KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Luka w Oracle WebCenter Enterprise Capture pozwala na przejęcie kontroli przez atakującego.
Luka w Oracle WebCenter Enterprise Capture pozwala na przejęcie kontroli przez atakującego.
Wykorzystanie luki w Oracle WebCenter Enterprise Capture pozwala na przejęcie kontroli nad systemem.
Wykryta luka w Cisco Smart Software Manager On-Prem pozwala na zdalne wykonanie poleceń z uprawnieniami roota.
Wykorzystanie podatności Zip Slip w RAGFlow pozwala na zdalne wykonanie kodu przez nadpisanie plików.
Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by…
ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed `Groovy compilation and loading` flow. An authenticated attacker can provide code that is compiled and instantiated…
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. The flaw stems from unvalidated dependent custom volume names in instance backup index.yaml files. Attackers can import a crafted…
Wykonanie kodu zdalnego w Autel Maxi Charger umożliwia nieautoryzowane pobieranie i uruchamianie plików.
The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This makes it possible for unauthenticated attackers to inject a PHP…
In the Linux kernel, the following vulnerability has been resolved: net: serialize netif_running() check in enqueue_to_backlog() Syzbot reported a KASAN slab-use-after-free in fib_rules_lookup(). The root cause is a race condition where packets can escape the backlog flushing during device…
Typebot is an open-source chatbot builder. In versions prior to 3.13.1, a Server-Side Request Forgery (SSRF) vulnerability in the Typebot webhook block (HTTP Request component) functionality allows authenticated users to make arbitrary HTTP requests from the server, including access to AWS…
Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network.
Luka w Flowise umożliwia nieautoryzowane przesyłanie plików, co może prowadzić do zdalnego wykonania kodu.
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by…
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may…
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets.
Słaba autoryzacja w Windows iSCSI pozwala nieautoryzowanemu atakującemu na obejście zabezpieczeń.
Podatność w PowerJob umożliwia zdalne wykonanie kodu bez uwierzytelnienia.
Luka w Oracle Universal Work Queue pozwala na przejęcie kontroli przez atakującego z niskimi uprawnieniami.
Luka w Oracle Universal Work Queue umożliwia przejęcie kontroli przez atakującego z niskimi uprawnieniami.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Luka w Oracle WebCenter Enterprise Capture pozwala na przejęcie kontroli przez atakującego. | Luka w Oracle WebCenter Enterprise Capture pozwala na przejęcie kontroli przez atakującego. |
W tym tygodniu | 9,9 | 0,41 % | ||
| Luka w Oracle WebCenter Enterprise Capture pozwala na przejęcie kontroli przez atakującego. | Luka w Oracle WebCenter Enterprise Capture pozwala na przejęcie kontroli przez atakującego. |
W tym tygodniu | 9,9 | 0,41 % | ||
| Wykorzystanie luki w Oracle WebCenter Enterprise Capture pozwala na przejęcie kontroli nad systemem. | Wykorzystanie luki w Oracle WebCenter Enterprise Capture pozwala na przejęcie kontroli nad systemem. |
W tym tygodniu | 9,9 | 0,41 % | ||
| Wykryta luka w Cisco Smart Software Manager On-Prem pozwala na zdalne wykonanie poleceń z uprawnieniami roota. | Wykryta luka w Cisco Smart Software Manager On-Prem pozwala na zdalne wykonanie poleceń z uprawnieniami roota. |
W tym tygodniu | 9,8 | 0,91 % | ||
| Wykorzystanie podatności Zip Slip w RAGFlow pozwala na zdalne wykonanie kodu przez nadpisanie plików. | Wykorzystanie podatności Zip Slip w RAGFlow pozwala na zdalne wykonanie kodu przez nadpisanie plików. |
Pilne działanie | 9,8 | 0,91 % | ||
| Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network. |
W tym tygodniu | 9,8 | 0,91 % | ||
| Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine |
W tym tygodniu | 9,8 | 0,91 % | ||
| Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. |
W tym tygodniu | 9,8 | 0,91 % | ||
| Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network. | Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network. |
W tym tygodniu | 9,8 | 0,91 % | ||
| As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security… | As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by… |
W tym tygodniu | 9,9 | 0,41 % | ||
| ThingLinks is an enterprise IoT platform. | ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed `Groovy compilation and loading` flow. An authenticated attacker can provide code that is compiled and instantiated… |
W tym tygodniu | 9,9 | 0,41 % | ||
| Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to… | Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. The flaw stems from unvalidated dependent custom volume names in instance backup index.yaml files. Attackers can import a crafted… |
W tym tygodniu | 9,9 | 0,4 % | ||
| Wykonanie kodu zdalnego w Autel Maxi Charger umożliwia nieautoryzowane pobieranie i uruchamianie plików. | Wykonanie kodu zdalnego w Autel Maxi Charger umożliwia nieautoryzowane pobieranie i uruchamianie plików. |
Pilne działanie | 9,8 | 0,91 % | ||
| The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and… | The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This makes it possible for unauthenticated attackers to inject a PHP… |
W tym tygodniu | 9,8 | 0,9 % | ||
| In the Linux kernel, the following vulnerability has been resolved: net: serialize netif_running() check in enqueue_to_backlog() Syzbot… | In the Linux kernel, the following vulnerability has been resolved: net: serialize netif_running() check in enqueue_to_backlog() Syzbot reported a KASAN slab-use-after-free in fib_rules_lookup(). The root cause is a race condition where packets can escape the backlog flushing during device… |
W tym tygodniu | 9,9 | 0,4 % | ||
| Typebot is an open-source chatbot builder. | Typebot is an open-source chatbot builder. In versions prior to 3.13.1, a Server-Side Request Forgery (SSRF) vulnerability in the Typebot webhook block (HTTP Request component) functionality allows authenticated users to make arbitrary HTTP requests from the server, including access to AWS… |
Pilne działanie | 9,9 | 0,4 % | ||
| Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network. | Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network. |
W tym tygodniu | 9,9 | 0,4 % | ||
| Luka w Flowise umożliwia nieautoryzowane przesyłanie plików, co może prowadzić do zdalnego wykonania kodu. | Luka w Flowise umożliwia nieautoryzowane przesyłanie plików, co może prowadzić do zdalnego wykonania kodu. |
Pilne działanie | 9,8 | 0,9 % | ||
| As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security… | As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by… |
W tym tygodniu | 9,9 | 0,4 % | ||
| Vulnerability in Oracle Essbase (component: Security). | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may… |
W tym tygodniu | 9,9 | 0,4 % | ||
| EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary… | EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets. |
W tym tygodniu | 9,9 | 0,4 % | ||
| Słaba autoryzacja w Windows iSCSI pozwala nieautoryzowanemu atakującemu na obejście zabezpieczeń. | Słaba autoryzacja w Windows iSCSI pozwala nieautoryzowanemu atakującemu na obejście zabezpieczeń. |
W tym tygodniu | 9,8 | 0,9 % | ||
| Podatność w PowerJob umożliwia zdalne wykonanie kodu bez uwierzytelnienia. | Podatność w PowerJob umożliwia zdalne wykonanie kodu bez uwierzytelnienia. |
W tym tygodniu | 9,8 | 0,9 % | ||
| Luka w Oracle Universal Work Queue pozwala na przejęcie kontroli przez atakującego z niskimi uprawnieniami. | Luka w Oracle Universal Work Queue pozwala na przejęcie kontroli przez atakującego z niskimi uprawnieniami. |
W tym tygodniu | 9,9 | 0,4 % | ||
| Luka w Oracle Universal Work Queue umożliwia przejęcie kontroli przez atakującego z niskimi uprawnieniami. | Luka w Oracle Universal Work Queue umożliwia przejęcie kontroli przez atakującego z niskimi uprawnieniami. |
W tym tygodniu | 9,9 | 0,4 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.