57.479 CVE seguite
782 Sfruttate ora
187 Usate dai ransomware
Ultima sincronia
CVE Tracker
57.479 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordinato dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2021-26828 | HIGH 8.8 | scadabr scadabr OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm. | 39,4% | |
| CVE-2021-26644 | HIGH 8.8 | mangboard mangboard_wp SQL-Injection vulnerability caused by the lack of verification of input values for the table name of DB used by the Mangboard bulletin board. A remote attacker can use this vulnerability to execute arbitrary code on the server where the bulletin board is runni | 0,9% | — |
| CVE-2021-26642 | HIGH 8.8 | xpressengine xpressengine When uploading an image file to a bulletin board developed with XpressEngine, a vulnerability in which an arbitrary file can be uploaded due to insufficient verification of the file. A remote attacker can use this vulnerability to execute arbitrary code on the | 1,2% | — |
| CVE-2021-26636 | HIGH 8.8 | maxb maxboard Stored XSS and SQL injection vulnerability in MaxBoard could lead to occur Remote Code Execution, which could lead to information exposure and privilege escalation. | 1,4% | — |
| CVE-2021-26629 | HIGH 8.8 | tobesoft xplatform A path traversal vulnerability in XPLATFORM's runtime archive function could lead to arbitrary file creation. When the .xzip archive file is decompressed, an arbitrary file can be d in the parent path by using the path traversal pattern ‘..\’. | 1,5% | — |
| CVE-2021-26625 | HIGH 8.8 | tobesoft nexacro Insufficient Verification of input Data leading to arbitrary file download and execute was discovered in Nexacro platform. This vulnerability is caused by an automatic update function that does not verify input data except version information. Remote attackers | 0,6% | — |
| CVE-2021-26608 | HIGH 8.8 | handysoft hshell An arbitrary file download and execution vulnerability was found in the HShell.dll of handysoft Co., Ltd groupware ActiveX module. This issue is due to missing support for integrity check of download URL or downloaded file hash. | 0,6% | — |
| CVE-2021-26411 | HIGH 8.8 | ransomware microsoft edge Internet Explorer Memory Corruption Vulnerability | 80,8% | |
| CVE-2021-26097 | HIGH 8.8 | fortinet fortisandbox An improper neutralization of special elements used in an OS Command vulnerability in FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and 3.0.0 through 3.0.6 may allow an authenticated attacker with access to the web GUI to execute unauthorized code or | 1,2% | — |
| CVE-2021-25646 | HIGH 8.8 | apache druid Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possibl | 99,0% | — |
| CVE-2021-25642 | HIGH 8.8 | apache hadoop ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without validation. An attacker having access to ZooKeeper can run arbitrary commands as YARN user by exploiting this. Users shou | 2,2% | — |
| CVE-2021-25265 | HIGH 8.8 | sophos connect A malicious website could execute code remotely in Sophos Connect Client before version 2.1. | 1,8% | — |
| CVE-2021-24093 | HIGH 8.8 | microsoft windows_10 Windows Graphics Component Remote Code Execution Vulnerability | 43,8% | — |
| CVE-2021-24088 | HIGH 8.8 | microsoft windows_10 Windows Local Spooler Remote Code Execution Vulnerability | 2,3% | — |
| CVE-2021-24072 | HIGH 8.8 | microsoft sharepoint_enterprise_server Microsoft SharePoint Server Remote Code Execution Vulnerability | 2,2% | — |
| CVE-2021-24066 | HIGH 8.8 | microsoft sharepoint_enterprise_server Microsoft SharePoint Remote Code Execution Vulnerability | 5,9% | — |
| CVE-2021-24013 | HIGH 8.8 | fortinet fortimail Multiple Path traversal vulnerabilities in the Webmail of FortiMail before 6.4.4 may allow a regular user to obtain unauthorized access to files and data via specifically crafted web requests. | 1,1% | — |
| CVE-2021-23040 | HIGH 8.8 | f5 big-ip_advanced_firewall_manager On BIG-IP AFM version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x, a SQL injection vulnerability exists in an undisclosed page of the BIG-IP Configuration utility. This issue is expos | 1,0% | — |
| CVE-2021-23029 | HIGH 8.8 | f5 big-ip_advanced_web_application_firewall On version 16.0.x before 16.0.1.2, insufficient permission checks may allow authenticated users with guest privileges to perform Server-Side Request Forgery (SSRF) attacks through F5 Advanced Web Application Firewall (WAF) and the BIG-IP ASM Configuration util | 0,9% | — |
| CVE-2021-23026 | HIGH 8.8 | f5 big-ip_access_policy_manager BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x and all versions of BIG-IQ 8.x, 7.x, and 6.x are vulnerable to cross-site request forgery (CSRF) attacks through | 0,5% | — |
| CVE-2021-23025 | HIGH 8.8 | f5 big-ip_access_policy_manager On version 15.1.x before 15.1.0.5, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all versions of 12.1.x and 11.6.x, an authenticated remote command execution vulnerability exists in the BIG-IP Configuration utility. Note: Software versions which have rea | 2,3% | — |
| CVE-2021-23014 | HIGH 8.8 | f5 big-ip_advanced_web_application_firewall On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, and 14.1.x before 14.1.4, BIG-IP Advanced WAF and ASM are missing authorization checks for file uploads to a specific directory within the REST API which might allow Authenticated users with guest privi | 0,8% | — |
| CVE-2021-22993 | HIGH 8.8 | f5 big-ip_advanced_web_application_firewall On BIG-IP Advanced WAF and BIG-IP ASM versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, DOM-based XSS on DoS Profile properties page. Note: Software versions which have reached En | 0,9% | — |
| CVE-2021-22988 | HIGH 8.8 | f5 big-ip_access_policy_manager On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, TMUI, also referred to as the Configuration utility, has an authenticated remote command execut | 10,4% | — |
| CVE-2021-22129 | HIGH 8.8 | fortinet fortimail Multiple instances of incorrect calculation of buffer size in the Webmail and Administrative interface of FortiMail before 6.4.5 may allow an authenticated attacker with regular webmail access to trigger a buffer overflow and to possibly execute unauthorized c | 1,1% | — |