58.507 CVE seguite
796 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
58.507 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordinato dal più basso | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2020-26541 | MED 6.5 | linux linux_kernel The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c. | 0,5% | — |
| CVE-2020-26141 | MED 6.5 | alfa awus036h_firmware An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames. An adversary can abuse this to inject and possibly decrypt packets in | 3,1% | — |
| CVE-2020-26140 | MED 6.5 | alfa awus036h_firmware An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext frames in a protected Wi-Fi network. An adversary can abuse this to inject arbitrary data frames independent of the ne | 2,9% | — |
| CVE-2020-26084 | MED 6.5 | cisco edge_fog_fabric A vulnerability in the REST API of Cisco Edge Fog Fabric could allow an authenticated, remote attacker to access files outside of their authorization sphere on an affected device. The vulnerability is due to incorrect authorization enforcement on an affected s | 0,9% | — |
| CVE-2020-26078 | MED 6.5 | cisco iot_field_network_director A vulnerability in the file system of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to overwrite files on an affected system. The vulnerability is due to insufficient file system protections. An attacker could exploit thi | 1,5% | — |
| CVE-2020-26066 | MED 6.5 | cisco catalyst_sd-wan_manager A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External | 0,6% | — |
| CVE-2020-26065 | MED 6.5 | cisco catalyst_sd-wan_manager A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct path traversal attacks and obtain read access to sensitive files on an affected system. The vulnerability is due t | 1,7% | — |
| CVE-2020-24490 | MED 6.5 | bluez bluez Improper buffer restrictions in BlueZ may allow an unauthenticated user to potentially enable denial of service via adjacent access. This affects all Linux kernel versions that support BlueZ. | 2,2% | — |
| CVE-2020-2003 | MED 6.5 | paloaltonetworks pan-os An external control of filename vulnerability in the command processing of PAN-OS allows an authenticated administrator to delete arbitrary system files affecting the integrity of the system or causing denial of service to all PAN-OS services. This issue affec | 0,9% | — |
| CVE-2020-1958 | MED 6.5 | apache druid When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. The | 4,6% | — |
| CVE-2020-1932 | MED 6.5 | apache superset An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1. Authenticated Apache Superset users are able to retrieve other users' information, including hashed passwords, by accessing an unused and undocumented API endpoint | 1,4% | — |
| CVE-2020-17520 | MED 6.5 | apache pulsar_manager In the Pulsar manager 0.1.0 version, malicious users will be able to bypass pulsar-manager's admin, permission verification mechanism by constructing special URLs, thereby accessing any HTTP API. | 1,4% | — |
| CVE-2020-17511 | MED 6.5 | apache airflow In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase. Same happened when creating a Connection with a password field. | 2,6% | — |
| CVE-2020-17133 | MED 6.5 | microsoft dynamics_nav Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability | 3,6% | — |
| CVE-2020-17130 | MED 6.5 | microsoft 365_apps Microsoft Excel Security Feature Bypass Vulnerability | 2,3% | — |
| CVE-2020-17119 | MED 6.5 | microsoft 365_apps Microsoft Outlook Information Disclosure Vulnerability | 4,0% | — |
| CVE-2020-17040 | MED 6.5 | microsoft windows_10 Windows Hyper-V Security Feature Bypass Vulnerability | 2,7% | — |
| CVE-2020-16996 | MED 6.5 | microsoft windows_server_2012 Kerberos Security Feature Bypass Vulnerability | 2,4% | — |
| CVE-2020-16953 | MED 6.5 | microsoft sharepoint_enterprise_server <p>An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system.</p> <p>To | 3,8% | — |
| CVE-2020-16948 | MED 6.5 | microsoft sharepoint_enterprise_server <p>An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system.</p> <p>To | 3,8% | — |
| CVE-2020-16943 | MED 6.5 | microsoft dynamics_365 <p>An elevation of privilege vulnerability exists in Microsoft Dynamics 365 Commerce. An unauthenticated attacker who successfully exploited this vulnerability could update data without proper authorization.</p> <p>To exploit the vulnerability, an attacker wou | 1,1% | — |
| CVE-2020-1689 | MED 6.5 | juniper junos On Juniper Networks EX4300-MP Series, EX4600 Series and QFX5K Series deployed in a Virtual Chassis configuration, receipt of a stream of specific layer 2 frames can cause high CPU load, which could lead to traffic interruption. This issue does not occur when t | 0,5% | — |
| CVE-2020-1688 | MED 6.5 | juniper junos On Juniper Networks SRX Series and NFX Series, a local authenticated user with access to the shell may obtain the Web API service private key that is used to provide encrypted communication between the Juniper device and the authenticator services. Exploitatio | 0,3% | — |
| CVE-2020-1687 | MED 6.5 | juniper junos On Juniper Networks EX4300-MP Series, EX4600 Series and QFX5K Series deployed in (Ethernet VPN) EVPN-(Virtual Extensible LAN) VXLAN configuration, receipt of a stream of specific VXLAN encapsulated layer 2 frames can cause high CPU load, which could lead to ne | 0,5% | — |
| CVE-2020-1681 | MED 6.5 | juniper junos_os_evolved Receipt of a specifically malformed NDP packet sent from the local area network (LAN) to a device running Juniper Networks Junos OS Evolved can cause the ndp process to crash, resulting in a Denial of Service (DoS). The process automatically restarts without i | 0,5% | — |