60.267 CVE seguite
809 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
Ricerca: http
2790 CVE
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2025-59922 | HIGH 7.2 | fortinet forticlientems An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.4, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2.0 through 7.2.10, FortiClientEMS | 7,8% | — |
| CVE-2017-5651 | CRIT 9.8 | apache tomcat In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processo | 7,8% | — |
| CVE-2016-5004 | MED 6.5 | apache ws-xmlrpc The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service (resource consumption) by decompressing a large file containing zeroes. | 7,7% | — |
| CVE-2015-6401 | HIGH 7.5 | cisco epc3928_docsis_3.0_8x4_wireless_residential_gateway_with_embedded_digital_voice_adapter Cisco EPC3928 devices with EDVA 5.5.10, 5.5.11, and 5.7.1 allow remote attackers to bypass an intended authentication requirement and execute unspecified administrative functions via a crafted HTTP request, aka Bug ID CSCux24941. | 7,6% | — |
| CVE-2013-4685 | HIGH 10.0 | juniper junos Buffer overflow in flowd in Juniper Junos 10.4 before 10.4S14, 11.4 before 11.4R7, 12.1 before 12.1R6, and 12.1X44 before 12.1X44-D15 on SRX devices, when Captive Portal is enabled with the UAC enforcer role, allows remote attackers to execute arbitrary code v | 7,6% | — |
| CVE-2018-8383 | MED 4.3 | microsoft edge A spoofing vulnerability exists when Microsoft Edge does not properly parse HTTP content, aka "Microsoft Edge Spoofing Vulnerability." This affects Microsoft Edge. This CVE ID is unique from CVE-2018-8388. | 7,6% | — |
| CVE-2016-6812 | MED 6.1 | apache cxf The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available service endpoints. The module calculates the base URL usi | 7,5% | — |
| CVE-2012-4534 | LOW 2.6 | apache tomcat org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, when the NIO connector is used in conjunction with sendfile and HTTPS, allows remote attackers to cause a denial of service (infinite loop) by terminating the | 7,5% | — |
| CVE-2016-1429 | HIGH 7.5 | cisco rv180_vpn_router_firmware Directory traversal vulnerability in the web interface on Cisco RV180 and RV180W devices allows remote attackers to read arbitrary files via a crafted HTTP request, aka Bug ID CSCuz43023. | 7,4% | — |
| CVE-2002-0240 | MED 5.0 | apache http_server PHP, when installed with Apache and configured to search for index.php as a default web page, allows remote attackers to obtain the full pathname of the server via the HTTP OPTIONS method, which reveals the pathname in the resulting error message. | 7,4% | — |
| CVE-2011-5062 | MED 5.0 | apache tomcat The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=aut | 7,4% | — |
| CVE-2002-2009 | MED 5.0 | apache tomcat Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, and (4) %20/, which leaks the pathname in an error message. | 7,3% | — |
| CVE-2014-0048 | CRIT 9.8 | apache geode An issue was found in Docker before 1.6.0. Some programs and scripts in Docker are downloaded via HTTP and then executed or used in unsafe ways. | 7,3% | — |
| CVE-2008-5519 | LOW 2.6 | apache mod_jk The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving (1) a request from a different client that includ | 7,3% | — |
| CVE-2024-20450 | CRIT 9.8 | cisco spa_301_firmware Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying oper | 7,2% | — |
| CVE-2023-37924 | CRIT 9.8 | apache submarine Apache Software Foundation Apache Submarine has an SQL injection vulnerability when a user logs in. This issue can result in unauthorized login. Now we have fixed this issue and now user must have the correct login to access workbench. This issue affects Apach | 7,2% | — |
| CVE-2016-6817 | HIGH 7.5 | apache tomcat The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer. This made a denial of service attack possible. | 7,2% | — |
| CVE-2015-5344 | CRIT 9.8 | apache camel The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request. | 7,1% | — |
| CVE-2002-2008 | MED 5.0 | apache tomcat Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message. | 7,1% | — |
| CVE-2020-11985 | MED 5.3 | apache http_server IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HT | 7,0% | — |
| CVE-2001-0904 | MED 5.0 | microsoft internet_explorer Internet Explorer 5.5 and 6 with the Q312461 (MS01-055) patch modifies the HTTP_USER_AGENT (UserAgent) information that indicates that the patch has been installed, which could allow remote malicious web sites to more easily identify and exploit vulnerable cli | 7,0% | — |
| CVE-2014-3306 | HIGH 10.0 | cisco dpc3010 The web server on Cisco DPC3010, DPC3212, DPC3825, DPC3925, DPQ3925, EPC3010, EPC3212, EPC3825, and EPC3925 Wireless Residential Gateway products allows remote attackers to execute arbitrary code via a crafted HTTP request, aka Bug ID CSCup40808. | 7,0% | — |
| CVE-2012-3526 | MED 5.0 | thomas_eibner mod_rpaf The reverse proxy add forward module (mod_rpaf) 0.5 and 0.6 for the Apache HTTP Server allows remote attackers to cause a denial of service (server or application crash) via multiple X-Forwarded-For headers in a request. | 7,0% | — |
| CVE-2014-3629 | MED 4.3 | apache qpid XML external entity (XXE) vulnerability in the XML Exchange module in Apache Qpid 0.30 allows remote attackers to cause outgoing HTTP connections via a crafted message. | 6,9% | — |
| CVE-2025-20363 | CRIT 9.0 | cisco adaptive_security_appliance_software A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, r | 6,9% | — |