58.507 CVE seguite
796 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
58.507 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2019-15976 | CRIT 9.8 | cisco data_center_network_manager Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. F | 92,8% | — |
| CVE-2023-35628 | HIGH 8.1 | microsoft windows_10_1507 Windows MSHTML Platform Remote Code Execution Vulnerability | 92,8% | — |
| CVE-2022-21907 | CRIT 9.8 | microsoft windows_10 HTTP Protocol Stack Remote Code Execution Vulnerability | 92,8% | — |
| CVE-2024-45216 | CRIT 9.8 | apache solr Improper Authentication vulnerability in Apache Solr. Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, w | 92,7% | — |
| CVE-2023-28302 | HIGH 7.5 | microsoft windows_10_1607 Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability | 92,6% | — |
| CVE-2023-21758 | HIGH 7.5 | microsoft windows_10 Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability | 92,5% | — |
| CVE-2009-3103 | HIGH 10.0 | microsoft windows_server_2008 Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a denial of service (system crash) v | 92,3% | — |
| CVE-2022-41622 | HIGH 8.8 | f5 big-ip_access_policy_manager In all versions, BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | 92,3% | — |
| CVE-2015-0359 | HIGH 10.0 | adobe flash_player Double free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CV | 92,1% | — |
| CVE-2010-1870 | MED 5.0 | apache struts The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects | 92,0% | — |
| CVE-2019-0227 | HIGH 7.5 | apache axis A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from sou | 91,9% | — |
| CVE-2017-12629 | CRIT 9.8 | apache solr Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnera | 91,9% | — |
| CVE-2012-1461 | MED 4.3 | anti-virus vba32 The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, F-Secure Anti-Virus 9.0.16160.0, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Ant | 91,7% | — |
| CVE-2019-11479 | HIGH 7.5 | canonical ubuntu_linux Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service | 91,7% | — |
| CVE-2017-0004 | HIGH 7.5 | microsoft windows_7 The Local Security Authority Subsystem Service (LSASS) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to cause a denial of service (reboot) via a crafted authentication request, aka "Local Security | 91,4% | — |
| CVE-2014-0054 | MED 6.8 | springsource spring_framework The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attac | 91,4% | — |
| CVE-2024-27316 | HIGH 7.5 | apache http_server HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion. | 91,3% | — |
| CVE-2014-0569 | HIGH 9.3 | adobe air_desktop_runtime Integer overflow in Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allo | 91,3% | — |
| CVE-2015-7547 | HIGH 8.1 | canonical ubuntu_linux Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via | 91,0% | — |
| CVE-2022-26809 | CRIT 9.8 | microsoft windows_10 Remote Procedure Call Runtime Remote Code Execution Vulnerability | 91,0% | — |
| CVE-2009-3023 | HIGH 9.0 | microsoft internet_information_server Buffer overflow in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 6.0 allows remote authenticated users to execute arbitrary code via a crafted NLST (NAME LIST) command that uses wildcards, leading to memory corruption, aka "IIS F | 90,9% | — |
| CVE-2010-0219 | HIGH 10.0 | apache axis2 Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a | 90,9% | — |
| CVE-2001-0333 | HIGH 7.5 | microsoft internet_information_server Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "\" characters twice. | 90,8% | — |
| CVE-2007-0450 | MED 5.0 | apache http_server Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with comb | 90,8% | — |
| CVE-2011-3368 | MED 5.0 | apache http_server The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows | 90,7% | — |