58.515 CVE seguite
796 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
58.515 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2018-11759 | HIGH 7.5 | apache tomcat_jk_connector The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by | 90,6% | — |
| CVE-2000-0402 | LOW 2.1 | microsoft sql_server The Mixed Mode authentication capability in Microsoft SQL Server 7.0 stores the System Administrator (sa) account in plaintext in a log file which is readable by any user, aka the "SQL Server 7.0 Service Pack Password" vulnerability. | 90,6% | — |
| CVE-2013-6429 | MED 6.8 | pivotal_software spring_framework The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks | 90,6% | — |
| CVE-2023-37582 | CRIT 9.8 | apache rocketmq The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. When NameServer address are leaked on the extranet and lack permission verification, an attacker can e | 90,4% | — |
| CVE-2006-2372 | HIGH 10.0 | microsoft dhcp_client_service Buffer overflow in the DHCP Client service for Microsoft Windows 2000 SP4, Windows XP SP1 and SP2, and Server 2003 up to SP1 allows remote attackers to execute arbitrary code via a crafted DHCP response. | 90,2% | — |
| CVE-2023-46264 | CRIT 9.8 | ivanti avalanche An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove code execution. | 90,2% | — |
| CVE-2015-3105 | HIGH 10.0 | adobe air Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and | 90,1% | — |
| CVE-2023-20073 | MED 5.3 | cisco rv340_firmware A vulnerability in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to insuffici | 90,1% | — |
| CVE-2020-11984 | CRIT 9.8 | apache http_server Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE | 90,0% | — |
| CVE-2012-1445 | MED 4.3 | aladdin esafe The ELF file parser in eSafe 7.0.17.0, Rising Antivirus 22.83.00.03, Fortinet Antivirus 4.2.254.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an ELF file with a modified abi field. NOTE: this may later be SPLIT into m | 89,9% | — |
| CVE-2012-1439 | MED 4.3 | aladdin esafe The ELF file parser in eSafe 7.0.17.0, Rising Antivirus 22.83.00.03, Fortinet Antivirus 4.2.254.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an ELF file with a modified padding field. NOTE: this may later be SPLIT in | 89,9% | — |
| CVE-2020-17132 | CRIT 9.1 | microsoft exchange_server Microsoft Exchange Remote Code Execution Vulnerability | 89,9% | — |
| CVE-2017-5645 | CRIT 9.8 | apache log4j In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code. | 89,8% | — |
| CVE-2017-12636 | HIGH 7.2 | apache couchdb CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 | 89,7% | — |
| CVE-2012-1423 | MED 4.3 | authentium command_antivirus The TAR file parser in Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, F-Prot Antivirus 4.6.2.117, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, K7 AntiVirus 9.77.3565, NOD32 Antivirus 5795, Norman Antivirus | 89,7% | — |
| CVE-2022-30522 | HIGH 7.5 | apache http_server If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort. | 89,5% | — |
| CVE-2011-3923 | CRIT 9.8 | apache struts Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands. | 89,5% | — |
| CVE-2023-21547 | HIGH 7.5 | microsoft windows_10_1607 Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability | 89,3% | — |
| CVE-2006-0026 | MED 6.5 | microsoft internet_information_server Buffer overflow in Microsoft Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows local and possibly remote attackers to execute arbitrary code via crafted Active Server Pages (ASP). | 89,3% | — |
| CVE-2015-2342 | HIGH 10.0 | vmware vcenter_server The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol. | 89,0% | — |
| CVE-2021-45456 | CRIT 9.8 | apache kylin Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may c | 88,9% | — |
| CVE-2020-9490 | HIGH 7.5 | apache http_server Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push of | 88,8% | — |
| CVE-2020-5398 | HIGH 7.5 | netapp data_availability_services In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the | 88,8% | — |
| CVE-2023-21769 | HIGH 7.5 | microsoft windows_10_1607 Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability | 88,7% | — |
| CVE-2022-30216 | HIGH 8.8 | microsoft windows_10 Windows Server Service Tampering Vulnerability | 88,6% | — |