56.864 CVE seguite
777 Sfruttate ora
183 Usate dai ransomware
Ultima sincronia
CVE Tracker
56.864 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordinato dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2020-1961 | CRIT 9.8 | apache syncope Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling attackers to inject arbitrary JEXL expressions, leading to Remote Code Execution (RCE) was discovered. | 4,6% | — |
| CVE-2020-1959 | CRIT 9.8 | apache syncope A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an unauthenticated Remote Code Execution (RCE) vulnerability. Apache Syncope uses Java Bean Validation (JSR | 4,8% | — |
| CVE-2020-1957 | CRIT 9.8 | apache shiro Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass. | 23,3% | — |
| CVE-2020-1955 | CRIT 9.8 | apache couchdb CouchDB version 3.0.0 shipped with a new configuration setting that governs access control to the entire database server called `require_valid_user_except_for_up`. It was meant as an extension to the long standing setting `require_valid_user`, which in turn re | 1,8% | — |
| CVE-2020-1952 | CRIT 9.8 | apache iotdb An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients could execute code remotely. | 2,7% | — |
| CVE-2020-19510 | CRIT 9.8 | textpattern textpattern Textpattern 4.7.3 contains an aribtrary file load via the file_insert function in include/txp_file.php. | 1,5% | — |
| CVE-2020-1948 | CRIT 9.8 | apache dubbo This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will ex | 15,8% | — |
| CVE-2020-1947 | CRIT 9.8 | apache shardingsphere In Apache ShardingSphere(incubator) 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputs to load datasource configuration. SnakeYAML allows to unmarshal data to a Java type By using the YAML tag. Unmarshallin | 33,9% | — |
| CVE-2020-1946 | CRIT 9.8 | apache spamassassin In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, use | 6,1% | — |
| CVE-2020-1944 | CRIT 9.8 | apache traffic_server There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and Transfer-Encoding and Content length headers. Upgrade to versions 7.1.9 and 8.0.6 or later versions. | 2,7% | — |
| CVE-2020-1939 | CRIT 9.8 | apache nuttx The Apache NuttX (Incubating) project provides an optional separate "apps" repository which contains various optional components and example programs. One of these, ftpd, had a NULL pointer dereference bug. The NuttX RTOS itself is not affected. Users of the o | 2,5% | — |
| CVE-2020-1938 | CRIT 9.8 | apache geode When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attac | 99,3% | |
| CVE-2020-17531 | CRIT 9.8 | apache tapestry A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the page's validate method, leading to deserialization without authentication. Apache Tapestry 4 reached en | 9,7% | — |
| CVE-2020-17530 | CRIT 9.8 | apache struts Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25. | 95,9% | |
| CVE-2020-17529 | CRIT 9.8 | apache nuttx Out-of-bounds Write vulnerability in TCP Stack of Apache NuttX (incubating) versions up to and including 9.1.0 and 10.0.0 allows attacker to corrupt memory by supplying and invalid fragmentation offset value specified in the IP header. This is only impacts bui | 2,9% | — |
| CVE-2020-17523 | CRIT 9.8 | apache shiro Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass. | 85,9% | — |
| CVE-2020-17510 | CRIT 9.8 | apache shiro Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass. | 9,2% | — |
| CVE-2020-17051 | CRIT 9.8 | microsoft windows_server_2008 Windows Network File System Remote Code Execution Vulnerability | 10,6% | — |
| CVE-2020-1654 | CRIT 9.8 | juniper junos On Juniper Networks SRX Series with ICAP (Internet Content Adaptation Protocol) redirect service enabled, processing a malformed HTTP message can lead to a Denial of Service (DoS) or Remote Code Execution (RCE) Continued processing of this malformed HTTP messa | 2,2% | — |
| CVE-2020-1647 | CRIT 9.8 | juniper junos On Juniper Networks SRX Series with ICAP (Internet Content Adaptation Protocol) redirect service enabled, a double free vulnerability can lead to a Denial of Service (DoS) or Remote Code Execution (RCE) due to processing of a specific HTTP message. Continued p | 2,6% | — |
| CVE-2020-1615 | CRIT 9.8 | juniper junos The factory configuration for vMX installations, as shipped, includes default credentials for the root account. Without proper modification of these default credentials by the administrator, an attacker could exploit these credentials and access the vMX instan | 1,8% | — |
| CVE-2020-16137 | CRIT 9.8 | cisco unified_ip_conference_station_7937g_firmware A privilege escalation issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to reset the credentials for the SSH administrative console to arbitrary values. Note: We cannot prove this vulnerability exists. Out of an abund | 19,4% | — |
| CVE-2020-15801 | CRIT 9.8 | netapp max_data In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The <executable-name>._pth file (e.g., the python._pth file) is not affected. | 3,5% | — |
| CVE-2020-13957 | CRIT 9.8 | apache solr Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The | 79,3% | — |
| CVE-2020-13942 | CRIT 9.8 | apache unomi It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly | 68,4% | — |