58.535 CVE seguite
797 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
58.535 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2019-0626 | CRIT 9.8 | microsoft windows_10 A memory corruption vulnerability exists in the Windows Server DHCP service when an attacker sends specially crafted packets to a DHCP server, aka 'Windows DHCP Server Remote Code Execution Vulnerability'. | 68,6% | — |
| CVE-2015-7611 | HIGH 8.1 | apache james_server Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors. | 68,6% | — |
| CVE-2020-13951 | HIGH 7.5 | apache openmeetings Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack. | 68,6% | — |
| CVE-2021-21983 | MED 6.5 | vmware cloud_foundation Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying p | 68,6% | — |
| CVE-2018-8631 | HIGH 7.5 | microsoft internet_explorer A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. | 68,5% | — |
| CVE-2017-11893 | HIGH 7.5 | microsoft chakracore ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory | 68,5% | — |
| CVE-2001-0537 | HIGH 9.3 | cisco ios HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being used, by specifying a high access level in the URL. | 68,5% | — |
| CVE-2023-50290 | MED 6.5 | apache solr Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, | 68,4% | — |
| CVE-2006-1359 | HIGH 9.3 | microsoft ie Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain createTextRange call on a checkbox object, which results in a dereference of an invalid table pointer. | 68,3% | — |
| CVE-2012-0182 | HIGH 9.3 | microsoft word Microsoft Word 2007 SP2 and SP3 does not properly handle memory during the parsing of Word documents, which allows remote attackers to execute arbitrary code via a crafted document, aka "Word PAPX Section Corruption Vulnerability." | 68,3% | — |
| CVE-2020-13942 | CRIT 9.8 | apache unomi It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly | 68,3% | — |
| CVE-2021-26691 | CRIT 9.8 | apache http_server In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow | 68,3% | — |
| CVE-2018-8355 | HIGH 7.5 | microsoft chakracore A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge. This CVE ID is | 68,2% | — |
| CVE-2010-3332 | MED 6.4 | microsoft .net_framework Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify | 68,2% | — |
| CVE-2000-0630 | MED 5.0 | microsoft internet_information_server IIS 4.0 and 5.0 allows remote attackers to obtain fragments of source code by appending a +.htr to the URL, a variant of the "File Fragment Reading via .HTR" vulnerability. | 68,2% | — |
| CVE-2019-1166 | MED 5.9 | microsoft windows_10 A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) protection, aka 'Windows NTLM Tampering Vulnerability'. | 68,1% | — |
| CVE-2011-0654 | HIGH 10.0 | microsoft windows_2003_server Integer underflow in the BowserWriteErrorLogEntry function in the Common Internet File System (CIFS) browser service in Mrxsmb.sys or bowser.sys in Active Directory in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Window | 68,1% | — |
| CVE-2019-0233 | HIGH 7.5 | apache struts An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload. | 68,0% | — |
| CVE-2017-11809 | HIGH 7.5 | microsoft chakracore ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Eng | 68,0% | — |
| CVE-2019-13373 | CRIT 9.8 | dlink central_wifimanager An issue was discovered in the D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6. Input does not get validated and arbitrary SQL statements can be executed in the database via the /web/Public/Conn.php parameter dbSQL. | 68,0% | — |
| CVE-2022-0435 | HIGH 8.8 | fedoraproject fedora A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed. This flaw allows a remote user to crash the system | 68,0% | — |
| CVE-2008-5180 | MED 5.3 | microsoft office_communicator Microsoft Communicator, and Communicator in Microsoft Office 2010 beta, allows remote attackers to cause a denial of service (memory consumption) via a large number of SIP INVITE requests, which trigger the creation of many sessions. | 68,0% | — |
| CVE-1999-0612 | LOW 0.0 | gnu finger_service A version of finger is running that exposes valid user information to any entity on the network. | 68,0% | — |
| CVE-2010-0480 | HIGH 9.3 | microsoft windows_2000 Multiple stack-based buffer overflows in the MPEG Layer-3 audio codecs in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allow remote attackers to execute arbitrary code via a crafted AVI fil | 67,9% | — |
| CVE-2001-0151 | MED 5.0 | microsoft internet_information_services IIS 5.0 allows remote attackers to cause a denial of service via a series of malformed WebDAV requests. | 67,9% | — |