56.794 CVE seguite
777 Sfruttate ora
183 Usate dai ransomware
Ultima sincronia
CVE Tracker
56.794 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordinato dal più basso | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2022-2586 | MED 5.3 | canonical ubuntu_linux It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted. | 10,5% | |
| CVE-2022-2585 | MED 5.3 | canonical ubuntu_linux It was discovered that when exec'ing from a non-leader thread, armed POSIX CPU timers would be left on a list but freed, leading to a use-after-free. | 1,3% | — |
| CVE-2022-23774 | MED 5.3 | docker docker_desktop Docker Desktop before 4.4.4 on Windows allows attackers to move arbitrary files. | 0,9% | — |
| CVE-2022-23551 | MED 5.3 | microsoft azure_ad_pod_identity aad-pod-identity assigns Azure Active Directory identities to Kubernetes applications and has now been deprecated as of 24 October 2022. The NMI component in AAD Pod Identity intercepts and validates token requests based on regex. In this case, a token request | 0,7% | — |
| CVE-2022-23280 | MED 5.3 | microsoft outlook_2016 Microsoft Outlook for Mac Security Feature Bypass Vulnerability | 2,4% | — |
| CVE-2022-23261 | MED 5.3 | microsoft edge_chromium Microsoft Edge (Chromium-based) Tampering Vulnerability | 1,6% | — |
| CVE-2022-23032 | MED 5.3 | f5 big-ip_access_policy_manager In all versions before 7.2.1.4, when proxy settings are configured in the network access resource of a BIG-IP APM system, connecting BIG-IP Edge Client on Mac and Windows is vulnerable to a DNS rebinding attack. Note: Software versions which have reached End o | 0,4% | — |
| CVE-2022-23030 | MED 5.3 | f5 big-ip_access_policy_manager On version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when the BIG-IP Virtual Edition (VE) uses the ixlv driver (which is used in SR-IOV mode and requires Intel X710/XL710/XXV710 family of network adapters | 0,9% | — |
| CVE-2022-23029 | MED 5.3 | f5 big-ip_access_policy_manager On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, when a FastL4 profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilizat | 0,7% | — |
| CVE-2022-23028 | MED 5.3 | f5 big-ip_advanced_firewall_manager On BIG-IP AFM version 16.x before 16.1.0, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when global AFM SYN cookie protection (TCP Half Open flood vector) is activated in the AFM Device Dos or DOS profile, certain types of TCP conne | 0,9% | — |
| CVE-2022-23027 | MED 5.3 | f5 big-ip_access_policy_manager On BIG-IP versions 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, 13.1.x beginning in 13.1.3.6, 12.1.5.3-12.1.6, and 11.6.5.2, when a FastL4 profile and an HTTP, FIX, and/or hash persistence profile are configured on the same virtual server, undisclosed request | 0,9% | — |
| CVE-2022-22976 | MED 5.3 | netapp active_iq_unified_manager Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due to | 2,3% | — |
| CVE-2022-22970 | MED 5.3 | netapp active_iq_unified_manager In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object. | 2,0% | — |
| CVE-2022-22968 | MED 5.3 | netapp active_iq_unified_manager In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower cas | 5,7% | — |
| CVE-2022-22961 | MED 5.3 | vmware cloud_foundation VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an information disclosure vulnerability due to returning excess information. A malicious actor with remote access may leak the hostname of the target system. Successful exploitation | 0,8% | — |
| CVE-2022-22932 | MED 5.3 | apache karaf Apache Karaf obr:* commands and run goal on the karaf-maven-plugin have partial path traversal which allows to break out of expected folder. The risk is low as obr:* commands are not very used and the entry is set by user. This has been fixed in revision: http | 2,8% | — |
| CVE-2022-22494 | MED 5.3 | ibm spectrum_protect_operations_center IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14 could allow a remote attacker to gain details of the database, such as type and version, by sending a specially-crafted HTTP request. This information could then be used in future attacks. IBM X-F | 1,5% | — |
| CVE-2022-22473 | MED 5.3 | ibm websphere_application_server IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper handling of Administrative Console data. This information could be used in further attacks against the system. IBM X-Force | 1,0% | — |
| CVE-2022-22457 | MED 5.3 | ibm security_verify_governance IBM Security Verify Governance, Identity Manager 10.0.1 stores sensitive information including user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 225007. | 0,1% | — |
| CVE-2022-22449 | MED 5.3 | ibm security_verify_governance IBM Security Verify Governance, Identity Manager 10.01 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM | 0,7% | — |
| CVE-2022-22409 | MED 5.3 | ibm aspera_faspex IBM Aspera Faspex 5.0.5 could allow a remote attacker to gather sensitive information about the web application, caused by an insecure configuration. IBM X-Force ID: 222592. | 0,8% | — |
| CVE-2022-22386 | MED 5.3 | ibm security_verify_privilege_on-premises IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information | 0,5% | — |
| CVE-2022-22377 | MED 5.3 | ibm security_verify_privilege_on-premises IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information | 0,5% | — |
| CVE-2022-22330 | MED 5.3 | ibm control_desk IBM Control Desk 7.6.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 219126. | 0,8% | — |
| CVE-2022-22302 | MED 5.3 | fortinet fortiauthenticator A clear text storage of sensitive information (CWE-312) vulnerability in both FortiGate version 6.4.0 through 6.4.1, 6.2.0 through 6.2.9 and 6.0.0 through 6.0.13 and FortiAuthenticator version 5.5.0 and all versions of 6.1 and 6.0 may allow a local unauthorize | 0,3% | — |