58.450 CVE seguite
792 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
58.450 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordinato dal più alto |
|---|---|---|---|---|
| CVE-2023-39553 | HIGH 7.5 | apache apache-airflow-providers-apache-drill Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider. Apache Airflow Drill Provider is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection with Drill | 2,3% | — |
| CVE-2023-3955 | HIGH 8.8 | kubernetes kubernetes A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes. | 3,1% | — |
| CVE-2023-39508 | HIGH 8.8 | apache airflow Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task" feature enables authenticated user to bypass some of the restrictions put in place. It | 2,6% | — |
| CVE-2023-39456 | HIGH 7.5 | apache traffic_server Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 9.2.3, which fixes the issue. | 53,8% | — |
| CVE-2023-39447 | MED 4.4 | f5 big-ip_access_policy_manager When BIG-IP APM Guided Configurations are configured, undisclosed sensitive information may be logged in restnoded log. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | 0,2% | — |
| CVE-2023-39441 | MED 5.9 | apache airflow Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Airflow before 2.7.0 are affected by the Validation of OpenSSL Certificate vulnerability. The default SSL context with SSL library did not check a server's X.509 | 0,8% | — |
| CVE-2023-39412 | MED 5.4 | intel unison_software Cross-site request forgery in some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access. | 0,3% | — |
| CVE-2023-39411 | MED 5.0 | intel unison_software Improper input validationation for some Intel Unison software may allow a privileged user to potentially enable denial of service via local access. | 0,2% | — |
| CVE-2023-39410 | HIGH 7.5 | apache avro When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Java applications using Apache Avro Java SDK up to and including 1.11 | 1,8% | — |
| CVE-2023-3937 | MED 4.8 | snowsoftware snow_license_manager Cross site scripting vulnerability in web portal in Snow Software License Manager from version 9.0.0 up to and including 9.30.1 on Windows allows an authenticated user with high privileges to trigger cross site scripting attack via the web browser | 0,3% | — |
| CVE-2023-39265 | LOW 3.8 | apache superset Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Add | 86,2% | — |
| CVE-2023-39264 | MED 4.3 | apache superset By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0. | 1,1% | — |
| CVE-2023-39246 | MED 4.6 | dell encryption Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server version prior to 11.8.1 contain an Insecure Operation on Windows Junction Vulnerability during installation. A local malicious user could potentially exploit this vu | 0,2% | — |
| CVE-2023-39228 | MED 5.3 | intel unison_software Improper access control for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via network access. | 0,7% | — |
| CVE-2023-39221 | MED 5.4 | intel unison_software Improper access control for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access. | 0,4% | — |
| CVE-2023-39198 | HIGH 7.5 | fedoraproject fedora A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an attac | 0,4% | — |
| CVE-2023-39197 | MED 4.0 | fedoraproject fedora An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol. | 1,0% | — |
| CVE-2023-39196 | MED 5.3 | apache ozone Improper Authentication vulnerability in Apache Ozone. The vulnerability allows an attacker to download metadata internal to the Storage Container Manager service without proper authentication. The attacker is not allowed to do any modification within the Ozo | 0,8% | — |
| CVE-2023-39194 | LOW 3.2 | fedoraproject fedora A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger | 0,4% | — |
| CVE-2023-39193 | MED 6.1 | fedoraproject fedora A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosur | 0,4% | — |
| CVE-2023-39192 | MED 6.7 | fedoraproject fedora A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds read by setting the size fields with a value beyond | 0,4% | — |
| CVE-2023-39191 | HIGH 8.2 | fedoraproject fedora An improper input validation flaw was found in the eBPF subsystem in the Linux kernel. The issue occurs due to a lack of proper validation of dynamic pointers within user-supplied eBPF programs prior to executing them. This may allow an attacker with CAP_BPF p | 0,5% | — |
| CVE-2023-39189 | MED 5.1 | fedoraproject fedora A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading | 0,4% | — |
| CVE-2023-39180 | MED 4.0 | linux linux_kernel A flaw was found within the handling of SMB2_READ commands in the kernel ksmbd module. The issue results from not releasing memory after its effective lifetime. An attacker can leverage this to create a denial-of-service condition on affected installations of | 1,4% | — |
| CVE-2023-39179 | HIGH 7.5 | linux linux_kernel A flaw was found within the handling of SMB2 read requests in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to | 1,1% | — |