56.959 CVE seguite
777 Sfruttate ora
183 Usate dai ransomware
Ultima sincronia
CVE Tracker
56.959 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordinato dal più basso | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2024-48019 | MED 5.4 | apache doris Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Files or Directories Accessible to External Parties vulnerability in Apache Doris. Application administrators can read arbitrary files from the server filesystem through path tra | 1,0% | — |
| CVE-2024-45761 | MED 5.4 | dell openmanage_server_administrator Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains an improper input validation vulnerability. A remote low-privileged malicious user could potentially exploit this vulnerability to load any web plugins or Java class leading to the pos | 0,3% | — |
| CVE-2024-43580 | MED 5.4 | microsoft edge_chromium Microsoft Edge (Chromium-based) Spoofing Vulnerability | 0,4% | — |
| CVE-2024-43176 | MED 5.4 | ibm openpages_with_watson IBM OpenPages 9.0 could allow an authenticated user to obtain sensitive information such as configurations that should only be available to privileged users. | 0,3% | — |
| CVE-2024-39863 | MED 5.4 | apache airflow Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue. | 1,0% | — |
| CVE-2024-39534 | MED 5.4 | juniper junos_os_evolved An Incorrect Comparison vulnerability in the local address verification API of Juniper Networks Junos OS Evolved allows an unauthenticated network-adjacent attacker to create sessions or send traffic to the device using the network and broadcast address of the | 0,7% | — |
| CVE-2024-38503 | MED 5.4 | apache syncope When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”. | 0,7% | — |
| CVE-2024-38217 | MED 5.4 | microsoft windows_10_1507 Windows Mark of the Web Security Feature Bypass Vulnerability | 10,0% | |
| CVE-2024-37527 | MED 5.4 | ibm openpages_with_watson IBM OpenPages with Watson 8.3 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure | 0,2% | — |
| CVE-2024-36387 | MED 5.4 | apache http_server Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance. | 1,7% | — |
| CVE-2024-35280 | MED 5.4 | fortinet fortideceptor A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiDeceptor 5.3.0, FortiDeceptor 5.2.0, FortiDeceptor 5.1 all versions, FortiDeceptor 5.0 all versions, FortiDeceptor 4.3 all versions, FortiDece | 0,3% | — |
| CVE-2024-32077 | MED 5.4 | apache airflow Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs. Users are recommended to upgrade to version 2.9.1, which fixes this issue. | 1,6% | — |
| CVE-2024-30058 | MED 5.4 | microsoft edge_chromium Microsoft Edge (Chromium-based) Spoofing Vulnerability | 0,4% | — |
| CVE-2024-30057 | MED 5.4 | microsoft edge Microsoft Edge for iOS Spoofing Vulnerability | 0,4% | — |
| CVE-2024-30055 | MED 5.4 | microsoft edge_chromium Microsoft Edge (Chromium-based) Spoofing Vulnerability | 0,6% | — |
| CVE-2024-30050 | MED 5.4 | microsoft windows_10_1507 Windows Mark of the Web Security Feature Bypass Vulnerability | 11,5% | — |
| CVE-2024-30041 | MED 5.4 | microsoft bing_search Microsoft Bing Search Spoofing Vulnerability | 0,7% | — |
| CVE-2024-29986 | MED 5.4 | microsoft edge_chromium Microsoft Edge for Android (Chromium-based) Information Disclosure Vulnerability | 0,5% | — |
| CVE-2024-29133 | MED 5.4 | apache commons_configuration Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommended to upgrade to version 2.10.1, which fixes the issue. | 1,7% | — |
| CVE-2024-28776 | MED 5.4 | ibm cognos_controller IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to | 0,2% | — |
| CVE-2024-27785 | MED 5.4 | fortinet fortiaiops An improper neutralization of formula elements in a CSV File [CWE-1236] vulnerability in Fortinet FortiAIOps 2.0.0 may allow a remote authenticated attacker to execute arbitrary commands on a client's workstation via poisoned CSV reports. | 0,4% | — |
| CVE-2024-27140 | MED 5.4 | apache archiva ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva. This issue affects Apache Archiva: from 2.0.0. As this project is retired, we do not plan to release a vers | 1,3% | — |
| CVE-2024-25705 | MED 5.4 | esri portal_for_arcgis There is a cross‑site scripting (XSS) vulnerability in Esri Portal for ArcGIS Experience Builder versions 11.1 and below on Windows and Linux that allows a remote, authenticated attacker with low‑privileged access to create a crafted link which, when clicked, | 0,5% | — |
| CVE-2024-25692 | MED 5.4 | esri portal_for_arcgis There is a cross-site-request forgery vulnerability in Esri Portal for ArcGIS Versions 11.1 and below that may in some cases allow a remote, unauthenticated attacker to trick an authorized user into executing unwanted actions via a crafted form. The impact to | 0,2% | — |
| CVE-2024-25090 | MED 5.4 | apache roller Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not | 0,8% | — |