56.959 CVE seguite
777 Sfruttate ora
183 Usate dai ransomware
Ultima sincronia
CVE Tracker
56.959 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordinato dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2019-5620 | CRIT 9.8 | hitachienergy microscada_pro_sys600 ABB MicroSCADA Pro SYS600 version 9.3 suffers from an instance of CWE-306: Missing Authentication for Critical Function. | 70,1% | — |
| CVE-2019-5544 | CRIT 9.8 | ransomware fedoraproject fedora OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8. | 96,8% | |
| CVE-2019-5523 | CRIT 9.8 | vmware vcloud_director VMware vCloud Director for Service Providers 9.5.x prior to 9.5.0.3 update resolves a Remote Session Hijack vulnerability in the Tenant and Provider Portals. Successful exploitation of this issue may allow a malicious actor to access the Tenant or Provider Por | 2,8% | — |
| CVE-2019-5021 | CRIT 9.8 | f5 big-ip_controller Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the `root` user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to the nature of this issue, systems deployed using af | 6,3% | — |
| CVE-2019-4640 | CRIT 9.8 | ibm security_secret_server IBM Security Secret Server 10.7 processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code which could result in an attacker executing malicious code. IBM X-Force ID: 170046. | 0,5% | — |
| CVE-2019-4576 | CRIT 9.8 | ibm qradar_network_packet_capture IBM QRadar Network Packet Capture 7.3.0 - 7.3.3 Patch 1 and 7.4.0 GA does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 166803. | 1,3% | — |
| CVE-2019-3772 | CRIT 9.8 | oracle retail_customer_management_and_segmentation_foundation Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources. | 2,8% | — |
| CVE-2019-20822 | CRIT 9.8 | foxitsoftware 3d An issue was discovered in the 3D Plugin Beta for Foxit Reader and PhantomPDF before 9.7.0.29430. It has an out-of-bounds write via incorrect image data. | 1,1% | — |
| CVE-2019-19781 | CRIT 9.8 | ransomware citrix application_delivery_controller_firmware An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal. | 100,0% | |
| CVE-2019-1976 | CRIT 9.8 | cisco industrial_network_director A vulnerability in the “plug-and-play” services component of Cisco Industrial Network Director (IND) could allow an unauthenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to improper access | 2,0% | — |
| CVE-2019-1974 | CRIT 9.8 | cisco integrated_management_controller_supervisor A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to bypass user authentication and | 4,5% | — |
| CVE-2019-1971 | CRIT 9.8 | cisco enterprise_nfv_infrastructure_software A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to perform a command injection attack and execute arbitrary commands with root privileges. The vulnerability is due to ins | 3,6% | — |
| CVE-2019-19513 | CRIT 9.8 | un4seen bassmidi The BASSMIDI plugin 2.4.12.1 for Un4seen BASS Audio Library on Windows is prone to an out of bounds write vulnerability. An attacker may exploit this to execute code on the target machine. A failure in exploitation leads to a denial of service. | 3,0% | — |
| CVE-2019-1938 | CRIT 9.8 | cisco ucs_director A vulnerability in the web-based management interface of Cisco UCS Director and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrator privileges on an a | 4,6% | — |
| CVE-2019-1937 | CRIT 9.8 | cisco integrated_management_controller_supervisor A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to acquire a valid session token w | 75,9% | — |
| CVE-2019-1935 | CRIT 9.8 | cisco integrated_management_controller_supervisor A vulnerability in Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to log in to the CLI of an affected system by using the SCP User account | 83,4% | — |
| CVE-2019-19230 | CRIT 9.8 | broadcom nolio An unsafe deserialization vulnerability exists in CA Release Automation (Nolio) 6.6 with the DataManagement component that can allow a remote attacker to execute arbitrary code. | 3,8% | — |
| CVE-2019-1913 | CRIT 9.8 | cisco sf-220-24_firmware Multiple vulnerabilities in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an unauthenticated, remote attacker to overflow a buffer, which then allows the execution of arbitrary code with root privileges on the under | 25,9% | — |
| CVE-2019-1895 | CRIT 9.8 | cisco enterprise_nfv_infrastructure_software A vulnerability in the Virtual Network Computing (VNC) console implementation of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to access the VNC console session of an administrative user on an affected dev | 2,3% | — |
| CVE-2019-18814 | CRIT 9.8 | linux linux_kernel An issue was discovered in the Linux kernel through 5.3.9. There is a use-after-free when aa_label_parse() fails in aa_audit_rule_init() in security/apparmor/audit.c. | 2,5% | — |
| CVE-2019-18805 | CRIT 9.8 | broadcom fabric_operating_system An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading | 3,4% | — |
| CVE-2019-18780 | CRIT 9.8 | veritas access An arbitrary command injection vulnerability in the Cluster Server component of Veritas InfoScale allows an unauthenticated remote attacker to execute arbitrary commands as root or administrator. These Veritas products are affected: Access 7.4.2 and earlier, A | 6,1% | — |
| CVE-2019-18225 | CRIT 9.8 | citrix application_delivery_controller_firmware An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway before 10.5 build 70.8, 11.x before 11.1 build 63.9, 12.0 before build 62.10, 12.1 before build 54.16, and 13.0 before build 41.28. An attacker with management-interface access | 1,5% | — |
| CVE-2019-18190 | CRIT 9.8 | trendmicro antivirus\+_security_2020 Trend Micro Security (Consumer) 2020 (v16.x) is affected by a vulnerability in where null pointer dereference errors result in the crash of application, which could potentially lead to possible unsigned code execution under certain circumstances. | 2,7% | — |
| CVE-2019-1804 | CRIT 9.8 | cisco nexus_93108tc-ex_firmware A vulnerability in the SSH key management for the Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software could allow an unauthenticated, remote attacker to connect to the affected system with the privileges of the root user. The | 3,5% | — |