56.855 CVE seguite
777 Sfruttate ora
183 Usate dai ransomware
Ultima sincronia
CVE Tracker
56.855 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordinato dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2021-0276 | CRIT 9.8 | juniper steel-belted_radius_carrier A stack-based Buffer Overflow vulnerability in Juniper Networks SBR Carrier with EAP (Extensible Authentication Protocol) authentication configured, allows an attacker sending specific packets causing the radius daemon to crash resulting with a Denial of Servi | 2,3% | — |
| CVE-2021-0254 | CRIT 9.8 | juniper junos A buffer size validation vulnerability in the overlayd service of Juniper Networks Junos OS may allow an unauthenticated remote attacker to send specially crafted packets to the device, triggering a partial Denial of Service (DoS) condition, or leading to remo | 2,6% | — |
| CVE-2020-9682 | CRIT 9.8 | adobe creative_cloud_desktop_application Adobe Creative Cloud Desktop Application versions 5.1 and earlier have a symlink vulnerability vulnerability. Successful exploitation could lead to arbitrary file system write. | 4,3% | — |
| CVE-2020-9671 | CRIT 9.8 | adobe creative_cloud_desktop_application Adobe Creative Cloud Desktop Application versions 5.1 and earlier have an insecure file permissions vulnerability. Successful exploitation could lead to privilege escalation. | 4,0% | — |
| CVE-2020-9670 | CRIT 9.8 | adobe creative_cloud_desktop_application Adobe Creative Cloud Desktop Application versions 5.1 and earlier have a symlink vulnerability vulnerability. Successful exploitation could lead to privilege escalation. | 3,6% | — |
| CVE-2020-9669 | CRIT 9.8 | adobe creative_cloud Adobe Creative Cloud Desktop Application versions 5.1 and earlier have a lack of exploit mitigations vulnerability. Successful exploitation could lead to privilege escalation. | 3,4% | — |
| CVE-2020-9633 | CRIT 9.8 | adobe flash_player Adobe Flash Player Desktop Runtime 32.0.0.371 and earlier, Adobe Flash Player for Google Chrome 32.0.0.371 and earlier, and Adobe Flash Player for Microsoft Edge and Internet Explorer 32.0.0.330 and earlier have an use after free vulnerability. Successful expl | 7,6% | — |
| CVE-2020-9493 | CRIT 9.8 | apache chainsaw A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution. | 4,6% | — |
| CVE-2020-9480 | CRIT 9.8 | apache spark In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application' | 29,4% | — |
| CVE-2020-9294 | CRIT 9.8 | fortinet fortimail An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a remote unauthenticated attacker to access the system as a legitimate user by requesting a password change via the user i | 77,8% | — |
| CVE-2020-9292 | CRIT 9.8 | fortinet fortisiem_windows_agent An unquoted service path vulnerability in the FortiSIEM Windows Agent component may allow an attacker to gain elevated privileges via the AoWinAgt executable service path. | 1,5% | — |
| CVE-2020-8271 | CRIT 9.8 | citrix sd-wan Unauthenticated remote code execution with root privileges in Citrix SD-WAN Center versions before 11.2.2, 11.1.2b and 10.2.8 | 11,1% | — |
| CVE-2020-8257 | CRIT 9.8 | citrix gateway_plug-in Improper privilege management on services run by Citrix Gateway Plug-in for Windows, versions before and including 13.0-61.48 and 12.1-58.15, lead to privilege escalation attacks | 1,6% | — |
| CVE-2020-8212 | CRIT 9.8 | citrix xenmobile_server Improper access control in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix XenMobile Server before 10.9 RP5 allows access to privileged functionality. | 1,6% | — |
| CVE-2020-8211 | CRIT 9.8 | citrix xenmobile_server Improper input validation in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix XenMobile Server before 10.9 RP5 allows SQL Injection. | 1,5% | — |
| CVE-2020-7883 | CRIT 9.8 | wowsoft printchaser Printchaser v2.2021.804.1 and earlier versions contain a vulnerability, which could allow remote attacker to download and execute remote file by setting the argument, variable in the activeX module. This can be leveraged for code execution. | 0,9% | — |
| CVE-2020-7878 | CRIT 9.8 | 4nb videooffice An arbitrary file download and execution vulnerability was found in the VideoOffice X2.9 and earlier versions (CVE-2020-7878). This issue is due to missing support for integrity check. | 0,7% | — |
| CVE-2020-7485 | CRIT 9.8 | schneider-electric tristation_1131 **VERSION NOT SUPPORTED WHEN ASSIGNED** A legacy support account in the TriStation software version v4.9.0 and earlier could cause improper access to the TriStation host machine. This was addressed in TriStation version v4.9.1 and v4.10.1 released on May 30, 2 | 1,8% | — |
| CVE-2020-6649 | CRIT 9.8 | fortinet fortiisolator An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID (via other, | 1,5% | — |
| CVE-2020-5902 | CRIT 9.8 | ransomware f5 big-ip_access_policy_manager In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclo | 100,0% | |
| CVE-2020-5868 | CRIT 9.8 | f5 big-iq_centralized_management In BIG-IQ 6.0.0-7.0.0, a remote access vulnerability has been discovered that may allow a remote user to execute shell commands on affected systems using HTTP requests to the BIG-IQ user interface. | 2,2% | — |
| CVE-2020-5499 | CRIT 9.8 | apache rust_sgx_sdk Baidu Rust SGX SDK through 1.0.8 has an enclave ID race. There are non-deterministic results in which, sometimes, two global IDs are the same. | 3,2% | — |
| CVE-2020-5426 | CRIT 9.8 | vmware pivotal_scheduler Scheduler for TAS prior to version 1.4.0 was permitting plaintext transmission of UAA client token by sending it over a non-TLS connection. This also depended on the configuration of the MySQL server which is used to cache a UAA client token used by the servic | 0,7% | — |
| CVE-2020-5413 | CRIT 9.8 | oracle banking_corporate_lending_process_management Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the "deserialization gadgets" exploit wh | 4,4% | — |
| CVE-2020-4879 | CRIT 9.8 | ibm cognos_controller IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could allow a remote attacker to bypass security restrictions, caused by improper validation of authentication cookies. IBM X-Force ID: 190847. | 1,5% | — |