60.443 CVE seguite
812 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
60.443 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordinato dal più basso |
|---|---|---|---|---|
| CVE-2024-24912 | MED 6.7 | checkpoint harmony_endpoint A local privilege escalation vulnerability has been identified in Harmony Endpoint Security Client for Windows versions E88.10 and below. To exploit this vulnerability, an attacker must first obtain the ability to execute local privileged code on the target sy | 0,2% | — |
| CVE-2024-24910 | HIGH 7.3 | checkpoint identity_agent A local attacker can erscalate privileges on affected Check Point ZoneAlarm ExtremeSecurity NextGen, Identity Agent for Windows, and Identity Agent for Windows Terminal Server. To exploit this vulnerability, an attacker must first obtain the ability to execute | 0,2% | — |
| CVE-2024-24864 | MED 5.3 | linux linux_kernel A race condition was found in the Linux kernel's media/dvb-core in dvbdmx_write() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue. | 0,2% | — |
| CVE-2024-24861 | LOW 3.3 | linux linux_kernel A race condition was found in the Linux kernel's media/xc4000 device driver in xc4000 xc4000_get_frequency() function. This can result in return value overflow issue, possibly leading to malfunction or denial of service issue. | 0,2% | — |
| CVE-2024-24860 | MED 4.6 | linux linux_kernel A race condition was found in the Linux kernel's bluetooth device driver in {min,max}_key_size_set() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue. | 0,8% | — |
| CVE-2024-24859 | MED 4.6 | linux linux_kernel A race condition was found in the Linux kernel's net/bluetooth in sniff_{min,max}_interval_set() function. This can result in a bluetooth sniffing exception issue, possibly leading denial of service. | 0,7% | — |
| CVE-2024-24858 | MED 4.6 | debian debian_linux A race condition was found in the Linux kernel's net/bluetooth in {conn,adv}_{min,max}_interval_set() function. This can result in I2cap connection or broadcast abnormality issue, possibly leading to denial of service. | 0,3% | — |
| CVE-2024-24857 | MED 4.6 | debian debian_linux A race condition was found in the Linux kernel's net/bluetooth device driver in conn_info_{min,max}_age_set() function. This can result in integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service. | 0,3% | — |
| CVE-2024-24855 | MED 5.0 | linux linux_kernel A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue. | 0,2% | — |
| CVE-2024-24795 | MED 6.3 | apache http_server HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are recommended to upgrade to version 2.4.59, which fixe | 2,9% | — |
| CVE-2024-24780 | CRIT 9.8 | apache iotdb Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register malicious function from untrusted URI. This issue affects Apache IoTDB: from 1.0.0 before 1.3.4. Users are recommended to | 1,4% | — |
| CVE-2024-24779 | MED 5.0 | apache superset Apache Superset with custom roles that include `can write on dataset` and without all data access permissions, allows for users to create virtual datasets to data they don't have access to. These users could then use those virtual datasets to get access to una | 0,7% | — |
| CVE-2024-24778 | MED 6.5 | apache streampipes Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. This issue affects Apache StreamPipes: through 0.95.1. Users are recommended to upgrade to version 0.97.0 which fixe | 0,7% | — |
| CVE-2024-24775 | HIGH 7.5 | f5 big-ip_access_policy_manager When a virtual server is enabled with VLAN group and SNAT listener is configured, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated | 0,5% | — |
| CVE-2024-24773 | MED 4.9 | apache superset Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1, which | 0,8% | — |
| CVE-2024-24772 | MED 4.3 | apache superset A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to | 1,0% | — |
| CVE-2024-24749 | HIGH 7.5 | geoserver geoserver GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.23.5 and 2.24.3, if GeoServer is deployed in the Windows operating system using an Apache Tomcat web application server, it is possible to bypass existi | 0,8% | — |
| CVE-2024-24746 | HIGH 7.5 | apache nimble Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache NimBLE. Specially crafted GATT operation can cause infinite loop in GATT server leading to denial of service in Bluetooth stack or device. This issue affects Apache NimBLE: throu | 1,4% | — |
| CVE-2024-24683 | MED 6.5 | apache hop_engine Improper Input Validation vulnerability in Apache Hop Engine.This issue affects Apache Hop Engine: before 2.8.0. Users are recommended to upgrade to version 2.8.0, which fixes the issue. When Hop Server writes links to the PrepareExecutionPipelineServlet pag | 1,2% | — |
| CVE-2024-24576 | CRIT 10.0 | fedoraproject fedora Rust is a programming language. The Rust Security Response WG was notified that the Rust standard library prior to version 1.77.2 did not properly escape arguments when invoking batch files (with the `bat` and `cmd` extensions) on Windows using the `Command`. | 20,3% | — |
| CVE-2024-24549 | HIGH 7.5 | apache tomcat Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after a | 23,1% | — |
| CVE-2024-24482 | CRIT 9.8 | apktool apktool Aprktool before 2.9.3 on Windows allows ../ and /.. directory traversal. | 1,2% | — |
| CVE-2024-2433 | MED 4.3 | paloaltonetworks pan-os An improper authorization vulnerability in Palo Alto Networks Panorama software enables an authenticated read-only administrator to upload files using the web interface and completely fill one of the disk partitions with those uploaded files, which prevents th | 0,6% | — |
| CVE-2024-2432 | MED 4.5 | paloaltonetworks globalprotect A privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race c | 0,4% | — |
| CVE-2024-2431 | MED 5.5 | paloaltonetworks globalprotect An issue in the Palo Alto Networks GlobalProtect app enables a non-privileged user to disable the GlobalProtect app in configurations that allow a user to disable GlobalProtect with a passcode. | 0,2% | — |