56.580 CVE seguite
773 Sfruttate ora
183 Usate dai ransomware
Ultima sincronia
CVE Tracker
56.580 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordinato dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2021-26895 | CRIT 9.8 | microsoft windows_server_2008 Windows DNS Server Remote Code Execution Vulnerability | 7,3% | — |
| CVE-2021-26894 | CRIT 9.8 | microsoft windows_server_2008 Windows DNS Server Remote Code Execution Vulnerability | 7,3% | — |
| CVE-2021-26893 | CRIT 9.8 | microsoft windows_server_2008 Windows DNS Server Remote Code Execution Vulnerability | 7,0% | — |
| CVE-2021-26877 | CRIT 9.8 | microsoft windows_server_2008 Windows DNS Server Remote Code Execution Vulnerability | 16,5% | — |
| CVE-2021-26691 | CRIT 9.8 | apache http_server In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow | 68,3% | — |
| CVE-2021-26634 | CRIT 9.8 | maxb maxboard SQL injection and file upload attacks are possible due to insufficient validation of input values in some parameters and variables of files compromising Maxboard, which may lead to arbitrary code execution or privilege escalation. Attackers can use these vulne | 1,3% | — |
| CVE-2021-26606 | CRIT 9.8 | dreamsecurity magicline4nx.exe A vulnerability in PKI Security Solution of Dream Security could allow arbitrary command execution. This vulnerability is due to insufficient validation of the authorization certificate. An attacker could exploit this vulnerability by sending a crafted HTTP re | 2,4% | — |
| CVE-2021-26461 | CRIT 9.8 | apache nuttx Apache Nuttx Versions prior to 10.1.0 are vulnerable to integer wrap-around in functions malloc, realloc and memalign. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code in | 5,0% | — |
| CVE-2021-26432 | CRIT 9.8 | microsoft windows_10 Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability | 11,3% | — |
| CVE-2021-26295 | CRIT 9.8 | apache ofbiz Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz. | 97,8% | — |
| CVE-2021-26114 | CRIT 9.8 | fortinet fortiwan Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiWAN before 4.5.9 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. | 1,5% | — |
| CVE-2021-26102 | CRIT 9.8 | fortinet fortiwan A relative path traversal vulnerability (CWE-23) in FortiWAN version 4.5.7 and below, 4.4 all versions may allow a remote non-authenticated attacker to delete files on the system by sending a crafted POST request. In particular, deleting specific configuration | 16,8% | — |
| CVE-2021-25641 | CRIT 9.8 | apache dubbo Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte | 21,2% | — |
| CVE-2021-24094 | CRIT 9.8 | microsoft windows_10 Windows TCP/IP Remote Code Execution Vulnerability | 22,1% | — |
| CVE-2021-24078 | CRIT 9.8 | microsoft windows_server_2008 Windows DNS Server Remote Code Execution Vulnerability | 11,2% | — |
| CVE-2021-24077 | CRIT 9.8 | microsoft windows_10 Windows Fax Service Remote Code Execution Vulnerability | 2,7% | — |
| CVE-2021-24074 | CRIT 9.8 | microsoft windows_10 Windows TCP/IP Remote Code Execution Vulnerability | 25,7% | — |
| CVE-2021-24007 | CRIT 9.8 | fortinet fortimail Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail before 6.4.4 may allow a non-authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. | 1,4% | — |
| CVE-2021-23008 | CRIT 9.8 | f5 big-ip_access_policy_manager On version 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and all versions of 16.0.x and 11.6.x., BIG-IP APM AD (Active Directory) authentication can be bypassed via a spoofed AS-REP (Kerberos Authentication Service Res | 1,3% | — |
| CVE-2021-22992 | CRIT 9.8 | f5 big-ip_access_policy_manager On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, a malicious HTTP response to an Advanced WAF/BIG-IP ASM virtual server with Login Page configur | 72,7% | — |
| CVE-2021-22991 | CRIT 9.8 | f5 big-ip_access_policy_manager On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI nor | 61,1% | |
| CVE-2021-22986 | CRIT 9.8 | ransomware f5 big-ip_access_policy_manager On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote | 99,9% | |
| CVE-2021-22941 | CRIT 9.8 | ransomware citrix sharefile_storagezones_controller Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compromise the storage zones controller. | 53,6% | |
| CVE-2021-22891 | CRIT 9.8 | citrix sharefile_storagezones_controller A missing authorization vulnerability exists in Citrix ShareFile Storage Zones Controller before 5.7.3, 5.8.3, 5.9.3, 5.10.1 and 5.11.18 may allow unauthenticated remote compromise of the Storage Zones Controller. | 1,1% | — |
| CVE-2021-22160 | CRIT 9.8 | apache pulsar If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as | 52,9% | — |