57.971 CVE seguite
788 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
57.971 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordinato dal più alto |
|---|---|---|---|---|
| CVE-2021-44172 | MED 4.3 | fortinet forticlient_endpoint_management_server An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClientEMS versions 7.0.0 through 7.0.4, 7.0.6 through 7.0.7, in all 6.4 and 6.2 version management interface may allow an unauthenticated attacker to gain information | 0,9% | — |
| CVE-2021-44171 | CRIT 9.0 | fortinet fortios A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiOS version 6.0.0 through 6.0.14, FortiOS version 6.2.0 through 6.2.10, FortiOS version 6.4.0 through 6.4.8, FortiOS version 7.0.0 through 7.0.3 allows | 1,5% | — |
| CVE-2021-44170 | MED 6.7 | fortinet fortios A stack-based buffer overflow vulnerability [CWE-121] in the command line interpreter of FortiOS before 7.0.4 and FortiProxy before 2.0.8 may allow an authenticated attacker to execute unauthorized code or commands via specially crafted command line arguments. | 0,2% | — |
| CVE-2021-44169 | HIGH 8.2 | fortinet forticlient A improper initialization in Fortinet FortiClient (Windows) version 6.0.10 and below, version 6.2.9 and below, version 6.4.7 and below, version 7.0.3 and below allows attacker to gain administrative privileges via placing a malicious executable inside the Fort | 0,4% | — |
| CVE-2021-44167 | MED 6.8 | fortinet forticlient An incorrect permission assignment for critical resource vulnerability [CWE-732] in FortiClient for Linux version 6.0.8 and below, 6.2.9 and below, 6.4.7 and below, 7.0.2 and below may allow an unauthenticated attacker to access sensitive information in log fi | 0,5% | — |
| CVE-2021-44166 | MED 4.1 | fortinet fortitoken_mobile An improper access control vulnerability [CWE-284 ] in FortiToken Mobile (Android) external push notification 5.1.0 and below may allow a remote attacker having already obtained a user's password to access the protected system during the 2FA procedure, even th | 0,7% | — |
| CVE-2021-44145 | MED 6.5 | apache nifi In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information. | 1,7% | — |
| CVE-2021-44140 | CRIT 9.1 | apache jspwiki Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki user | 6,2% | — |
| CVE-2021-44050 | MED 6.5 | broadcom ca_network_flow_analysis CA Network Flow Analysis (NFA) 21.2.1 and earlier contain a SQL injection vulnerability in the NFA web application, due to insufficient input validation, that could potentially allow an authenticated user to access sensitive data. | 0,9% | — |
| CVE-2021-44040 | HIGH 7.5 | apache traffic_server Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.3 and 9.0.0 to 9.1.1. | 2,0% | — |
| CVE-2021-44024 | HIGH 7.1 | trendmicro apex_one A link following denial-of-service vulnerability in Trend Micro Apex One (on-prem and SaaS) and Trend Micro Worry-Free Business Security (10.0 SP1 and Services) could allow a local attacker to overwrite arbitrary files in the context of SYSTEM. Please note: an | 0,4% | — |
| CVE-2021-44023 | HIGH 7.1 | trendmicro antivirus\+_security_2021 A link following denial-of-service (DoS) vulnerability in the Trend Micro Security (Consumer) 2021 familiy of products could allow an attacker to abuse the PC Health Checkup feature of the product to create symlinks that would allow modification of files which | 0,4% | — |
| CVE-2021-44022 | MED 5.5 | trendmicro apex_one A reachable assertion vulnerability in Trend Micro Apex One could allow an attacker to crash the program on affected installations, leading to a denial-of-service (DoS). Please note: an attacker must first obtain the ability to execute low-privileged code on t | 0,2% | — |
| CVE-2021-43999 | HIGH 8.8 | apache guacamole Apache Guacamole 1.2.0 and 1.3.0 do not properly validate responses received from a SAML identity provider. If SAML support is enabled, this may allow a malicious user to assume the identity of another Guacamole user. | 1,8% | — |
| CVE-2021-43980 | LOW 3.7 | apache tomcat The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0 | 1,9% | — |
| CVE-2021-43976 | MED 4.6 | debian debian_linux In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker (who can connect a crafted USB device) to cause a denial of service (skb_over_panic). | 0,7% | — |
| CVE-2021-43975 | MED 6.7 | debian debian_linux In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allows an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value. | 0,6% | — |
| CVE-2021-43940 | HIGH 7.8 | atlassian confluence_data_center Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the local system via a DLL Hijacking vulnerability in the Confluence installer. This vulnerability only affects installations | 0,3% | — |
| CVE-2021-43908 | MED 4.3 | microsoft visual_studio_code Visual Studio Code Spoofing Vulnerability | 2,7% | — |
| CVE-2021-43907 | CRIT 9.8 | microsoft windows_subsystem_for_linux Visual Studio Code WSL Extension Remote Code Execution Vulnerability | 3,8% | — |
| CVE-2021-43905 | CRIT 9.6 | microsoft 365_copilot Microsoft Office app Remote Code Execution Vulnerability | 2,8% | — |
| CVE-2021-43899 | CRIT 9.8 | microsoft wireless_display_adapter_firmware Microsoft 4K Wireless Display Adapter Remote Code Execution Vulnerability | 2,4% | — |
| CVE-2021-43896 | MED 5.5 | microsoft powershell Microsoft PowerShell Spoofing Vulnerability | 2,3% | — |
| CVE-2021-43893 | HIGH 7.5 | microsoft windows_10 Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability | 6,6% | — |
| CVE-2021-43892 | HIGH 7.4 | microsoft biztalk_esb_toolkit Microsoft BizTalk ESB Toolkit Spoofing Vulnerability | 2,9% | — |