60.583 CVE seguite
812 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
60.583 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordinato dal più basso |
|---|---|---|---|---|
| CVE-2022-4543 | MED 5.5 | linux linux_kernel A flaw named "EntryBleed" was found in the Linux Kernel Page Table Isolation (KPTI). This issue could allow a local attacker to leak KASLR base via prefetch side-channels based on TLB timing for Intel systems. | 1,0% | — |
| CVE-2022-45412 | HIGH 8.8 | mozilla firefox When resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be produced where the symlink was resolved to a string containing unitialized memory in the buffer. <br>*This bug only affects Thunderbird on Unix-based operated systems | 0,8% | — |
| CVE-2022-45402 | MED 6.1 | apache airflow In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` endpoint. | 81,1% | — |
| CVE-2022-45378 | CRIT 9.8 | apache soap In the default configuration of Apache SOAP, an RPCRouterServlet is available without authentication. This gives an attacker the possibility to invoke methods on the classpath that meet certain criteria. Depending on what classes are available on the classpath | 2,5% | — |
| CVE-2022-45347 | CRIT 9.8 | apache shardingsphere Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn't cleanup the database session completely after client authentication failed, which allowed an attacker to execute normal commands by constructing a special MySQL client. This | 1,5% | — |
| CVE-2022-45143 | HIGH 7.5 | apache tomcat The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to su | 2,7% | — |
| CVE-2022-45136 | CRIT 9.8 | apache jena_sdb Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying database server to return malicious data. The mySQL JDBC driver in particular is known to be vulnerab | 1,7% | — |
| CVE-2022-45135 | CRIT 9.8 | apache cocoon Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue. | 1,1% | — |
| CVE-2022-45109 | LOW 3.3 | intel unison_software Improper initialization for some Intel Unison software may allow an authenticated user to potentially enable information disclosure via local access. | 0,2% | — |
| CVE-2022-4510 | HIGH 7.8 | microsoft binwalk A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is ru | 22,9% | — |
| CVE-2022-45064 | HIGH 8.0 | apache apache_sling_engine The SlingRequestDispatcher doesn't correctly implement the RequestDispatcher API resulting in a generic type of include-based cross-site scripting issues on the Apache Sling level. The vulnerability is exploitable by an attacker that is able to include a resou | 1,1% | — |
| CVE-2022-45052 | HIGH 8.8 | axiell iguana A Local File Inclusion vulnerability has been found in Axiell Iguana CMS. Due to insufficient neutralisation of user input on the url parameter on the Proxy.type.php endpoint, external users are capable of accessing files on the server. | 0,8% | — |
| CVE-2022-45051 | MED 6.1 | axiell iguana A reflected XSS vulnerability has been found in Axiell Iguana CMS, allowing an attacker to execute code in a victim's browser. The module parameter on the Service.template.cls endpoint does not properly neutralise user input, resulting in the vulnerability. | 0,5% | — |
| CVE-2022-45049 | MED 6.1 | axiell iguana A reflected XSS vulnerability has been found in Axiell Iguana CMS, allowing an attacker to execute code in a victim's browser. The url parameter on the novelist.php endpoint does not properly neutralise user input, resulting in the vulnerability. | 0,5% | — |
| CVE-2022-45048 | HIGH 8.4 | apache ranger Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability. This issue affects Apache Ranger: 2.3.0. Users are recommended to update to version 2.4.0. | 1,1% | — |
| CVE-2022-45047 | CRIT 9.8 | apache sshd Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD | 3,8% | — |
| CVE-2022-44730 | MED 4.4 | apache xml_graphics_batik Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. A malicious SVG can probe user profile / data and send it directly as parameter to a URL. | 0,8% | — |
| CVE-2022-44729 | HIGH 7.1 | apache xml_graphics_batik Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource | 0,9% | — |
| CVE-2022-44713 | HIGH 7.5 | microsoft office Microsoft Outlook for Mac Spoofing Vulnerability | 1,6% | — |
| CVE-2022-44710 | HIGH 7.8 | microsoft windows_11 DirectX Graphics Kernel Elevation of Privilege Vulnerability | 0,6% | — |
| CVE-2022-44708 | HIGH 8.3 | microsoft edge Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | 2,0% | — |
| CVE-2022-44707 | MED 6.5 | microsoft windows_10 Windows Kernel Denial of Service Vulnerability | 2,7% | — |
| CVE-2022-44704 | HIGH 7.8 | microsoft windows_sysmon Microsoft Windows System Monitor (Sysmon) Elevation of Privilege Vulnerability | 0,7% | — |
| CVE-2022-44702 | HIGH 7.8 | microsoft terminal Windows Terminal Remote Code Execution Vulnerability | 1,4% | — |
| CVE-2022-44699 | MED 5.5 | microsoft azure_network_watcher_agent Azure Network Watcher Agent Security Feature Bypass Vulnerability | 0,5% | — |