KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Błąd w Cisco IOS XR umożliwia zdalnym atakującym wywołanie odmowy usługi przez nieprawidłowy komunikat BGP.
Win32k Elevation of Privilege Vulnerability
Win32k Elevation of Privilege Vulnerability
Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR.
A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5, watchOS 5.3.7. Processing a maliciously crafted mail message may lead to heap corruption.
An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic.
Obejście ograniczeń plików w IBM InfoSphere BigInsights umożliwia dostęp do nieautoryzowanych danych.
Problem z przetwarzaniem złośliwie przygotowanego zdjęcia w iCloud może prowadzić do ataku.
The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.
Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver all versions from r0p0 - r42p0, Valhall GPU Kernel Driver all versions from r19p0 - r42p0, and Avalon GPU Kernel Driver all versions from r41p0 - r42p0 allows…
VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data…
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
The Sneeit Framework plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.3 via the sneeit_articles_pagination_callback() function. This is due to the function accepting user input and then passing that through call_user_func(). This makes it possible…
The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoint that exposes the 'Bearer Token' value when 'No-Auth URL' is enabled. This makes it possible for unauthenticated attackers to extract the…
Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitrary code by uploading a specially crafted file from a malicious (S)FTP server.
Wstrzyknięcie poleceń w LibreNMS umożliwia zdalne wykonanie dowolnego kodu.
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() function. This is due to the function accepting user input and then passing that through call_user_func_array(). This makes it possible for…
The Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the __construct function in all versions up to, and including, 3.6.0. This makes it possible for unauthenticated…
Luka w GitLab umożliwia nieautoryzowanym użytkownikom zdalne modyfikowanie lub usuwanie projektów.
Nieautoryzowani atakujący w Ghost mogą odczytywać dane z bazy danych.
Przepełnienie bufora w OpenSSL przy przetwarzaniu danych CMS może prowadzić do awarii usługi lub zdalnego wykonania kodu.
Obejście uwierzytelnienia w Ivanti Sentry pozwala na tworzenie kont administracyjnych bez autoryzacji.
net-snmp is a SNMP application library, tools and daemon. Prior to versions 5.9.5 and 5.10.pre2, a specially crafted packet to an net-snmp snmptrapd daemon can cause a buffer overflow and the daemon to crash. This issue has been patched in versions 5.9.5 and 5.10.pre2.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Błąd w Cisco IOS XR umożliwia zdalnym atakującym wywołanie odmowy usługi przez nieprawidłowy komunikat BGP. | Błąd w Cisco IOS XR umożliwia zdalnym atakującym wywołanie odmowy usługi przez nieprawidłowy komunikat BGP. |
Pilne działanie | 4,3 | 3,31 % | ||
| Win32k Elevation of Privilege Vulnerability | Win32k Elevation of Privilege Vulnerability |
Pilne działanie | 4,6 | 1,58 % | ||
| Win32k Elevation of Privilege Vulnerability | Win32k Elevation of Privilege Vulnerability |
Pilne działanie | 4,6 | 1,58 % | ||
| Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR. | Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR. |
Pilne działanie | 4,4 | 2,55 % | ||
| A memory consumption issue was addressed with improved memory handling. | A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5, watchOS 5.3.7. Processing a maliciously crafted mail message may lead to heap corruption. |
Pilne działanie | 4,3 | 2,18 % | ||
| An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to… | An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic. |
Pilne działanie | 4,4 | 0,89 % | ||
| Obejście ograniczeń plików w IBM InfoSphere BigInsights umożliwia dostęp do nieautoryzowanych danych. | Obejście ograniczeń plików w IBM InfoSphere BigInsights umożliwia dostęp do nieautoryzowanych danych. |
Pilne działanie | 3,5 | 4,77 % | ||
| Problem z przetwarzaniem złośliwie przygotowanego zdjęcia w iCloud może prowadzić do ataku. | Problem z przetwarzaniem złośliwie przygotowanego zdjęcia w iCloud może prowadzić do ataku. |
Pilne działanie | 4,2 | 1,19 % | ||
| The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump"… | The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025. |
Pilne działanie | 4,0 | 0,55 % | ||
| Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver… | Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver all versions from r0p0 - r42p0, Valhall GPU Kernel Driver all versions from r19p0 - r42p0, and Avalon GPU Kernel Driver all versions from r41p0 - r42p0 allows… |
Pilne działanie | 3,3 | 1,22 % | ||
| VMware ESX contains an insufficient logging vulnerability. | VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged. |
Pilne działanie | 2,7 | 0,3 % | ||
| Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder… | Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. |
Pilne działanie | Nieustalone | Nieustalone | Data nieustalonaData nieustalona | |
| Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged… | Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data… |
Pilne działanie | Nieustalone | Nieustalone | Data nieustalonaData nieustalona | |
| Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference… | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. |
Pilne działanie | Nieustalone | Nieustalone | Data nieustalonaData nieustalona | |
| The Sneeit Framework plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.3 via the… | The Sneeit Framework plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.3 via the sneeit_articles_pagination_callback() function. This is due to the function accepting user input and then passing that through call_user_func(). This makes it possible… |
Pilne działanie | 9,8 | 76,14 % | ||
| The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the… | The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoint that exposes the 'Bearer Token' value when 'No-Auth URL' is enabled. This makes it possible for unauthenticated attackers to extract the… |
Pilne działanie | 9,8 | 74,66 % | ||
| Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. | Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitrary code by uploading a specially crafted file from a malicious (S)FTP server. |
Pilne działanie | 9,8 | 72,68 % | ||
| Wstrzyknięcie poleceń w LibreNMS umożliwia zdalne wykonanie dowolnego kodu. | Wstrzyknięcie poleceń w LibreNMS umożliwia zdalne wykonanie dowolnego kodu. |
Pilne działanie | 9,1 | 73,31 % | ||
| The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via… | The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() function. This is due to the function accepting user input and then passing that through call_user_func_array(). This makes it possible for… |
Pilne działanie | 9,8 | 67,62 % | ||
| The Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to unauthorized… | The Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the __construct function in all versions up to, and including, 3.6.0. This makes it possible for unauthenticated… |
Pilne działanie | 9,8 | 61,48 % | ||
| Luka w GitLab umożliwia nieautoryzowanym użytkownikom zdalne modyfikowanie lub usuwanie projektów. | Luka w GitLab umożliwia nieautoryzowanym użytkownikom zdalne modyfikowanie lub usuwanie projektów. |
Pilne działanie | 9,1 | 60,2 % | ||
| Nieautoryzowani atakujący w Ghost mogą odczytywać dane z bazy danych. | Nieautoryzowani atakujący w Ghost mogą odczytywać dane z bazy danych. |
Pilne działanie | 9,4 | 56,66 % | ||
| Przepełnienie bufora w OpenSSL przy przetwarzaniu danych CMS może prowadzić do awarii usługi lub zdalnego wykonania kodu. | Przepełnienie bufora w OpenSSL przy przetwarzaniu danych CMS może prowadzić do awarii usługi lub zdalnego wykonania kodu. |
Pilne działanie | 9,8 | 52,45 % | ||
| Obejście uwierzytelnienia w Ivanti Sentry pozwala na tworzenie kont administracyjnych bez autoryzacji. | Obejście uwierzytelnienia w Ivanti Sentry pozwala na tworzenie kont administracyjnych bez autoryzacji. |
Pilne działanie | 9,9 | 47,19 % | ||
| net-snmp is a SNMP application library, tools and daemon. | net-snmp is a SNMP application library, tools and daemon. Prior to versions 5.9.5 and 5.10.pre2, a specially crafted packet to an net-snmp snmptrapd daemon can cause a buffer overflow and the daemon to crash. This issue has been patched in versions 5.9.5 and 5.10.pre2. |
Pilne działanie | 9,8 | 42,36 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.