CyberSigur / Security Intelligence
Urmărește catalogul CISA Known Exploited Vulnerabilities. Caută după CVE, furnizor sau produs; informațiile sunt publicate de autoritatea americană CISA.
1.758 vulnerabilități · Pagina 38 din 88
Cisco IOS and IOS XE contain an out-of-bounds write vulnerability in the Group Encrypted Transport VPN (GET VPN) feature that could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute malicious code or cause a device to crash.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Adobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in the context of the current user.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Microsoft WordPad contains an unspecified vulnerability that allows for information disclosure.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Microsoft Skype for Business contains an unspecified vulnerability that allows for privilege escalation.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS).
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA.
Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Apple iOS and iPadOS contain an unspecified vulnerability that allows for local privilege escalation.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain specific limited SYSTEM privileges.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that allows a local, non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Google Chromium libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using libvpx, including but not limited to Google Chrome.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Apple iOS, iPadOS, macOS, and watchOS contain an improper certificate validation vulnerability that can allow a malicious app to bypass signature validation.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Apple iOS, iPadOS, macOS, and watchOS contain an unspecified vulnerability that allows for local privilege escalation.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Trend Micro Apex One and Worry-Free Business Security contain an unspecified vulnerability in the third-party anti-virus uninstaller that could allow an attacker to manipulate the module to conduct remote code execution. An attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
MinIO contains a security feature bypass vulnerability that allows an attacker to use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket` to conduct privilege escalation. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Realtek SDK contains an improper input validation vulnerability in the miniigd SOAP service that allows remote attackers to execute malicious code via a crafted NewInternalClient request.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Zyxel EMG2926 routers contain a command injection vulnerability located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute malicious commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.