4542 karet z 5015 položek
· strana 10 z 76
CZ ·
EN/orig
Hvězdička u CVE znamená, že jsem to číslo vytáhl z širšího textu článku.
Neukazuju u něj proto KEV, EPSS ani CVSS, a to preventivně, protože článek se na něj mohl
jen odkazovat, třeba jako na starší kauzu.
IBM heeft meerdere kwetsbaarheden verholpen in IBM Guardium Data Protection versies 12.0, 12.1 en 12.2. De kwetsbaarheden betreffen onder andere remote code execution via path traversal, meerdere SQL-injectieproblemen, en diverse buffer overflow kwetsbaarheden (heap-based, stack-based en buffer overrun) in verschillende componenten zoals de MongoDB protocol parser en de TDS PRELOGIN packet decoder. Aanvallers kunnen deze kwetsbaarheden misbruiken om zonder authenticatie willekeurige code uit te…
HPE heeft meerdere beveiligingsproblemen verholpen in Brocade Fabric OS, specifiek in versies vóór 10.0.1 en in de 9.2.x en 10.0.x release lijnen. De kwetsbaarheden omvatten onder andere authenticatieomzeiling, denial of service, informatielekken, privilege-escalatie, buffer overflows, command injection, en arbitrary code execution. Aanvallers kunnen via verschillende aanvalsvectoren, zoals speciaal vervaardigde managementverzoeken, REST API-aanroepen, web management interfaces, en…
BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August. [...]
IBM heeft meerdere beveiligingsproblemen opgelost in DataPower Gateway versies 10.5 tot 11.0 en een veelvoud aan onderliggende subcomponenten. De kwetsbaarheden betreffen een breed scala aan problemen zoals use-after-free bugs, race conditions, buffer overflows, null pointer dereferences, integer overflows, geheugenlekken, onjuiste validatie, en cryptografische fouten. Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die remote code execution, denial of service,…
Juniper heeft meerdere kwetsbaarheden verholpen in Junos OS. De kwetsbaarheden bevinden zich in verschillende componenten van Junos OS, waaronder de VXLAN Gateway Daemon (vgd), kmd op MX Series routers, SDK service met JDAF routing, TWAMP client (rmopd service), gRPC library, ipfd daemon op SRX Series, dot1x daemon op Fusion Aggregation Devices, routing protocol daemon (rpd) op MX Series, jdhcpd process, authd process, kernel bij Extended Echo, pkid component, UTM Anti-Spam SBL component op SRX…
This vulnerability allows local attackers to escalate privileges on affected installations of FreeBSD Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-58094.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of LibreOffice. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-6045.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of LibreOffice. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-63274.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of LibreOffice. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-63273.
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Sparx Systems Enterprise Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 5.5. The following CVEs are assigned: CVE-2026-88794.
This vulnerability allows local attackers to disclose sensitive information on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 4.4. The following CVEs are assigned: CVE-2026-93536.
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.1, CVEs: CVE-2026-71575, Summary: The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-up authentication policies. Users are recommended to upgrade to versions 4…
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.1, CVEs: CVE-2026-111096, CVE-2026-111095, CVE-2026-111094, Summary: CVE-2026-111096 : In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible CVE-2026-111095 : In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible CVE-2026-111094 : In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote…
Classification: Critical, Solution: Official Fix, Exploit Maturity: Proof-of-Concept, CVSSv3.1: 9.9, CVEs: CVE-2026-105740, Summary: Any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c "exec {command}" with zero validation, no allowlisting, and no sandboxing. The command executes immediately when the server list is fetched. Additionally, the env…
CISA added CVE-2025-61624 to the Known Exploited Vulnerabilities catalog. Affected product: Fortinet Multiple Products. Remediation due date: 2026-10-19.
De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
De multiples vulnérabilités ont été découvertes dans le noyau Linux de SUSE. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Red Hat. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
De multiples vulnérabilités ont été découvertes dans le noyau Linux d'Ubuntu. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.
De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
De multiples vulnérabilités ont été découvertes dans Microsoft Office. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.
De multiples vulnérabilités ont été découvertes dans Traefik. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et un contournement de la politique de sécurité.
De multiples vulnérabilités ont été découvertes dans Google Chrome. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
De multiples vulnérabilités ont été découvertes dans les produits Mattermost. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Serial number: AV26-1053 Date: October 15, 2026 As of October 15, 2026, SUSE is affected by vulnerabilities in the following products: Rancher Prior to 2.10.5 Prior to 2.11.1 Prior to 2.9.9 Steve Prior to 0.2.1 Prior to 0.3.3 Prior to 0.4.4 Prior to 0.5.13 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Users who can create Projects can gain access to arbitrary projects Steve doesn’t verify a…
Serial number: AV26-1052 Date: October 15, 2026 As of October 7, 2026, Johnson Controls is affected by a vulnerability in the following product: ADVMS Prior to 3.10 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Vulnerability impacting American Dynamics VMS - JCI-PSA-2026-17 Johnson Controls Product Security Advisories
Serial number: AV26-1051 Date: October 15, 2026 As of October 13, 2026, Schneider Electric is affected by a vulnerability in the following products: Sage RTU 1410/1430/1450 Versions prior to C3414-500-S02L0 Sage RTU 2400 Versions prior to C3414-500-S02L0 Sage RTU 3030 Magnum Versions prior to C3414-500-S02L0 Sage RTU 4400 Versions prior to C3414-500-S02L0 The Cyber Centre encourages users and administrators to review the provided web link perform the suggested mitigations and apply the…
Serial number: AV26-1050 Date: October 15, 2026 As of October 15, 2026, JetBrains is affected by vulnerabilities in the following products: Datalore Prior to 2026.2.1 Junie CLI Prior to 26.8.3 TeamCity Prior to 2026.2 Prior to 2026.1.4 Prior to 2025.11.8 YouTrack Prior to 2026.2.19575 Piror to 2026.3.16075 Prior to 2026.3.16397 Prior to 2026.3.16402 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.…
Serial number: AV26-1049 Date: October 15, 2026 As of October 14, 2026, F5 is affected by vulnerabilities in the following products: NGINX Gateway Fabric Prior to 2.8.0 NGINX Ingress Controller Prior to 5.7.0 NGINX JavaScript Prior to 1.0.2 NGINX Open Source Prior to 1.30.6 Prior to 1.31.7 NGINX Plus Prior to 37.0.5.1 Prior to 37.1.0.1 Versions R33 to R36 NGINX Instance Manager Prior to 2.24.0 F5 WAF for NGINX Prior to 5.16.0 Prior to 5.14.2 F5 DoS for NGINX Prior to 4.11.0 The Cyber Centre…
Serial number: AV26-1048 Date: October 15, 2026 As of October 14, 2026, SonicWall is affected by vulnerabilities in the following product: Network Security Manager (NSM) On-Prem (VMWare, Hyper-V, Azure and KVM) Version 4.3.1 and prior The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. SonicWall NSM On-Prem Affected By Multiple Vulnerabilities SonicWall Security Advisory
Serial number: AV26-1047 Date: October 15, 2026 As of October 14, 2026, Drupal is affected by vulnerabilities in the following product: Drupal core Prior to 11.4.10 Prior to 11.3.19 Prior to 10.6.19 The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates or perform the suggested mitigations. Drupal core Critical - Remote code execution SA-CORE-2026-014 Drupal Security Advisories
Serial number: AV26-1046 Date: October 15, 2026 As of October 15, 2026, Hewlett Packard Enterprise is affected by vulnerabilities in the following products: HPE NonStop HTTP WEBSERVER Version T1144L24^AAL and prior HPE NonStop Servers Multiple versions and models HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers Versions prior to 3.22 HPE Integrated Lights-Out 6 (iLO 6) Versions prior to 1.79 HPE Integrated Lights-Out 7 (iLO 7) Version prior to 1.25.01 HPE Networking AOS-Switch (AOS-S)…
Serial number: AV26-1045 Date: October 15, 2026 As of October 13, 2026, Google is affected by vulnerabilities in the following product: Stable Channel Chrome for Desktop Versions prior to 155.0.8059.79/.80 (Windows/Mac), and 155.0.8059.79 to (Linux) The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Stable Channel Update for Desktop
Serial number: AV26-1044 Date: October 15, 2026 As of October 14, 2026, n8n is affected by vulnerabilities in the following product: n8n Prior to 1.123.83 Prior to 2.41.4 Prior to 2.42.1 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. SQL Injection in the Microsoft SQL Node via Expression Interpolation into the Query Field Advisory Shared-Workflow Credential Check Misses Nested and Tool Inline Sub…
On October 13 and 14, Google issued several Chrome updates. Most users are on Chrome’s Stable channel. The desktop update brings Chrome to versions 155.0.8059.79/.80 for Windows and Mac and 155.0.8059.79 for Linux. The update includes 37 security fixes, including seven rated Critical. On the same day, Google released version 155.0.8059.79 for Android. It may not be available on Google Play for everyone yet but keep an eye out for it. Google says it also includes stability and performance…
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.