Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
The FindAll Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.4. This is due to the plugin not properly logging in a user with the data that was previously verified through the 'findall_membership_check_facebook_user' and the…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
ipv4: free inet_opt and ireq_opt after an RCU grace period
tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the
child socket (newinet->inet_opt) without copying it.
Another cpu can concurrently process a…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
xfrm: Fix skb double-free in xfrm_dev_direct_output()
A return value other than 1 from local_out() means that the skb has been
consumed or its ownership was transferred. xfrm_dev_direct_output()
nevertheless frees the skb on…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Prevent stale XSK buffer release on refill retry
When an XDP redirect to an AF_XDP socket fails because its RX ring is
full, the XSK core frees the buffer. During the subsequent batched refill
of a legacy cyclic RQ,…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
With AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until
an MPWQE is refilled. If XSK allocation then returns -ENOMEM,
actual_wq_head is not…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 messages. This could lead to remote code execution or denial of service with no additional execution privileges needed.
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read,…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: xsk: Fix invalid buffer access for legacy rq
The below crash can be encountered when using xdpsock in rx mode for
legacy rq: the buffer gets released in the XDP_REDIRECT path, and then
once again in the driver. This…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
The Simple User Capabilities plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the suc_submit_capabilities() function in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to elevate the role of any user…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview> guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
CVSS
9,8
EPSS
0,45 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
The FindAll Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.4. This is due to the plugin not properly logging in a user with the data that was previously verified through the 'findall_membership_check_facebook_user' and the…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
ipv4: free inet_opt and ireq_opt after an RCU grace period
tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the
child socket (newinet->inet_opt) without copying it.
Another cpu can concurrently process a…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
xfrm: Fix skb double-free in xfrm_dev_direct_output()
A return value other than 1 from local_out() means that the skb has been
consumed or its ownership was transferred. xfrm_dev_direct_output()
nevertheless frees the skb on…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Prevent stale XSK buffer release on refill retry
When an XDP redirect to an AF_XDP socket fails because its RX ring is
full, the XSK core frees the buffer. During the subsequent batched refill
of a legacy cyclic RQ,…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
With AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until
an MPWQE is refilled. If XSK allocation then returns -ENOMEM,
actual_wq_head is not…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 messages. This could lead to remote code execution or denial of service with no additional execution privileges needed.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read,…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: xsk: Fix invalid buffer access for legacy rq
The below crash can be encountered when using xdpsock in rx mode for
legacy rq: the buffer gets released in the XDP_REDIRECT path, and then
once again in the driver. This…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
The Simple User Capabilities plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the suc_submit_capabilities() function in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to elevate the role of any user…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview> guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
9,8
0,45 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.