd. has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit a Relative Path Traversal flaw to download arbitrary system files. |
Obserwuj | 8,7 | 0,68 % | ||
| In the Linux kernel, the following vulnerability has been resolved: namei: don't reveal overmounted entries in refwalk In rcuwalk the… | In the Linux kernel, the following vulnerability has been resolved: namei: don't reveal overmounted entries in refwalk In rcuwalk the dentry is validated before it is accepted. step_into() step_into() rechecks d_seq and __follow_mount_rcu() rechecks mount_lock. An entry that gets unlinked in… |
Obserwuj | 8,8 | 0,18 % | ||
| In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Preserve memslot arch flags on… | In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY kvm_arch_prepare_memory_region() computes new->arch.flags, i.e. whether a memslot is KVM_MEM_HUGEPAGE_CAPABLE or KVM_MEM_HUGEPAGE_INCAPABLE, only for KVM_MR_CREATE… |
Obserwuj | 8,8 | 0,18 % | ||
| In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add TLB flush after MES queue eviction/suspension MES… | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add TLB flush after MES queue eviction/suspension MES (Micro Engine Scheduler) does not perform heavy-weight TLB invalidation after unmapping queues, unlike HWS which does this automatically. This causes a race… |
Obserwuj | 8,8 | 0,18 % | ||
| Użycie pożyczonego uchwytu w IOMMUFD prowadzi do wykorzystania po zwolnieniu pamięci. | Użycie pożyczonego uchwytu w IOMMUFD prowadzi do wykorzystania po zwolnieniu pamięci. |
Obserwuj | 8,8 | 0,18 % | ||
| In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: fix TX DMA buffer flush When transmit flushing a… | In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: fix TX DMA buffer flush When transmit flushing a qcom-geni UART during an ongoing TX DMA, the UART gets stuck infinitely repeating corrupted TX DMA frames. The DMA-mode uart_ops does not provide a… |
Obserwuj | 8,8 | 0,18 % | ||
| In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopf_group_alloc() links… | In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopf_group_alloc() links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufd_fault_iopf_handler() also queued an accepted… |
Obserwuj | 8,8 | 0,18 % | ||
| In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Add a max slot check for SQ The variable WQE mode must… | In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Add a max slot check for SQ The variable WQE mode must be validated against the maximum slots supported by HW. The max supported value is 64K. Adding a max and min check and fail if user supplied value is more than… |
Obserwuj | 8,8 | 0,18 % | ||
| In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Free CQ toggle page after firmware teardown Free the… | In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Free CQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxt_qplib_destroy_cq() won't write the toggle value to an… |
Obserwuj | 8,8 | 0,18 % | ||
| In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown Free the… | In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxt_qplib_destroy_srq() won't write the toggle values to an… |
Obserwuj | 8,8 | 0,18 % | ||
| In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Check irq validity in… | In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt() Function kvm_vcpu_ioctl_interrupt() can be called from userspace, here add irq validility cheking in kvm_vcpu_ioctl_interrupt(). |
Obserwuj | 8,8 | 0,18 % | ||
| In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs The… | In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs The intra-host migration/mirroring feature is not fully implemented for SEV-SNP VMs. The proper migration requires additional SNP-specific state such as… |
Obserwuj | 8,8 | 0,18 % | ||
| Błędne domyślne uprawnienia w ArubaSign umożliwiają zdalne wykonanie kodu przez nieuprawnionych użytkowników. | Błędne domyślne uprawnienia w ArubaSign umożliwiają zdalne wykonanie kodu przez nieuprawnionych użytkowników. |
Obserwuj | 8,8 | 0,18 % | ||
| Wykorzystanie po zwolnieniu pamięci w rozszerzeniach Google Chrome na Mac umożliwia zdalne wykonanie kodu. | Wykorzystanie po zwolnieniu pamięci w rozszerzeniach Google Chrome na Mac umożliwia zdalne wykonanie kodu. |
Obserwuj | 8,8 | 0,18 % | ||
| Luka w walidacji certyfikatów w Palo Alto umożliwia zdalne wykonanie kodu z uprawnieniami SYSTEM. | Luka w walidacji certyfikatów w Palo Alto umożliwia zdalne wykonanie kodu z uprawnieniami SYSTEM. |
Obserwuj | 8,8 | 0,18 % | ||
| OrangeHRM is a comprehensive human resource management (HRM) system. | OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the password reset workflow does not enforce that the username submitted in the final reset request matches the account for which the reset process was originally initiated. After obtaining a valid reset… |
Obserwuj | 8,8 | 0,18 % | ||
| `HmacShaCryptor.Hash` never hashed its input. | `HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing… |
Obserwuj | 8,8 | 0,17 % | ||
| Obejście kontroli dostępu w WSO2 APIM pozwala na nieautoryzowane operacje przez użytkowników. | Obejście kontroli dostępu w WSO2 APIM pozwala na nieautoryzowane operacje przez użytkowników. |
Obserwuj | 8,8 | 0,17 % | ||
| In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Require exactly one Stream ID for a… | In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID tegra241_vintf_init_vsid() maps a guest vSID to a single physical Stream ID taken from master->streams[0], and only warns when the device does not have exactly one… |
Obserwuj | 8,8 | 0,17 % | ||
| In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Validate MSI data before routing it to… | In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Validate MSI data before routing it to EIOINTC pch_msi_set_irq() passes e->msi.data straight into eiointc_set_irq() as the irq number. The MSI data comes from userspace, that either via a KVM_IRQ_ROUTING_MSI… |
Obserwuj | 8,8 | 0,17 % | ||
| Przepełnienie bufora w jądrze Linuxa umożliwia odczyt i zapis poza przydzieloną pamięcią. | Przepełnienie bufora w jądrze Linuxa umożliwia odczyt i zapis poza przydzieloną pamięcią. |
Obserwuj | 8,8 | 0,17 % | ||
| In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: reject feature changes after… | In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: reject feature changes after endpoint vhost_scsi_setup_vq_cmds() runs from VHOST_SCSI_SET_ENDPOINT and allocates each command's protection scatterlist array (prot_sgl) according to the acknowledged… |
Obserwuj | 8,8 | 0,17 % | ||
| W Glances przed wersją 4.5.6 wstrzyknięcie złośliwych danych może prowadzić do wykonania poleceń. | W Glances przed wersją 4.5.6 wstrzyknięcie złośliwych danych może prowadzić do wykonania poleceń. |
Obserwuj | 8,8 | 0,17 % | ||
| In the Linux kernel, the following vulnerability has been resolved: iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA… | In the Linux kernel, the following vulnerability has been resolved: iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path In iommu_dma_map_sg(), when handling PCI P2PDMA cases, the DMA length of the current scatterlist segment `s` is incorrectly assigned from the head entry… |
Obserwuj | 8,8 | 0,17 % | ||
| In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race in unix socket mediation when peer_path is… | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race in unix socket mediation when peer_path is used The holding a reference to the peer_sk is not enough to ensure access to the peer sk path. Accessing the path outside of the state lock allows for a race with… |
Obserwuj | 8,8 | 0,17 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.