60.443 CVE seguite
812 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
60.443 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2020-3383 | HIGH 8.8 | cisco data_center_network_manager A vulnerability in the archive utility of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. The vulnerability is due to a lack of proper input validation of path | 7,0% | — |
| CVE-2006-6578 | HIGH 7.5 | microsoft internet_information_services Microsoft Internet Information Services (IIS) 5.1 permits the IUSR_Machine account to execute non-EXE files such as .COM files, which allows attackers to execute arbitrary commands via arguments to any .COM file that executes those arguments, as demonstrated u | 7,0% | — |
| CVE-2015-7614 | MED 6.8 | adobe acrobat Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allow attackers to bypass JavaScript API e | 7,0% | — |
| CVE-2007-1257 | HIGH 10.0 | cisco catalyst_6000_ws-svc-nam-1 The Network Analysis Module (NAM) in Cisco Catalyst Series 6000, 6500, and 7600 allows remote attackers to execute arbitrary commands via certain SNMP packets that are spoofed from the NAM's own IP address. | 7,0% | — |
| CVE-2021-30468 | HIGH 7.5 | apache cxf A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior | 7,0% | — |
| CVE-2021-26893 | CRIT 9.8 | microsoft windows_server_2008 Windows DNS Server Remote Code Execution Vulnerability | 7,0% | — |
| CVE-2021-21128 | HIGH 8.8 | google chrome Heap buffer overflow in Blink in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 7,0% | — |
| CVE-2021-38665 | HIGH 7.4 | microsoft remote_desktop_client Remote Desktop Protocol Client Information Disclosure Vulnerability | 7,0% | — |
| CVE-1999-1055 | HIGH 7.5 | microsoft excel Microsoft Excel 97 does not warn the user before executing worksheet functions, which could allow attackers to execute arbitrary commands by using the CALL function to execute a malicious DLL, aka the Excel "CALL Vulnerability." | 7,0% | — |
| CVE-2001-0904 | MED 5.0 | microsoft internet_explorer Internet Explorer 5.5 and 6 with the Q312461 (MS01-055) patch modifies the HTTP_USER_AGENT (UserAgent) information that indicates that the patch has been installed, which could allow remote malicious web sites to more easily identify and exploit vulnerable cli | 7,0% | — |
| CVE-2016-2164 | HIGH 7.5 | apache openmeetings The (1) FileService.importFileByInternalUserId and (2) FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1 improperly use the Java URL class without checking the specified protocol handler, which allows remote attackers to read arbitrar | 7,0% | — |
| CVE-2013-6366 | MED 6.5 | vmware hyperic_hq The Groovy script console in VMware Hyperic HQ 4.6.6 allows remote authenticated administrators to execute arbitrary code via a Runtime.getRuntime().exec call. | 7,0% | — |
| CVE-2017-7018 | HIGH 8.8 | apple icloud An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the | 7,0% | — |
| CVE-2012-2665 | HIGH 7.5 | apache openoffice Multiple heap-based buffer overflows in the XML manifest encryption tag parsing functionality in OpenOffice.org and LibreOffice before 3.5.5 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted Open Document Tex | 7,0% | — |
| CVE-2023-20052 | MED 5.3 | cisco secure_endpoint On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote att | 7,0% | — |
| CVE-2015-0341 | HIGH 10.0 | adobe flash_player Use-after-free vulnerability in Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than | 7,0% | — |
| CVE-2015-0338 | HIGH 10.0 | adobe flash_player Integer overflow in Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code via unspecified vectors. | 7,0% | — |
| CVE-2019-0786 | CRIT 9.8 | microsoft windows_10 An elevation of privilege vulnerability exists in the Microsoft Server Message Block (SMB) Server when an attacker with valid credentials attempts to open a specially crafted file over the SMB protocol on the same machine, aka 'SMB Server Elevation of Privileg | 7,0% | — |
| CVE-2015-1773 | MED 4.3 | apache flex Cross-site scripting (XSS) vulnerability in asdoc/templates/index.html in Apache Flex before 4.14.1 allows remote attackers to inject arbitrary web script or HTML by providing a crafted URI to JavaScript code generated by the asdoc component. | 7,0% | — |
| CVE-2010-2206 | HIGH 9.3 | adobe acrobat Array index error in AcroForm.api in Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted GIF image in a PDF file, which bypasses a size check and triggers a he | 7,0% | — |
| CVE-2019-1384 | CRIT 9.9 | microsoft windows_10 A security feature bypass vulnerability exists where a NETLOGON message is able to obtain the session key and sign messages.To exploit this vulnerability, an attacker could send a specially crafted authentication request, aka 'Microsoft Windows Security Featur | 7,0% | — |
| CVE-2017-3079 | CRIT 9.8 | adobe flash_player Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable memory corruption vulnerability in the internal representation of raster data. Successful exploitation could lead to arbitrary code execution. | 7,0% | — |
| CVE-2019-0961 | MED 6.5 | microsoft windows_10 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0758, CVE-2019-0882. | 7,0% | — |
| CVE-2019-0882 | MED 6.5 | microsoft windows_10 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0758, CVE-2019-0961. | 7,0% | — |
| CVE-2019-0774 | MED 6.5 | microsoft windows_10 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0614. | 7,0% | — |