Hvězdička u CVE znamená, že jsem to číslo vytáhl z širšího textu článku. Neukazuju u něj proto KEV, EPSS ani CVSS, a to preventivně, protože článek se na něj mohl jen odkazovat, třeba jako na starší kauzu.
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 7.1, CVEs: CVE-2026-112188, Summary: MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted.
EPSS 0.00 CVSS 7.1 CVE-2026-112188 MISP FI
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 5.3, CVEs: CVE-2026-112192, Summary: MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata.
EPSS 0.00 CVSS 5.3 CVE-2026-112192 MISP FI
Classification: Severe, Solution: Official Fix, Exploit Maturity: Functional, CVSSv3.1: 7.4, CVEs: CVE-2026-112146, Summary: A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown processing of the file /etc/emDaemon/passwd of the component MQTT Broker. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. The exploit is now public and may be used.
EPSS 0.00 CVSS 7.4 CVE-2026-112146 D-Link FI
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.1, CVEs: CVE-2026-112158, Summary: A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. Impacted is the function same_check of the file ipt_SAME.ko. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. Upgrading to version 7.21.5 and 7.23.1 is recommended to address this issue. You should upgrade the affected component.
EPSS 0.00 CVSS 7.1 CVE-2026-112158 MikroTik FI
CISA added CVE-2026-96652 to the Known Exploited Vulnerabilities catalog. Affected product: Plex Media Server. Remediation due date: 2026-11-03.
KEV ✓ EPSS 0.12 CVE-2026-96652 Plex US
CISA added CVE-2026-96654 to the Known Exploited Vulnerabilities catalog. Affected product: Plex Media Server. Remediation due date: 2026-10-23.
KEV ✓ EPSS 0.02 CVE-2026-96654 Plex US
CISA added CVE-2026-96655 to the Known Exploited Vulnerabilities catalog. Affected product: Plex Media Server. Remediation due date: 2026-11-03.
KEV ✓ EPSS 0.02 CVE-2026-96655 Plex US
CISA added CVE-2026-96656 to the Known Exploited Vulnerabilities catalog. Affected product: Plex Media Server. Remediation due date: 2026-10-23.
KEV ✓ EPSS 0.02 CVE-2026-96656 Plex US
CISA added CVE-2026-106931 to the Known Exploited Vulnerabilities catalog. Affected product: EG Secure Solutions SiteGuard Server Edition. Remediation due date: 2026-10-23.
KEV ✓ EPSS 0.03 CVE-2026-106931 EG Secure Solutions SiteGuard US
De multiples vulnérabilités ont été découvertes dans Mattermost Server. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Mattermost FR
De multiples vulnérabilités ont été découvertes dans Laravel. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à l'intégrité des données et un contournement de la politique de sécurité.
Laravel FR
We include indicators of activity and mitigations for PAN-OS vulnerability CVE-2026-0257. The post Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19) appeared first on Unit 42.
KEV ✓ · ransomware EPSS 0.96 CVE-2026-0257 US
Serial Number: AV26-1062 Date: October 19, 2026 As of October 19, 2026, Eptura is affected by a vulnerability in the following product: Archibus Prior to 2025.02 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Eptura Archibus Archived Archibus Release Notes
Eptura CA
Serial Number: AV26-1061 Date: October 19, 2026 As of October 19, 2026, Red Hat is affected by vulnerabilities in the following products: Fast Datapath for RHEL 10/8/9 All versions ManageIQ All versions Migration Toolkit for Applications 8 All versions Migration Toolkit for Virtualization All versions OpenShift Service Mesh 3 All versions Red Hat Advanced Cluster Management for Kubernetes 2 All versions Red Hat Ansible Automation Platform 2 All versions Red Hat Ansible Automation Platform…
Red Hat CA
F5 has released out-of-band security patches to address multiple NGINX web server flaws, including three critical-severity vulnerabilities that can let attackers execute code on vulnerable systems. [...]
CVE-2026-15176 * CVE-2026-93479 * CVE-2026-97205 * F5 NGINX US
Serial number: AV26-423 Date: May 5, 2026 Updated: October 19, 2026 On May 5, 2026, Redis published a security advisory to address vulnerabilities in the following products: Redis Software – multiple versions Redis OSS/CE releases – multiple versions Update 1 Open-source reporting indicates that CVE-2026-25243 is being exploited in the wild. The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates. Redis Security advisory: …
EPSS 0.04 CVE-2026-23631 CVE-2026-25243 CVE-2026-25588 Redis CA
SonicWall ha rilasciato aggiornamenti di sicurezza per sanare due vulnerabilità con gravità "alta" che interessano Network Security Manager (NSM). Tali vulnerabilità, qualora sfruttate, potrebbero consentire ad un utente malintenzionato remoto autenticato l'accesso ad informazioni sensibili, l'elevazione dei propri privilegi e l'esecuzione di codice arbitrario sui sistemi interessati.
EPSS 0.01 CVE-2026-100232 CVE-2026-96540 SonicWall IT FR
MongoDB ha rilasciato aggiornamenti di sicurezza per sanare 5 nuove vulnerabilità, di cui 3 con gravità "alta", in MongoDB Server. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un utente malintenzionato, in determinate condizioni, di compromettere la disponibilità del servizio sui sistemi interessati.
EPSS 0.00 CVE-2026-104004 CVE-2026-104005 CVE-2026-96299 MongoDB IT
Drupal heeft kwetsbaarheden verholpen in de Drupal core Field UI module, Entity List module, Navigation module, Link module en het Gin administratie thema. De kwetsbaarheden betreffen meerdere modules binnen Drupal. In de Field UI module en de Entity List module is een remote code execution kwetsbaarheid aanwezig die kan worden misbruikt via contributed modules of custom code, waarbij sommige aanvalspaden geen authenticatie vereisen. De Navigation module, Link module en het Gin administratie…
Drupal NL
Rilevate 3 vulnerabilità, di cui una con gravità "critica", in Drupal, noto Content Management System (CMS) open source. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato remoto non autenticato di eseguire codice arbitrario sui sistemi interessati.
EPSS 0.00 CVE-2026-108097 Drupal IT
Lack of integrity checks in Mobatek’s MobaXterm Mon, 10/19/2026 - 09:20 Aviso Affected Resources MobaXterm Personal Edition (Portable), version 26.4 GA, by Mobatek. Description INCIBE has coordinated the disclosure of a high-severity vulnerability affecting Mobatek’s MobaXterm, a Windows terminal that integrates remote connection tools and Unix utilities. The vulnerability was discovered by Pedro J. Nunez-Cacho Fuentes (@tunelko). This vulnerability has been assigned the following code, CVSS v4…
EPSS 0.00 CVSS 8.5 CVE-2026-112161 Mobatek ES
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 6.8, CVEs: CVE-2026-106030, Summary: The vulnerability CVE-2026-106030: NordVPN for Windows allows local attackers to stop unprotected Windows system services and change their startup type to Manual via named pipes. The NordVPN user-mode application allows a low-privileged attacker to act as a trusted process and connect to the named pipe \\.\pipe\nord-security\v1\NordVpnService\Server. The attacker can…
EPSS 0.00 CVSS 6.8 CVE-2026-106030 NordVPN FI PL
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: CVE-2026-43865, CVE-2026-78162, CVE-2026-78163, CVE-2026-78164, CVE-2026-78165, CVE-2026-79983, CVE-2026-79984, CVE-2026-79985, CVE-2026-79986, CVE-2026-80312, CVE-2026-80343, CVE-2026-80344, CVE-2026-83531, CVE-2026-84176, CVE-2026-84178, CVE-2026-84180, CVE-2026-84181, CVE-2026-85243, CVE-2026-85245, CVE-2026-85246 (+20 other associated CVEs), Summary: On 15 October the Apache Camel PMC…
Apache FI
De multiples vulnérabilités ont été découvertes dans Microsoft Edge. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et un problème de sécurité non spécifié par l'éditeur.
Microsoft FR
De multiples vulnérabilités ont été découvertes dans les produits F5. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
EPSS 0.01 CVSS 9.2 CVE-2026-101019 CVE-2026-101025 CVE-2026-104939 CVE-2026-15176 CVE-2026-91184 CVE-2026-93479 CVE-2026-94197 CVE-2026-95101 CVE-2026-96615 CVE-2026-97205 CVE-2026-97629 F5 NGINX FR FI
De multiples vulnérabilités ont été découvertes dans Roundcube Webmail. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une falsification de requêtes côté serveur (SSRF) et une injection de code indirecte à distance (XSS).
Roundcube FR
De multiples vulnérabilités ont été découvertes dans Stormshield Network Security. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à l'intégrité des données, une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.
EPSS 0.00 CVE-2026-111090 Stormshield FR
Une vulnérabilité a été découverte dans Mattermost Server. Elle permet à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Mattermost FR
De multiples vulnérabilités ont été découvertes dans Juniper Networks Session Smart Router. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.3, CVEs: CVE-2026-111880, Summary: FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATE_MESSAGE with a backward session-key offset and MIC offset to write 16 zero bytes beyond the allocation.
EPSS 0.00 CVSS 8.3 CVE-2026-111880 FreeRDP FI
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.2, CVEs: CVE-2026-111881, Summary: FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboard_synthesize_image_format_to_bmp for CF_DIB/CF_DIBV5, crashing the client or causing an out-of-bounds write.
EPSS 0.00 CVSS 7.2 CVE-2026-111881 FreeRDP FI
Classification: Critical, Solution: Official Fix, Exploit Maturity: Functional, CVSSv3.1: 9.3, CVEs: CVE-2026-102764, Summary: BeyondTrust has remediated a critical vulnerability in Remote Support (RS) that could allow a remote attacker to perform file operations on an affected appliance. The vulnerability exists within internal components of Remote Support. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could be used to…
KEV ✓ EPSS 0.19 CVSS 9.3 CVE-2026-102764 BeyondTrust FI CA SE US NL IT
Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system. [...]
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.1, CVEs: CVE-2026-62927, CVE-2026-63252, CVE-2026-58080, CVE-2026-63248, CVE-2026-60007, CVE-2026-61387, Summary: Successful exploitation of these vulnerabilities could allow an attacker to delete protected data, recover user credentials and impersonate legitimate users, or cause the server to stop responding to all clients. Incorrect Authorization, Missing Release of Memory after Effective Lifetime,…
EPSS 0.01 CVSS 9.1 CVE-2026-58080 CVE-2026-60007 CVE-2026-61387 CVE-2026-62927 CVE-2026-63248 CVE-2026-63252 Eclipse Foundation výroba a průmysl energetika vodárenství FI US
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-107617, CVE-2026-97858, CVE-2026-105664, Summary: Successful exploitation of these vulnerabilities could allow an attacker to gain control over affected IP cameras: Use of Hard-coded Credentials, Improperly Controlled Modification of Dynamically-Determined Object Attributes, Observable Response Discrepancy
EPSS 0.00 CVSS 9.8 CVE-2026-105664 CVE-2026-107617 CVE-2026-97858 Guangzhou Juan IoT Technology energetika telekomunikace doprava finance FI US
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.1, CVEs: CVE-2026-107336, CVE-2026-107333, CVE-2026-107362, CVE-2026-107361, CVE-2026-107337, CVE-2026-107335, CVE-2026-107334, Summary: Authentication Bypass by Spoofing, Incorrect Authorization, Server-Side Request Forgery (SSRF), Authentication Bypass Using an Alternate Path or Channel, Cross-Site Request Forgery (CSRF), Improper Handling of Highly Compressed Data (Data Amplification)
EPSS 0.01 CVSS 8.1 CVE-2026-107333 CVE-2026-107334 CVE-2026-107335 CVE-2026-107336 CVE-2026-107337 CVE-2026-107361 CVE-2026-107362 CISA energetika vodárenství FI US
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: CVE-2026-110151, CVE-2026-110922, CVE-2026-110144, CVE-2026-110159, CVE-2026-110166, CVE-2026-110172, CVE-2026-110913, CVE-2026-110918, CVE-2026-110919, CVE-2026-110921, Summary: The Extended Stable channel has been updated to 152.0.7977.169 for Windows and Mac which will roll out over the coming days/weeks. There are 10 security fixes.
EPSS 0.00 CVE-2026-110144 CVE-2026-110151 CVE-2026-110159 CVE-2026-110166 CVE-2026-110172 CVE-2026-110913 CVE-2026-110918 CVE-2026-110919 CVE-2026-110921 CVE-2026-110922 Google FI
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: CVE-2026-110922, CVE-2026-110913, CVE-2026-110919, CVE-2026-110918, CVE-2026-110917, CVE-2026-110921, CVE-2026-110920, CVE-2026-110916, CVE-2026-110915, CVE-2026-110914, Summary: The Stable channel has been updated to 155.0.8059.84/.85 for Windows and Mac and 155.0.8059.84 to Linux which will roll out over the coming days/weeks. This update includes 10 security fixes.
EPSS 0.00 CVE-2026-110913 CVE-2026-110914 CVE-2026-110915 CVE-2026-110916 CVE-2026-110917 CVE-2026-110918 CVE-2026-110919 CVE-2026-110920 CVE-2026-110921 CVE-2026-110922 Google FI
Serial number: AV26-1060 Date: October 16, 2026 As of October 15, 2026, Google is affected by vulnerabilities in the following product: Chrome Versions prior to 155.0.8059.84/.85 (Windows/Mac) and 155.0.8059.84 (Linux) The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Chrome Releases: Stable Channel Update for Desktop
Google CA
Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers. [...]
EPSS 0.01 CVE-2026-103849 Magento Adobe BlockStrap obchod US
Serial Number: AV26-1059 Date: October 16, 2026 As of October 15, 2026, BMC Helix is affected by a vulnerability in the following product: BMC Helix Network Management Prior to 26.3.01 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. BMC Helix Network Management 26.3.01 On-prem Release Notes BMC Helix On-prem Release Notes
BMC CA
Serial Number: AV26-1058 Date: October 16, 2026 As of October 14, 2026, Progress is affected by vulnerabilities in the following product: MOVEit Transfer Prior to 2025.1.6 Prior to 2026.0.4 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. MOVEit Transfer Critical Security Bulletin - September 2026 Progress Trust Center
Progress CA
Serial number: AV26-1057 Date: October 16, 2026 As of October 13, 2026, Mozilla is affected by vulnerabilities in the following products: Firefox ESR Prior to 153.5 Prior to 115.43 Firefox Prior to 158 Thunderbird Prior to 153.5 Prior to 158 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Security Vulnerabilities fixed in Firefox 158 - Mozilla Mozilla Foundation Security Advisory 2026-107 Security…
Mozilla CA
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-96199 Microsoft US
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-96198 Microsoft US
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-85898 Microsoft US
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-85897 Microsoft US
Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-85890 Microsoft US
Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-83831 Microsoft US
Serial number: AV26-1056 Date: October 16, 2026 As of October 15, 2026, Palo Alto Networks is affected by a vulnerability in the following product: Idira Secrets Manager (Self-Hosted) Prior to v13.9.1 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Idira Secrets Manager - Version 13.9.1 Palo Alto Networks Security Advisories
JetBrains ha rilasciato aggiornamenti di sicurezza per sanare molteplici vulnerabilità di sicurezza, di cui 1 con gravità "critica" e 4 con gravità “alta”, in diversi prodotti. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un utente malintenzionato di eludere i meccanismi di sicurezza, accedere a informazioni sensibili ed eseguire codice arbitrario remoto sui sistemi interessati.
EPSS 0.00 CVE-2026-108474 CVE-2026-111091 CVE-2026-111093 CVE-2026-111094 CVE-2026-111095 JetBrains IT
Google ha rilasciato un aggiornamento per il browser Chrome al fine di correggere 10 nuove vulnerabilità di sicurezza, di cui 1 con gravità “critica” e 6 con gravità “alta”.
EPSS 0.00 CVE-2026-110913 CVE-2026-110917 CVE-2026-110918 CVE-2026-110919 CVE-2026-110920 CVE-2026-110921 CVE-2026-110922 Google IT
Rilevate 27 vulnerabilità, di cui 1 con gravità “alta”, in Mattermost, piattaforma di collaborazione open-source progettata per la comunicazione interna di organizzazioni e aziende. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato autenticato tramite SAML di unirsi arbitrariamente a team ai quali non dovrebbe avere accesso, inclusi team configurati come invite-only, ottenendo l'accesso ad informazioni sensibili.
EPSS 0.00 CVE-2026-16453 Mattermost IT
Aggiornamenti di sicurezza sanano 10 vulnerabilità, di cui 6 con gravità “alta”, in FreeRDP, implementazione open source del protocollo Remote Desktop Protocol (RDP), utilizzato per collegarsi e controllare a distanza un computer. Tali vulnerabilità potrebbero consentire a un server malevolo di eseguire codice arbitrario sul sistema client oppure permettere a un utente malintenzionato remoto di compromettere la disponibilità del servizio sui server interessati.
EPSS 0.01 CVE-2026-111377 CVE-2026-111378 CVE-2026-111379 CVE-2026-111380 CVE-2026-111381 CVE-2026-111382 FreeRDP IT
Angular ha rilasciato aggiornamenti di sicurezza che sanano 3 vulnerabilità, di cui 2 con gravità "alta", nei pacchetti npm @angular/platform-server e @angular/router, componenti per il rendering lato server e per la gestione dell'instradamento delle applicazioni web. Tra queste si evidenziano le CVE-2026-101895 e CVE-2026-101896, per le quali risulta disponibile un Proof of Concept (PoC) in rete.
EPSS 0.01 CVE-2026-101895 CVE-2026-101896 @angular/platform-server @angular/router IT
SQL injection in TSG Profleet Fri, 10/16/2026 - 10:00 Aviso Affected Resources TSG Profleet version 12.004.01. Description INCIBE has coordinated the disclosure of a critical severity vulnerability affecting Profleet, a product from TSG, a provider of refuelling solutions for commercial and industrial fleets. The vulnerability was discovered by Rubén Barrios. This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector and CWE vulnerability type: CVE-2026-111472:…
EPSS 0.00 CVSS 9.3 CVE-2026-111472 TSG doprava ES
Server-Side Request Forgery in Wegow PDF export Fri, 10/16/2026 - 09:45 Aviso Affected Resources Ticket sales chart PDF export functionality in backoffice.wegow.com. Description INCIBE has coordinated the publication of a Server-Side Request Forgery (SSRF) vulnerability reported in the PDF export functionality of Wegow by Wegow Technologies, S.L. The vulnerability was discovered by Cosme Vázquez Tomé. This vulnerability has been assigned the following CVE identifier. The CVSS v4.0 base score…
EPSS 0.00 CVE-2026-101300 Wegow Technologies ES
Adobe heeft meerdere kwetsbaarheden verholpen in Adobe Commerce. De kwetsbaarheden betreffen onder andere stored Cross-Site Scripting (XSS) waarbij aanvallers kwaadaardige JavaScript-code kunnen injecteren in formuliervelden binnen de applicatie. Deze code wordt uitgevoerd in de context van de browser van het slachtoffer en kan ongeautoriseerde acties uitvoeren, zoals het kapen van sessies of het escaleren van privileges. Daarnaast zijn er kwetsbaarheden in de template engine van Adobe Commerce…
Adobe NL
Adobe heeft meerdere kwetsbaarheden verholpen in Adobe ColdFusion. De kwetsbaarheden in Adobe ColdFusion omvatten onder andere Server-Side Request Forgery (SSRF), Incorrect Authorization, Improper Input Validation, code-injectie, XML External Entity (XXE), Uncontrolled Resource Consumption en path traversal. Aanvallers kunnen deze kwetsbaarheden misbruiken om zonder enige gebruikersinteractie privileges te escaleren, arbitrary code uit te voeren, bestanden te uploaden zonder restricties,…
Adobe NL
Fortinet heeft kwetsbaarheden verholpen in FortiSIEM versie 7.5.0. De eerste kwetsbaarheid betreft een path traversal probleem waarbij het systeem onvoldoende beperkingen oplegt aan padnamen naar beperkte directories. Hierdoor kan een niet-geauthenticeerde aanvaller speciaal opgemaakte pakketten versturen om ongeautoriseerde code of commando's uit te voeren. De tweede kwetsbaarheid betreft een ontbrekende autorisatiecontrole binnen de GUI-component, waardoor een geauthenticeerde aanvaller via…
Fortinet NL