4631 karet z 5129 položek
· strana 41 z 78
CZ ·
EN/orig
Hvězdička u CVE znamená, že jsem to číslo vytáhl z širšího textu článku.
Neukazuju u něj proto KEV, EPSS ani CVSS, a to preventivně, protože článek se na něj mohl
jen odkazovat, třeba jako na starší kauzu.
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation of data that is sent to the NX-API. An attacker could exploit this vulnerability by sending a crafted HTTP request to the NX-API of an affected device. A successful exploit could allow the attacker to execute…
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and streamline the disclosure process…
Multiple vulnerabilities in the Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as Next Generation OAM (NGOAM), could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. These vulnerabilities are due to improper input validation of IP traffic when NGOAM is enabled. An attacker could exploit these vulnerabilities by sending crafted packets to an IP…
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and streamline the disclosure process, Cisco has grouped these issues by their underlying…
A vulnerability in the endpoint group (EPG) contract functionality of Cisco Nexus 9000 Series Fabric Switches in ACI Mode could allow an unauthenticated, remote attacker to bypass configured EPG contracts. This vulnerability is due to an improper control with EPG contracts. An attacker could exploit this vulnerability by sending IPv4 or IPv6 packets using UDP source and destination ports that are assigned to DHCP traffic through an affected device. A successful exploit could allow the attacker…
As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and…
A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to execute arbitrary commands as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient input validation of user-controlled command arguments. An attacker could exploit this vulnerability by authenticating using the API and sending crafted input. A…
A vulnerability in the export policies functionality of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to access sensitive files on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient access control to file system resources. An attacker could exploit this vulnerability by submitting crafted values in specific UI fields. A successful exploit…
A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper validation when an affected device is processing an MPLS echo-request packet. An attacker could exploit this…
A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain limited sensitive information for services that are…
A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, local attacker with low privileges to escape the Python sandbox and gain unauthorized access to the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by manipulating specific functions within the Python interpreter. A successful exploit could allow an attacker to escape the…
Serial number: AV26-1011 Date: October 7, 2026 As of October 6, 2026, Hewlett Packard Enterprise (HPE) is affected by vulnerabilities in the following products: HPE Networking AOS-Switch (AOS-S) Version 16.11.0031 and prior HP Networking ClearPass Policy Manager (CPPM) Version 6.11.15 and prior Version 6.14.0 and prior The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. HPESBNW05158 rev.1 - Multiple…
Serial number: AV26-1010 Date: October 7, 2026 As of October 6, 2026, Johnson Controls is affected by a vulnerability in the following product: Illustra Standard - L4L China Prior to 6.0.0.66394 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Vulnerability impacting Illustra Standard - L4L China Johnson Controls - Product Security Advisories
Google heeft kwetsbaarheden verholpen in Android. Samsung heeft de voor Samsung Mobile relevante kwetsbaarheden verholpen in hun producten. De kwetsbaarheden betreffen onder andere onjuiste bounds checking, ontbrekende permissiecontroles, integer overflows, onjuist geïnitialiseerde pointers, type confusion, race conditions en onjuiste exception handling. Deze fouten kunnen leiden tot out-of-bounds memory reads en writes, geheugen corruptie, privilege escalatie, informatielekken, denial-of…
Rilevata una vulnerabilità con gravità "alta" in llama.cpp, noto motore di inferenza open source che consente di eseguire LLM in locale. Tale vulnerabilità, qualora sfruttata, potrebbe consentire a un attaccante remoto di compromettere la disponibilità del servizio e, potenzialmente, di eseguire codice arbitrario sui sistemi interessati.
Rilevate 11 vulnerabilità di sicurezza, di cui 4 con gravità "alta", in Craft CMS, noto strumento per la gestione di siti web e-commerce. Tali vulnerabilità, qualora sfruttate, potrebbero consentire ad un utente malintenzionato autenticato, in determinate condizioni, di effettuare modifiche non autorizzate a dati applicativi e di eseguire codice arbitrario da remoto sui sistemi interessati.
Serial number: AV26-1009 Date: October 7, 2026 As of October 7, 2026, Veeam is affected by vulnerabilities in the following product: Veeam Backup and Replication Prior to 12.3.2.P4 Prior to 13.03 Prior to 13.1 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. KB4934: Vulnerabilities Resolved in Veeam Backup & Replication 12.3.2 P4 Veeam Support Knowledge Base
Serial number: AV26-1008 Date: October 7, 2026 As of October 7, 2026, VMware is affected by vulnerabilities in the following products: VMware Fusion MacOS Prior to 26H1u1 VMware Workstation Prior to 26H1u1 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. VMSA-2026-0007: VMware Workstation and Fusion updates address integer-overflow and buffer overflow vulnerabilities (CVE-2026-59346, CVE-2026-59347)…
Serial number: AV26-1007 Date: October 7, 2026 As of October 6, 2026, GitHub is affected by vulnerabilities in the following product: Enterprise Server 3.18.0 Prior to 3.18.16 3.19.0 Prior to 3.19.13 3.20.0 Prior to 3.20.9 3.21.0 Prior to 3.21.7 3.22.0 Prior to 3.22.2 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Release notes - GitHub Enterprise Server 3.18 Docs Release notes - GitHub Enterprise…
Serial number: AV26-1006 Date: October 7, 2026 As of October 6, 2026, Google is affected by vulnerabilities in the following product: Stable Channel Chrome for Desktop Versions prior to 155.0.8059.39/.40 (Windows/Mac), and 155.0.8059.39 (Linux) The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Stable Channel Update for Desktop
Google has published security fixes for Android. The October updates are available for Android operating system versions 14, 15, 16, 16-qpr2, and 17 where “qpr” stands for Quarterly Platform Release. QPRs are interim updates Google pushes out between major yearly cycles. These Android security bulletins contain valuable information for Android users. The updates are important as they fix several vulnerabilities rated as Critical, which can be exploited without users even doing anything. However…
Google ha pubblicato gli aggiornamenti di sicurezza per i dispositivi Pixel relativi al mese di ottobre, contenenti correzioni per 6 vulnerabilità, di cui 3 con gravità “critica” e 3 con gravità “alta”. Tali vulnerabilità, qualora sfruttate, potrebbero consentire ad un utente malintenzionato di accedere ad informazioni sensibili e di elevare i propri privilegi sui sistemi interessati.
Google has released updates for the Chrome browser and the ChromeOS operating system. On October 6, Google released a Stable Channel Update for Desktop. This is the most important one for desktop users. It brings Chrome to version 155.0.8059.39 for Linux and versions 154.0.8037.39/.40 for Windows and Mac. The update includes 247 security fixes including four rated Critical. On the same day, Google released version 155.0.8059.39 for Android, to a small percentage of users. It may not be…
Rilevata vulnerabilità di sicurezza con gravità “critica” che interessa il software ADM dei prodotti di ASUSTOR, produttore di sistemi di archiviazione di rete. Tale vulnerabilità, qualora sfruttata, potrebbe consentire a utenti malintenzionati di leggere file arbitrari sui sistemi interessati.
SonicWall ha rilasciato aggiornamenti di sicurezza per sanare 4 vulnerabilità, di cui 1 con gravità "critica" e 2 con gravità "alta", che interessano i modelli 6210, 7210 e 8200v appartenenti alla serie SMA1000. Tali vulnerabilità, qualora sfruttate, potrebbero consentire ad un utente malintenzionato di eludere dei meccanismi di sicurezza e di eseguire codice arbitrario sui sistemi interessati.
Multiple Vulnerabilities in BugTracker.NET Wed, 10/07/2026 - 10:28 Aviso Affected Resources BugTracker.NET 3.6.8 Description INCIBE has coordinated the disclosure of three high-severity vulnerabilities affecting BugTracker.NET, a free and open-source web application designed for tracking bugs and incidents. The vulnerabilities were discovered by Álvaro Monforte de la Huerga and Juan Gabriel Ruiz Fernández of the Ministry of Defense. These vulnerabilities have been assigned the following codes,…
Path Traversal in Satel Iberia SenNet Datalogger Serie 200 Wed, 10/07/2026 - 17:57 Aviso Affected Resources SenNet Datalogger Serie 200 V7.0m-1.53h. Description INCIBE has coordinated the publication of a high severity vulnerability affecting SenNet Datalogger Serie 200 by Satel Iberia, hardware for monitoring and controlling commercial and industrial buildings. The vulnerability was discovered by rijndael86. This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS…
On 5 October 2026, Atlassian published a security advisory addressing a critical arbitrary file access vulnerability. It affects Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye. CERT-EU strongly recommends upgrading all affected installations to a fixed version as soon as possible, starting with instances accessible from the internet. CERT-EU also recommends checking access…
Rilevate 24 nuove vulnerabilità di sicurezza, di cui 2 con gravità “critica” e 18 con gravità “alta”, che interessano il software Langflow, nota piattaforma open-source che permette di costruire, testare e distribuire applicazioni e agenti basati su intelligenza artificiale.
Aggiornamenti di sicurezza sanano 9 vulnerabilità, di cui 3 con gravità “alta”, che interessano Gitea, piattaforma collaborativa open source per la gestione del codice sorgente e lo sviluppo di applicazioni software.
ASUS ha rilasciato aggiornamenti di sicurezza per sanare 4 vulnerabilità, di cui 2 con gravità "critica" e 2 con gravità "alta", che interessano diversi modelli di router.
WatchGuard heeft meerdere kwetsbaarheden verholpen in Fireware OS. De impact van deze kwetsbaarheden varieert, net als de toegangsrechten die nodig zijn voor misbruik. - Een aanvaller met schrijfrechten op het systeem kan via een kwetsbaarheid in SAML single sign-on-sessies een kwaadaardig sessiebestand laden en arbitraire code uitvoeren. - Geauthenticeerde beheerders kunnen via path traversal in de WebUI Management Agent willekeurige lokale bestanden lezen. Een low-privileged geauthenticeerde…
Rilasciati aggiornamenti di sicurezza per risolvere due vulnerabilità, di cui una con gravità "alta", in GitHub Enterprise Server. Un utente autenticato autorizzato a inviare contenuti a un repository potrebbe sfruttare tale vulnerabilità per indurre il sistema a inoltrare richieste opportunamente predisposte verso host interni controllati dall'attaccante al fine di eseguire codice arbitrario sul sistema interessato.
Elastic ha rilasciato aggiornamenti di sicurezza per sanare molteplici vulnerabilità, di cui 3 con gravità "alta", che interessano i prodotti Kibana ed Elasticsearch.
JetBrains ha rilasciato aggiornamenti di sicurezza che sanano due vulnerabilità, di cui una con gravità "alta", in TeamCity. Tale vulnerabilità, qualora sfruttata, potrebbe consentire a utenti malintenzionati remoti di eseguire codice arbitrario sui sistemi interessati.
Google ha rilasciato un aggiornamento per il browser Chrome al fine di correggere 247 nuove vulnerabilità di sicurezza, di cui 12 con gravità “critica” e 42 con gravità “alta”.
SonicWall heeft meerdere kwetsbaarheden verholpen in de SonicWall SMA1000 Appliance. De kwetsbaarheden omvatten een pre-authenticatie Server-Side Request Forgery (SSRF) die ongeauthenticeerde aanvallers in staat stelt om onbevoegde interne verzoeken uit te voeren. Daarnaast is er een post-authenticatie remote code execution kwetsbaarheid via OS command injection. Verder is er een Zip Slip kwetsbaarheid in de management console die het mogelijk maakt om bestanden buiten de bedoelde directories…
Rilasciati aggiornamenti di sicurezza per risolvere 3 vulnerabilità, di cui 1 con gravità "alta", in Veeam Backup & Replication, soluzione di backup, ripristino e replica dei dati per ambienti virtuali, fisici e cloud. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato remoto, autenticato e con il ruolo Backup Viewer, di eseguire codice arbitrario sul Veeam Backup Server.
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.0: 6.3, CVEs: CVE-2026-63277, CVE-2026-59265, Summary: A malicious spreadsheet can make LibreOffice and Apache OpenOffice run an attacker's code as soon as the file is opened, security researchers have shown. There is no warning first, of the kind either program shows before it runs a macro. The attack works only when the program's Java support is enabled. So far, it has only been shown as a proof of…
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.6, CVEs: CVE-2026-63697, CVE-2026-86360, CVE-2026-86361, CVE-2026-86362, CVE-2026-71168, Summary: Dell System Update (DSU) remediation is available for multiple security vulnerabilities that could be exploited by malicious users to compromise the affected system. CVE-2026-86360 CVSSv3.1: 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Dell System Update, versions prior to 2.3.0.0, contains an Improper…
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: , Summary: This security and maintenance release features 7 security fixes and 4 bug fixes. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.1.3 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update…
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.0: 10.0, CVEs: CVE-2026-102255, CVE-2026-102256, CVE-2026-102257, CVE-2026-102258, Summary: 1) CVE-2026-102255 - Pre-authentication SSRF via unintended forward-proxy A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to…
Splunk addressed multiple vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. See CVE Details for vulnerability-specific affected versions, additional remediation, acknowledgments, and workarounds.
Splunk remedied common vulnerabilities and exposures (CVEs) in third-party packages in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15 or higher.
In Splunk MCP Server versions below 1.2.1, Splunk MCP Server could send the Splunk platform authentication token of a user who runs a custom Application Programming Interface (API) tool to the URL configured for that tool. If another user controls that URL, they could capture the token and use it to access data and perform actions as the user who ran the tool. Successful exploitation requires a user who holds a role that contains the mcp_tool_execute capability to run a custom API tool…
De multiples vulnérabilités ont été découvertes dans SPIP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.
De multiples vulnérabilités ont été découvertes dans les produits Veeam. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une injection de code indirecte à distance (XSS).
De multiples vulnérabilités ont été découvertes dans les produits HPE Aruba Networking. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
De multiples vulnérabilités ont été découvertes dans les produits Elastic. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.
De multiples vulnérabilités ont été découvertes dans Traefik. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
De multiples vulnérabilités ont été découvertes dans WordPress. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
De multiples vulnérabilités ont été découvertes dans OpenSSH. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.
De multiples vulnérabilités ont été découvertes dans GLPI. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données, une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.
De multiples vulnérabilités ont été découvertes dans Google Chrome. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
De multiples vulnérabilités ont été découvertes dans Microsoft Edge. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Serial number: AV26-1005 Date: October 6, 2026 As of October 6, 2026, Progress Software is affected by a vulnerability in the following product: Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator Prior to 2.1 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Progress DataDirect Critical Security Alert Bulletin – September 2026 – CVE-2026-91140 Progress Trust Center