60.282 CVE seguite
809 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
Ricerca: http
2791 CVE
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2017-12230 | HIGH 8.8 | cisco ios_xe A vulnerability in the web-based user interface (web UI) of Cisco IOS XE 16.2 could allow an authenticated, remote attacker to elevate their privileges on an affected device. The vulnerability is due to incorrect default permission settings for new users who a | 3,2% | — |
| CVE-2023-45802 | MED 5.9 | apache http_server When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping th | 3,2% | — |
| CVE-2022-36364 | HIGH 8.8 | apache apache_calcite_avatica Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via `httpclient_impl` connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead | 3,2% | — |
| CVE-2024-38477 | HIGH 7.5 | apache http_server null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request. Users are recommended to upgrade to version 2.4.60, which fixes this issue. | 3,2% | — |
| CVE-2024-26219 | HIGH 7.5 | microsoft windows_10_1809 HTTP.sys Denial of Service Vulnerability | 3,1% | — |
| CVE-2017-3858 | HIGH 8.8 | cisco ios_xe A vulnerability in the web framework of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation of HTTP parameters suppli | 3,1% | — |
| CVE-2004-0551 | MED 5.0 | cisco catalyst_2901 Cisco CatOS 5.x before 5.5(20) through 8.x before 8.2(2) and 8.3(2)GLX, as used in Catalyst switches, allows remote attackers to cause a denial of service (system crash and reload) by sending invalid packets instead of the final ACK portion of the three-way ha | 3,1% | — |
| CVE-2021-1459 | CRIT 9.8 | cisco rv110w_firmware A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. The vulnerability is due to improper valida | 3,1% | — |
| CVE-2014-3333 | HIGH 9.0 | cisco unity_connection The server in Cisco Unity Connection 9.1(1) and 9.1(2) allows remote authenticated users to obtain privileged access by conducting an "HTTP Intercept" attack and leveraging the ability to read files within the context of the web-server user account, aka Bug ID | 3,1% | — |
| CVE-2026-25667 | HIGH 7.5 | microsoft .net ASP.NET Core Kestrel in Microsoft .NET 8.0 before 8.0.22 and .NET 9.0 before 9.0.11 allows a remote attacker to cause excessive CPU consumption by sending a crafted QUIC packet, because of an incorrect exit condition for HTTP/3 Encoder/Decoder stream processin | 3,1% | — |
| CVE-2019-1716 | HIGH 7.5 | cisco ip_conference_phone_7800_firmware A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 7800 Series and Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or ex | 3,1% | — |
| CVE-2021-1318 | HIGH 7.2 | cisco rv016_multi-wan_vpn_router_firmware Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. Thes | 3,1% | — |
| CVE-2021-1317 | HIGH 7.2 | cisco rv016_multi-wan_vpn_router_firmware Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. Thes | 3,1% | — |
| CVE-2021-1316 | HIGH 7.2 | cisco rv016_multi-wan_vpn_router_firmware Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. Thes | 3,1% | — |
| CVE-2021-1315 | HIGH 7.2 | cisco rv016_multi-wan_vpn_router_firmware Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. Thes | 3,1% | — |
| CVE-2021-1314 | HIGH 7.2 | cisco rv016_multi-wan_vpn_router_firmware Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. Thes | 3,1% | — |
| CVE-2005-3058 | HIGH 7.5 | fortinet fortigate Interpretation conflict in Fortinet FortiGate 2.8, running FortiOS 2.8MR10 and v3beta, allows remote attackers to bypass the URL blocker via an (1) HTTP request terminated with a line feed (LF) and not carriage return line feed (CRLF) or (2) HTTP request with | 3,1% | — |
| CVE-2018-0469 | MED 6.8 | cisco ios_xe A vulnerability in the web user interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a double-free-in-memory handling by the affected software when specific HTTP r | 3,1% | — |
| CVE-2017-12250 | MED 5.3 | cisco wide_area_application_services A vulnerability in the HTTP web interface for Cisco Wide Area Application Services (WAAS) could allow an unauthenticated, remote attacker to cause an HTTP Application Optimization (AO) related process to restart, causing a partial denial of service (DoS) condi | 3,1% | — |
| CVE-2003-1581 | LOW 2.6 | apache http_server The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files via an HTTP request in conjunction with a crafted DNS response, as demonstrated by injecting XSS sequences, r | 3,1% | — |
| CVE-2018-8023 | MED 5.9 | apache mesos Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT). In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT impl | 3,1% | — |
| CVE-2022-44621 | CRIT 9.8 | apache kylin Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request. | 3,1% | — |
| CVE-2017-17671 | CRIT 9.8 | vbulletin vbulletin vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call is reachable with an unauthenticated request that can include directory traversal sequences to specify an arbitrary pathname, and because ../ traversal is blocked b | 3,0% | — |
| CVE-2016-1469 | HIGH 7.5 | cisco spa300_firmware The HTTP framework on Cisco SPA300, SPA500, and SPA51x devices allows remote attackers to cause a denial of service (device outage) via a series of malformed HTTP requests, aka Bug ID CSCut67385. | 3,0% | — |
| CVE-2020-3490 | MED 4.9 | cisco vision_dynamic_signage_director A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an authenticated, remote attacker with administrative privileges to conduct directory traversal attacks and obtain read access to sensitive files on an a | 3,0% | — |