57.080 CVE seguite
777 Sfruttate ora
184 Usate dai ransomware
Ultima sincronia
CVE Tracker
57.080 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2015-0699 | MED 5.0 | cisco unified_communications_domain_manager SQL injection vulnerability in the Interactive Voice Response (IVR) component in Cisco Unified Communications Manager (UCM) 10.5(1.98991.13) allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCut21563. | 1,9% | — |
| CVE-2022-20812 | CRIT 9.0 | cisco expressway Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow a remote attacker to overwrite arbitrary files or conduct null byte poisoning attacks o | 1,9% | — |
| CVE-2020-17091 | HIGH 7.8 | microsoft teams Microsoft Teams Remote Code Execution Vulnerability | 1,9% | — |
| CVE-2013-1332 | HIGH 7.2 | microsoft windows_7 dxgkrnl.sys (aka the DirectX graphics kernel subsystem) in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not properly handle objects in memory, whi | 1,9% | — |
| CVE-2011-1886 | LOW 2.1 | microsoft windows_xp win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP3 does not properly validate the arguments to functions, which allows local users to read arbitrary data from kernel memory via a crafted application that triggers a NULL pointer dereference, aka | 1,9% | — |
| CVE-1999-1582 | HIGH 7.5 | cisco pix_firewall By design, the "established" command on the Cisco PIX firewall allows connections from one host to arbitrary ports of a target host if an alternative conduit has already been allowed, which can cause administrators to configure less restrictive access controls | 1,9% | — |
| CVE-2023-36553 | CRIT 9.8 | fortinet fortisiem A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM version 5.4.0 and 5.3.0 through 5.3.3 and 5.2.5 through 5.2.8 and 5.2.1 through 5.2.2 and 5.1.0 through 5.1.3 and 5.0.0 through 5.0.1 and 4.10.0 | 1,9% | — |
| CVE-2014-4074 | HIGH 7.2 | microsoft windows_8 The Task Scheduler in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via an application that schedules a crafted task, aka "Task Scheduler Vulnerability." | 1,9% | — |
| CVE-2021-36945 | HIGH 7.3 | microsoft windows_10_update_assistant Windows 10 Update Assistant Elevation of Privilege Vulnerability | 1,9% | — |
| CVE-2020-11980 | MED 6.3 | apache karaf In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. By default, only an "admin" can actually invoke on an MBean. However there is a vulnerability there for someone who is not an admin, but has a "viewer" role. In | 1,9% | — |
| CVE-2004-1416 | MED 5.1 | pnxr3260.dll in the RealOne 2.0 build 6.0.11.868 browser plugin, as used in Internet Explorer, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted embed tag. | 1,9% | — |
| CVE-2019-9133 | MED 5.5 | fedoraproject fedora When processing subtitles format media file, KMPlayer version 2018.12.24.14 or lower doesn't check object size correctly, which leads to integer underflow then to memory out-of-bound read/write. An attacker can exploit this issue by enticing an unsuspecting us | 1,9% | — |
| CVE-2017-5103 | MED 4.3 | debian debian_linux Use of an uninitialized value in Skia in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. | 1,9% | — |
| CVE-2017-5102 | MED 4.3 | debian debian_linux Use of an uninitialized value in Skia in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. | 1,9% | — |
| CVE-2016-5720 | HIGH 7.8 | microsoft skype Multiple untrusted search path vulnerabilities in Microsoft Skype allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) msi.dll, (2) dpapi.dll, or (3) cryptui.dll that is located in the current working directory. | 1,9% | — |
| CVE-2023-38156 | HIGH 7.2 | microsoft azure_hdinsight Azure HDInsight Apache Ambari JDBC Injection Elevation of Privilege Vulnerability | 1,9% | — |
| CVE-2021-37533 | MED 6.5 | apache commons_net Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may le | 1,9% | — |
| CVE-2015-0772 | HIGH 7.1 | cisco telepresence_video_communication_server_software Cisco TelePresence Video Communication Server (VCS) X8.5RC4 allows remote attackers to cause a denial of service (CPU consumption or device outage) via a crafted SDP parameter-negotiation request in an SDP session during a SIP connection, aka Bug ID CSCut42422 | 1,9% | — |
| CVE-2013-1191 | HIGH 7.1 | cisco nexus_7000 Cisco NX-OS 6.1 before 6.1(5) on Nexus 7000 devices, when local authentication and multiple VDCs are enabled, allows remote authenticated users to gain privileges within an unintended VDC via crafted SSH key data in an SSH session to a management interface, ak | 1,9% | — |
| CVE-2021-25241 | MED 5.3 | trendmicro apex_one A server-side request forgery (SSRF) information disclosure vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to locate online agents via a sweep. | 1,9% | — |
| CVE-2020-3195 | HIGH 7.5 | cisco adaptive_security_appliance_software A vulnerability in the Open Shortest Path First (OSPF) implementation in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a memory leak on an affected de | 1,9% | — |
| CVE-2019-14688 | HIGH 7.0 | trendmicro control_manager Trend Micro has repackaged installers for several Trend Micro products that were found to utilize a version of an install package that had a DLL hijack vulnerability that could be exploited during a new product installation. The vulnerability was found to ONLY | 1,9% | — |
| CVE-2013-3167 | HIGH 7.2 | microsoft windows_7 win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 does not properly handle objects in memory, which allows local users to gain privileges | 1,9% | — |
| CVE-2012-0369 | HIGH 7.8 | cisco 2000_wireless_lan_controller Cisco Wireless LAN Controller (WLC) devices with software 6.0 and 7.0 before 7.0.220.0, 7.1 before 7.1.91.0, and 7.2 before 7.2.103.0 allow remote attackers to cause a denial of service (device reload) via a sequence of IPv6 packets, aka Bug ID CSCtt07949. | 1,9% | — |
| CVE-2024-38231 | MED 6.5 | microsoft windows_server_2008 Windows Remote Desktop Licensing Service Denial of Service Vulnerability | 1,9% | — |