56.580 CVE seguite
773 Sfruttate ora
183 Usate dai ransomware
Ultima sincronia
CVE Tracker
56.580 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordinato dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2021-33055 | CRIT 9.8 | zohocorp manageengine_adselfservice_plus Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions. | 18,1% | — |
| CVE-2021-32824 | CRIT 9.8 | apache dubbo Apache Dubbo is a java based, open source RPC framework. Versions prior to 2.6.10 and 2.7.10 are vulnerable to pre-auth remote code execution via arbitrary bean manipulation in the Telnet handler. The Dubbo main service port can be used to access a Telnet Hand | 2,9% | — |
| CVE-2021-32588 | CRIT 9.8 | fortinet fortiportal A use of hard-coded credentials (CWE-798) vulnerability in FortiPortal versions 5.2.5 and below, 5.3.5 and below, 6.0.4 and below, versions 5.1.x and 5.0.x may allow a remote and unauthenticated attacker to execute unauthorized commands as root by uploading an | 3,3% | — |
| CVE-2021-31914 | CRIT 9.8 | jetbrains teamcity In JetBrains TeamCity before 2020.2.4 on Windows, arbitrary code execution on TeamCity Server was possible. | 2,3% | — |
| CVE-2021-31805 | CRIT 9.8 | apache struts The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation | 85,4% | — |
| CVE-2021-31522 | CRIT 9.8 | apache kylin Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions. | 2,9% | — |
| CVE-2021-31349 | CRIT 9.8 | juniper 128_technology_session_smart_router_firmware The usage of an internal HTTP header created an authentication bypass vulnerability (CWE-287), allowing an attacker to view internal files, change settings, manipulate services and execute arbitrary code. This issue affects all Juniper Networks 128 Technology | 1,7% | — |
| CVE-2021-31166 | CRIT 9.8 | microsoft windows_10_2004 HTTP Protocol Stack Remote Code Execution Vulnerability | 99,7% | |
| CVE-2021-3064 | CRIT 9.8 | paloaltonetworks pan-os A memory corruption vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to disrupt system processes and potentially execute arbitrary code with root privileges. The attac | 19,1% | — |
| CVE-2021-3044 | CRIT 9.8 | paloaltonetworks cortex_xsoar An improper authorization vulnerability in Palo Alto Networks Cortex XSOAR enables a remote unauthenticated attacker with network access to the Cortex XSOAR server to perform unauthorized actions through the REST API. This issue impacts: Cortex XSOAR 6.1.0 bui | 1,4% | — |
| CVE-2021-30181 | CRIT 9.8 | apache dubbo Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubb | 60,6% | — |
| CVE-2021-30180 | CRIT 9.8 | apache dubbo Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo custome | 60,4% | — |
| CVE-2021-30179 | CRIT 9.8 | apache dubbo Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by the GenericFilter which will find the service and method specified in the first arguments of the invoc | 4,1% | — |
| CVE-2021-3013 | CRIT 9.8 | ripgrep_project ripgrep ripgrep before 13 on Windows allows attackers to trigger execution of arbitrary programs from the current working directory via the -z/--search-zip or --pre flag. | 1,9% | — |
| CVE-2021-30128 | CRIT 9.8 | apache ofbiz Apache OFBiz has unsafe deserialization prior to 17.12.07 version | 81,2% | — |
| CVE-2021-29798 | CRIT 9.8 | ibm sterling_b2b_integrator IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.1.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end databa | 1,1% | — |
| CVE-2021-29781 | CRIT 9.8 | ibm partner_engagement_manager IBM Partner Engagement Manager 2.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary code on the | 2,9% | — |
| CVE-2021-29200 | CRIT 9.8 | apache ofbiz Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack | 55,4% | — |
| CVE-2021-28481 | CRIT 9.8 | microsoft exchange_server Microsoft Exchange Server Remote Code Execution Vulnerability | 36,5% | — |
| CVE-2021-28480 | CRIT 9.8 | microsoft exchange_server Microsoft Exchange Server Remote Code Execution Vulnerability | 71,4% | — |
| CVE-2021-27905 | CRIT 9.8 | apache solr The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the loca | 93,1% | — |
| CVE-2021-27850 | CRIT 9.8 | apache tapestry A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before | 93,8% | — |
| CVE-2021-27193 | CRIT 9.8 | netop vision_pro Incorrect default permissions vulnerability in the API of Netop Vision Pro up to and including 9.7.1 allows a remote unauthenticated attacker to read and write files on the remote machine with system privileges resulting in a privilege escalation. | 1,5% | — |
| CVE-2021-26987 | CRIT 9.8 | netapp element_plug-in_for_vcenter_server Element Plug-in for vCenter Server incorporates SpringBoot Framework. SpringBoot Framework versions prior to 1.3.2 are susceptible to a vulnerability which when successfully exploited could lead to Remote Code Execution. All versions of Element Plug-in for vCe | 2,4% | — |
| CVE-2021-26897 | CRIT 9.8 | microsoft windows_server_2008 Windows DNS Server Remote Code Execution Vulnerability | 11,6% | — |