58.127 CVE seguite
788 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
58.127 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordinato dal più alto |
|---|---|---|---|---|
| CVE-2024-45844 | HIGH 7.2 | f5 big-ip_access_policy_manager BIG-IP monitor functionality may allow an attacker to bypass access control restrictions, regardless of the port lockdown settings. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | 10,6% | — |
| CVE-2024-45828 | MED 5.5 | linux linux_kernel In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request Bus cleanup path in DMA mode may trigger a RING_OP_STAT interrupt when the ring is being stopped. Depending on timing between | 0,3% | — |
| CVE-2024-45791 | HIGH 7.5 | apache hertzbeat Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: before 1.6.1. Users are recommended to upgrade to version 1.6.1, which fixes the issue. | 0,8% | — |
| CVE-2024-45784 | HIGH 7.5 | apache airflow Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnerability allows DAG authors to unintentionally or intentionally log sensitive configuration variables. Unauthorized users | 1,3% | — |
| CVE-2024-45772 | MED 5.1 | apache lucene_replicator Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator. This issue affects Apache Lucene's replicator module: from 4.4.0 before 9.12.0. The deprecated org.apache.lucene.replicator.http package is affected. The org.apache.lucene.replicator | 0,6% | — |
| CVE-2024-45761 | MED 5.4 | dell openmanage_server_administrator Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains an improper input validation vulnerability. A remote low-privileged malicious user could potentially exploit this vulnerability to load any web plugins or Java class leading to the pos | 0,4% | — |
| CVE-2024-45733 | HIGH 8.8 | splunk splunk In Splunk Enterprise for Windows versions below 9.2.3 and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a Remote Code Execution (RCE) due to an insecure session storage configuration. | 1,1% | — |
| CVE-2024-45731 | HIGH 8.0 | splunk splunk In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could write a file to the Windows system root directory, which has a default location in the Windows System32 | 0,5% | — |
| CVE-2024-45720 | HIGH 8.2 | apache subversion On Windows platforms, a "best fit" character encoding conversion of command line arguments to Subversion's executables (e.g., svn.exe, etc.) may lead to unexpected command line argument interpretation, including argument injection and execution of other progra | 0,6% | — |
| CVE-2024-45719 | LOW 2.6 | apache answer Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.0. The ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable. Users are re | 0,2% | — |
| CVE-2024-45693 | HIGH 8.0 | apache cloudstack Users logged into the Apache CloudStack's web interface can be tricked to submit malicious CSRF requests due to missing validation of the origin of the requests. This can allow an attacker to gain privileges and access to resources of the authenticated users a | 0,5% | — |
| CVE-2024-45673 | MED 5.5 | ibm security_verify_bridge_directory_sync IBM Security Verify Bridge Directory Sync 1.0.1 through 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 through 1.0.10, and IBM Security Verify Gateway for Radius 1.0.1 through 1.0.11 stores user credentials in configuration files which can be read | 0,1% | — |
| CVE-2024-45671 | MED 5.9 | ibm security_verify_information_queue IBM Security Verify Information Queue 10.0.5, 10.0.6, 10.0.7, and 10.0.8 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. | 0,2% | — |
| CVE-2024-45669 | MED 6.5 | ibm security_verify_information_queue IBM Security Verify Information Queue 10.0.5, 10.0.6, 10.0.7, and 10.0.8 could allow a remote user to cause a denial of service due to improper handling of special characters that could lead to uncontrolled resource consumption. | 0,4% | — |
| CVE-2024-45654 | MED 4.3 | ibm security_qradar_edr IBM Security ReaQta 3.12 could allow an authenticated user to perform unauthorized actions due to reliance on untrusted inputs. | 0,4% | — |
| CVE-2024-45651 | MED 6.3 | ibm sterling_connect_direct_web_services IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 does not invalidate session after a browser closure which could allow an authenticated user to impersonate another user on the system. | 0,3% | — |
| CVE-2024-45644 | MED 4.7 | ibm security_qradar_edr IBM Security ReaQta 3.12 allows a privileged user to upload or transfer files of dangerous types that can be automatically processed within the product's environment. | 0,3% | — |
| CVE-2024-45643 | MED 5.9 | ibm security_qradar_edr IBM Security QRadar 3.12 EDR uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive credential information. | 0,2% | — |
| CVE-2024-45642 | MED 5.3 | ibm security_qradar_edr IBM Security ReaQta 3.12 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted | 0,5% | — |
| CVE-2024-45641 | MED 6.5 | ibm security_qradar_edr IBM Security ReaQta EDR 3.12 could allow an attacker to perform unauthorized actions due to improper SSL certificate validation. | 0,2% | — |
| CVE-2024-45640 | MED 5.3 | ibm security_qradar_edr IBM Security ReaQta 3.12 returns sensitive information in an HTTP response that could be used in further attacks against the system. | 0,3% | — |
| CVE-2024-45638 | MED 4.1 | ibm security_qradar_edr IBM Security QRadar 3.12 EDR stores user credentials in plain text which can be read by a local privileged user. | 0,1% | — |
| CVE-2024-45627 | MED 5.9 | apache linkis In Apache Linkis <1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will allow the attacker to read arbitrary files from the Linkis server. Therefore, the par | 0,3% | — |
| CVE-2024-45626 | MED 6.5 | apache james_server Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a denial of service. Users are recommended to upgrade to version 3.7.6 and 3.8.2, which fix this issue. | 0,8% | — |
| CVE-2024-45537 | MED 6.5 | apache druid Apache Druid allows users with certain permissions to read data from other database systems using JDBC. This functionality allows trusted users to set up Druid lookups or run ingestion tasks. Druid also allows administrators to configure a list of allowed prop | 0,6% | — |