56.960 CVE seguite
777 Sfruttate ora
183 Usate dai ransomware
Ultima sincronia
CVE Tracker
56.960 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordinato dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2018-15981 | CRIT 9.8 | adobe flash_player Flash Player versions 31.0.0.148 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution. | 10,3% | — |
| CVE-2018-15439 | CRIT 9.8 | cisco sf200-24_firmware A vulnerability in the Cisco Small Business Switches software could allow an unauthenticated, remote attacker to bypass the user authentication mechanism of an affected device. The vulnerability exists because under specific circumstances, the affected softwar | 49,7% | — |
| CVE-2018-15427 | CRIT 9.8 | cisco video_surveillance_manager A vulnerability in Cisco Video Surveillance Manager (VSM) Software running on certain Cisco Connected Safety and Security Unified Computing System (UCS) platforms could allow an unauthenticated, remote attacker to log in to an affected system by using the root | 5,7% | — |
| CVE-2018-15394 | CRIT 9.8 | cisco stealthwatch_enterprise A vulnerability in the Stealthwatch Management Console (SMC) of Cisco Stealthwatch Enterprise could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected system. The vulne | 4,0% | — |
| CVE-2018-15389 | CRIT 9.8 | cisco prime_collaboration A vulnerability in the install function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to access the administrative web interface using a default hard-coded username and password that are used during install. Th | 1,4% | — |
| CVE-2018-15387 | CRIT 9.8 | cisco sd-wan A vulnerability in the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to bypass certificate validation on an affected device. The vulnerability is due to improper certificate validation. An attacker could exploit this vulnerability by su | 1,1% | — |
| CVE-2018-15386 | CRIT 9.8 | cisco digital_network_architecture_center A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and have direct unauthorized access to critical management functions. The vulnerability is due to an insecure default co | 3,4% | — |
| CVE-2018-15381 | CRIT 9.8 | cisco unity_express A Java deserialization vulnerability in Cisco Unity Express (CUE) could allow an unauthenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user. The vulnerability is due to insecure deserialization of user-supplied co | 87,3% | — |
| CVE-2018-15379 | CRIT 9.8 | cisco prime_infrastructure A vulnerability in which the HTTP web server for Cisco Prime Infrastructure (PI) has unrestricted directory permissions could allow an unauthenticated, remote attacker to upload an arbitrary file. This file could allow the attacker to execute commands at the p | 80,5% | — |
| CVE-2018-1457 | CRIT 9.8 | ibm engineering_requirements_management_doors An undisclosed vulnerability in IBM Rational DOORS 9.5.1 through 9.6.1.10 application allows an attacker to gain DOORS administrator privileges. IBM X-Force ID: 140208. | 2,5% | — |
| CVE-2018-14007 | CRIT 9.8 | citrix xenserver Citrix XenServer 7.1 and newer allows Directory Traversal. | 48,8% | — |
| CVE-2018-1352 | CRIT 9.8 | fortinet fortios A format string vulnerability in Fortinet FortiOS 5.6.0 allows attacker to execute unauthorized code or commands via the SSH username variable. | 1,1% | — |
| CVE-2018-1337 | CRIT 9.8 | apache directory_ldap_api In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connecti | 5,0% | — |
| CVE-2018-1312 | CRIT 9.8 | apache http_server In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration | 15,9% | — |
| CVE-2018-1309 | CRIT 9.8 | apache nifi Apache NiFi External XML Entity issue in SplitXML processor. Malicious XML content could cause information disclosure or remote code execution. The fix to disable external general entity parsing and disallow doctype declarations was applied on the Apache NiFi | 4,5% | — |
| CVE-2018-1297 | CRIT 9.8 | apache jmeter When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code. | 9,9% | — |
| CVE-2018-1295 | CRIT 9.8 | apache ignite In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulner | 6,2% | — |
| CVE-2018-1290 | CRIT 9.8 | apache fineract In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, Using a single quotation escape with two continuous SQL parameters can cause a SQL injection. This could be done in Methods like retrieveAuditEntries of AuditsApiResource | 3,2% | — |
| CVE-2018-1287 | CRIT 9.8 | apache jmeter In Apache JMeter 2.X and 3.X, when using Distributed Test only (RMI based), jmeter server binds RMI Registry to wildcard host. This could allow an attacker to get Access to JMeterEngine and send unauthorized code. | 3,4% | — |
| CVE-2018-1285 | CRIT 9.8 | apache log4net Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files. | 17,4% | — |
| CVE-2018-12848 | CRIT 9.8 | adobe acrobat_dc Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution. | 29,4% | — |
| CVE-2018-12828 | CRIT 9.8 | adobe flash_player Adobe Flash Player 30.0.0.134 and earlier have a "use of a component with a known vulnerability" vulnerability. Successful exploitation could lead to privilege escalation. | 6,2% | — |
| CVE-2018-12825 | CRIT 9.8 | adobe flash_player Adobe Flash Player 30.0.0.134 and earlier have a security bypass vulnerability. Successful exploitation could lead to security mitigation bypass. | 6,2% | — |
| CVE-2018-12815 | CRIT 9.8 | adobe acrobat_dc Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user. | 9,8% | — |
| CVE-2018-12812 | CRIT 9.8 | adobe acrobat_dc Adobe Acrobat and Reader 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier versions have a Type Confusion vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user. | 8,0% | — |