57.139 CVE seguite
777 Sfruttate ora
184 Usate dai ransomware
Ultima sincronia
CVE Tracker
57.139 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordinato dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2021-3033 | CRIT 9.1 | paloaltonetworks prisma_cloud An improper verification of cryptographic signature vulnerability exists in the Palo Alto Networks Prisma Cloud Compute console. This vulnerability enables an attacker to bypass signature validation during SAML authentication by logging in to the Prisma Cloud | 1,2% | — |
| CVE-2021-29943 | CRIT 9.1 | apache solr When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization reso | 5,4% | — |
| CVE-2021-27078 | CRIT 9.1 | microsoft exchange_server Microsoft Exchange Server Remote Code Execution Vulnerability | 20,0% | — |
| CVE-2021-26855 | CRIT 9.1 | ransomware microsoft exchange_server Microsoft Exchange Server Remote Code Execution Vulnerability | 100,0% | |
| CVE-2021-26412 | CRIT 9.1 | microsoft exchange_server Microsoft Exchange Server Remote Code Execution Vulnerability | 33,0% | — |
| CVE-2021-26291 | CRIT 9.1 | apache maven Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a positi | 8,7% | — |
| CVE-2021-23926 | CRIT 9.1 | apache xmlbeans The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0. | 6,2% | — |
| CVE-2021-23901 | CRIT 9.1 | apache nutch An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere wit | 4,4% | — |
| CVE-2021-23005 | CRIT 9.1 | f5 big-iq_centralized_management On all 7.x and 6.x versions (fixed in 8.0.0), when using a Quorum device for BIG-IQ high availability (HA) for automatic failover, BIG-IQ does not make use of Transport Layer Security (TLS) with the Corosync protocol. Note: Software versions which have reached | 1,0% | — |
| CVE-2021-22989 | CRIT 9.1 | f5 big-ip_access_policy_manager On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, when running in Appliance mode with Advanced WAF or BIG-IP ASM provisioned, the TMUI, also refe | 8,8% | — |
| CVE-2021-21982 | CRIT 9.1 | vmware carbon_black_cloud_workload VMware Carbon Black Cloud Workload appliance 1.0.0 and 1.01 has an authentication bypass vulnerability that may allow a malicious actor with network access to the administrative interface of the VMware Carbon Black Cloud Workload appliance to obtain a valid au | 1,4% | — |
| CVE-2021-20399 | CRIT 9.1 | ibm qradar_security_information_and_event_manager IBM Qradar SIEM 7.3.0 to 7.3.3 Patch 8 and 7.4.0 to 7.4.3 GA is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources | 1,8% | — |
| CVE-2021-1577 | CRIT 9.1 | cisco application_policy_infrastructure_controller A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an unauthenticated, remote attacker to read or write arbitrary files on an aff | 1,3% | — |
| CVE-2021-1225 | CRIT 9.1 | cisco sd-wan_vmanage Multiple vulnerabilities in the web-based management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to conduct SQL injection attacks on an affected system. These vulnerabilities exist because the web-based management | 1,4% | — |
| CVE-2020-5887 | CRIT 9.1 | f5 big-ip_access_policy_manager On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, BIG-IP Virtual Edition (VE) may expose a mechanism for remote attackers to access local daemons and bypass port lockdown settings. | 1,8% | — |
| CVE-2020-5886 | CRIT 9.1 | f5 big-ip_access_policy_manager On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems setup for connection mirroring in a High Availability (HA) pair transfers sensitive cryptographic objects over an insecure communications channel. This is a cont | 0,8% | — |
| CVE-2020-5885 | CRIT 9.1 | f5 big-ip_access_policy_manager On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems set up for connection mirroring in a high availability (HA) pair transfer sensitive cryptographic objects over an insecure communications channel. This is a cont | 0,8% | — |
| CVE-2020-5884 | CRIT 9.1 | f5 big-ip_access_policy_manager On versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.4, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the default deployment mode for BIG-IP high availability (HA) pair mirroring is insecure. This is a control plane issue that is exposed only on the network use | 1,5% | — |
| CVE-2020-5869 | CRIT 9.1 | f5 big-iq_centralized_management In BIG-IQ 5.2.0-7.0.0, high availability (HA) synchronization is not secure by TLS and may allow on-path attackers to read / modify confidential data in transit. | 0,5% | — |
| CVE-2020-4926 | CRIT 9.1 | ibm elastic_storage_system A vulnerability in the Spectrum Scale 5.1 core component and IBM Elastic Storage System 6.1 could allow unauthorized access to user data or injection of arbitrary data in the communication protocol. IBM X-Force ID: 191600. | 0,7% | — |
| CVE-2020-4006 | CRIT 9.1 | vmware cloud_foundation VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability. | 17,3% | |
| CVE-2020-3187 | CRIT 9.1 | cisco adaptive_security_appliance_software A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delet | 96,6% | — |
| CVE-2020-3158 | CRIT 9.1 | cisco smart_software_manager_on-prem A vulnerability in the High Availability (HA) service of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to access a sensitive part of the system with a high-privileged account. The vulnerability is due to a system account | 2,6% | — |
| CVE-2020-27130 | CRIT 9.1 | cisco security_manager A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of directory traversal character sequences within requests to an affected device. | 65,9% | — |
| CVE-2020-20907 | CRIT 9.1 | metinfo metinfo MetInfo 7.0 beta is affected by a file modification vulnerability. Attackers can delete and modify ini files in app/system/language/admin/language_general.class.php and app/system/include/function/file.func.php. | 2,2% | — |