56.713 CVE seguite
777 Sfruttate ora
183 Usate dai ransomware
Ultima sincronia
Ricerca: http
2706 CVE
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2017-6614 | MED 6.5 | cisco findit_network_probe A vulnerability in the file-download feature of the web user interface for Cisco FindIT Network Probe Software 1.0.0 could allow an authenticated, remote attacker to download and view any system file by using the affected software. The vulnerability is due to | 1,7% | — |
| CVE-2021-1574 | HIGH 8.8 | cisco business_process_automation Multiple vulnerabilities in the web-based management interface of Cisco Business Process Automation (BPA) could allow an authenticated, remote attacker to elevate privileges to Administrator. These vulnerabilities are due to improper authorization enforcement | 1,7% | — |
| CVE-2025-64153 | HIGH 7.2 | fortinet fortiextender_firmware A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.6.0 through 7.6.3, FortiExtender 7.4.0 through 7.4.7, FortiExtender 7.2 all versions, FortiExtender 7.0 all versions may allow an authentic | 1,7% | — |
| CVE-2015-6427 | MED 5.0 | cisco firesight_system_software Cisco FireSIGHT Management Center allows remote attackers to bypass the HTTP attack detection feature and avoid triggering Snort IDS rules via an SSL session that is mishandled after decryption, aka Bug ID CSCux53437. | 1,7% | — |
| CVE-2015-4286 | MED 5.0 | cisco unified_computing_system_central_software The web framework in Cisco UCS Central Software 1.3(0.99) allows remote attackers to read arbitrary files via a crafted HTTP request, aka Bug ID CSCuu41377. | 1,7% | — |
| CVE-2021-31349 | CRIT 9.8 | juniper 128_technology_session_smart_router_firmware The usage of an internal HTTP header created an authentication bypass vulnerability (CWE-287), allowing an attacker to view internal files, change settings, manipulate services and execute arbitrary code. This issue affects all Juniper Networks 128 Technology | 1,7% | — |
| CVE-2024-36387 | MED 5.4 | apache http_server Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance. | 1,7% | — |
| CVE-2021-1495 | MED 5.8 | cisco ios_xe Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability is due to incorrect handling of specific HTTP header param | 1,7% | — |
| CVE-2018-15319 | HIGH 7.5 | f5 big-ip_access_policy_manager On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.6, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. The issue is exposed with the non-default "normalize URI" configuration options used in iRules and/or | 1,7% | — |
| CVE-2020-26065 | MED 6.5 | cisco catalyst_sd-wan_manager A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct path traversal attacks and obtain read access to sensitive files on an affected system. The vulnerability is due t | 1,7% | — |
| CVE-2019-1863 | HIGH 8.1 | cisco integrated_management_controller_supervisor A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to make unauthorized changes to the system configuration. The vulnerability is due to insufficient auth | 1,7% | — |
| CVE-2017-12295 | MED 5.3 | cisco webex_meetings_server A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to access sensitive data about the application. An attacker could exploit this vulnerability to gain information to conduct additional reconnaissance attacks. The vu | 1,7% | — |
| CVE-2017-6784 | MED 5.3 | cisco small_business_rv340_firmware A vulnerability in the web interface of the Cisco RV340, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attac | 1,7% | — |
| CVE-2023-34434 | HIGH 7.5 | apache inlong Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. The attacker could bypass the current logic and achieve arbitrary file reading. To solve it, users are adv | 1,7% | — |
| CVE-2015-6309 | MED 6.8 | cisco email_security_appliance Cisco Email Security Appliance (ESA) 8.5.6-106 and 9.6.0-042 allows remote authenticated users to cause a denial of service (file-descriptor consumption and device reload) via crafted HTTP requests, aka Bug ID CSCuw32211. | 1,7% | — |
| CVE-2014-3407 | MED 5.0 | cisco adaptive_security_appliance_software The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9.3(.2) and earlier does not properly allocate memory blocks during HTTP packet handling, which allows remote attackers to cause a denial of service (memory consumption) via crafted | 1,7% | — |
| CVE-2018-0459 | MED 6.5 | cisco network_functions_virtualization_infrastructure A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to cause an affected system to reboot or shut down. The vulnerability is due to insufficient server-side | 1,7% | — |
| CVE-2018-5541 | HIGH 7.5 | f5 big-ip_application_security_manager When F5 BIG-IP ASM 13.0.0-13.1.0.1, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.5.1-11.5.6 is processing HTTP requests, an unusually large number of parameters can cause excessive CPU usage in the BIG-IP ASM bd process. | 1,7% | — |
| CVE-2022-20656 | MED 6.5 | cisco evolved_programmable_network_manager A vulnerability in the web-based management interface of Cisco PI and Cisco EPNM could allow an authenticated, remote attacker to conduct a path traversal attack on an affected device. To exploit this vulnerability, the attacker must have valid crede | 1,7% | — |
| CVE-2022-39951 | HIGH 7.2 | fortinet fortiweb A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb 6.4 all versions allows attacker to execute unauthorized code or comm | 1,7% | — |
| CVE-2011-3294 | MED 4.3 | cisco telepresence_video_communication_servers Cross-site scripting (XSS) vulnerability in the login page in the administrative interface on Cisco TelePresence Video Communication Servers (VCS) with software before X7.0 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP | 1,7% | — |
| CVE-2024-38202 | HIGH 7.3 | microsoft windows_10_1607 Summary Microsoft was notified that an elevation of privilege vulnerability exists in Windows Update, potentially enabling an attacker with basic user privileges to reintroduce previously mitigated vulnerabilities or circumvent some features of Virtualization | 1,7% | — |
| CVE-1999-1175 | HIGH 7.5 | cisco ios Web Cache Control Protocol (WCCP) in Cisco Cache Engine for Cisco IOS 11.2 and earlier does not use authentication, which allows remote attackers to redirect HTTP traffic to arbitrary hosts via WCCP packets to UDP port 2048. | 1,7% | — |
| CVE-2017-6163 | MED 5.9 | f5 big-ip_access_policy_manager In F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, PSM software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1, 11.4.0 to 11.5.4, when a virtual server uses the standard configuration of HTTP/2 or SPDY profile with Client SSL profile, and the client initi | 1,7% | — |
| CVE-2023-23392 | CRIT 9.8 | microsoft windows_11_21h2 HTTP Protocol Stack Remote Code Execution Vulnerability | 1,7% | — |