57.479 CVE seguite
782 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
57.479 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2011-0677 | HIGH 7.2 | microsoft windows_2003_server win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted applica | 1,4% | — |
| CVE-2011-0673 | HIGH 7.2 | microsoft windows_xp win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP3 allows local users to gain privileges via a crafted application that triggers a NULL pointer dereference, aka "Win32k Null Pointer De-reference Vulnerability." | 1,4% | — |
| CVE-2021-36194 | HIGH 8.8 | fortinet fortiweb Multiple stack-based buffer overflows in the API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to achieve arbitrary code execution via specially crafted requests. | 1,4% | — |
| CVE-2011-1503 | LOW 3.5 | liferay liferay_portal The XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat or Oracle GlassFish is used, allows remote authenticated users to read arbitrary (1) XSL and (2) XML files via a file:/// URL. | 1,4% | — |
| CVE-2008-3819 | MED 5.0 | cisco gss_4480_global_site_selector dnsserver in Cisco Application Control Engine Global Site Selector (GSS) before 3.0(1) allows remote attackers to cause a denial of service (daemon crash) via a series of crafted DNS requests, aka Bug ID CSCsj70093. | 1,4% | — |
| CVE-1999-1001 | LOW 2.6 | cisco cache_engine Cisco Cache Engine allows a remote attacker to gain access via a null username and password. | 1,4% | — |
| CVE-2025-21291 | HIGH 8.8 | microsoft windows_10_1809 Windows Direct Show Remote Code Execution Vulnerability | 1,4% | — |
| CVE-2024-49124 | HIGH 8.1 | microsoft windows_10_1507 Lightweight Directory Access Protocol (LDAP) Client Remote Code Execution Vulnerability | 1,4% | — |
| CVE-2023-35893 | CRIT 9.9 | ibm security_guardium IBM Security Guardium 10.6, 11.3, 11.4, and 11.5 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 258824. | 1,4% | — |
| CVE-2021-42297 | MED 5.0 | microsoft windows_10_update_assistant Windows 10 Update Assistant Elevation of Privilege Vulnerability | 1,4% | — |
| CVE-2018-0120 | MED 4.3 | cisco unified_communications_manager A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct an SQL injection attack against an affected system. The vulnerability exists because the affected software fails to validate u | 1,4% | — |
| CVE-2015-0689 | HIGH 7.5 | cisco cloud_web_security Cisco Cloud Web Security before 3.0.1.7 allows remote attackers to bypass intended filtering protection mechanisms by leveraging improper handling of HTTP methods, aka Bug ID CSCut69743. | 1,4% | — |
| CVE-2013-3438 | MED 5.0 | cisco unified_meetingplace_web_conferencing The web framework in the server in Cisco Unified MeetingPlace Web Conferencing allows remote attackers to bypass intended access restrictions and read unspecified web pages via crafted parameters, aka Bug ID CSCuh86385. | 1,4% | — |
| CVE-2001-0865 | HIGH 7.5 | cisco 12000_router Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not support the "fragment" keyword in an outgoing ACL, which could allow fragmented packets in violation of the intended access. | 1,4% | — |
| CVE-2001-0621 | HIGH 7.5 | cisco content_services_switch_11000 The FTP server on Cisco Content Service 11000 series switches (CSS) before WebNS 4.01B23s and WebNS 4.10B13s allows an attacker who is an FTP user to read and write arbitrary files via GET or PUT commands. | 1,4% | — |
| CVE-2024-26251 | MED 6.8 | microsoft sharepoint_server Microsoft SharePoint Server Spoofing Vulnerability | 1,4% | — |
| CVE-2023-44323 | MED 5.5 | microsoft edge_chromium Adobe Acrobat for Edge version 118.0.2088.46 (and earlier) is affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation | 1,4% | — |
| CVE-2020-4161 | MED 6.5 | ibm db2 IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 could allow an authenticated attacker to cause a denial of service due to incorrect handling of certain commands. IBM X-Force ID: 174341. | 1,4% | — |
| CVE-2017-5110 | MED 6.5 | debian debian_linux Inappropriate implementation of the web payments API on blob: and data: schemes in Web Payments in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to spoof the contents of the Omnibox via a crafted HTML page. | 1,4% | — |
| CVE-2017-5101 | MED 6.5 | debian debian_linux Inappropriate implementation in Omnibox in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to spoof the contents of the Omnibox via a crafted HTML page. | 1,4% | — |
| CVE-2017-5067 | MED 6.5 | google chrome An insufficient watchdog timer in navigation in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. | 1,4% | — |
| CVE-2017-6720 | MED 6.5 | cisco esw2-350g-52_firmware A vulnerability in the Secure Shell (SSH) subsystem of Cisco Small Business Managed Switches software could allow an authenticated, remote attacker to cause a reload of the affected switch, resulting in a denial of service (DoS) condition. The vulnerability is | 1,4% | — |
| CVE-2015-1805 | HIGH 7.2 | google android The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of ser | 1,4% | — |
| CVE-2014-2151 | MED 4.0 | cisco adaptive_security_appliance_software The WebVPN portal in Cisco Adaptive Security Appliance (ASA) Software 8.4(.7.15) and earlier allows remote authenticated users to obtain sensitive information via a crafted JavaScript file, aka Bug ID CSCui04520. | 1,4% | — |
| CVE-2011-3640 | HIGH 7.1 | google chrome Untrusted search path vulnerability in Mozilla Network Security Services (NSS), as used in Google Chrome before 17 on Windows and Mac OS X, might allow local users to gain privileges via a Trojan horse pkcs11.txt file in a top-level directory. NOTE: the vendor | 1,4% | — |