CyberSigur / Security Intelligence
Urmărește catalogul CISA Known Exploited Vulnerabilities. Caută după CVE, furnizor sau produs; informațiile sunt publicate de autoritatea americană CISA.
1.762 vulnerabilități · Pagina 72 din 89
The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution.
Apply updates per vendor instructions.
Microsoft Windows Win32k contains a vulnerability that allows an attacker to escalate privileges.
Apply updates per vendor instructions.
SolarWinds Serv-U versions 15.2.5 and earlier contain an improper input validation vulnerability that allows attackers to build and send queries without sanitization.
Apply updates per vendor instructions.
A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.
Apply updates per vendor instructions.
Improper sanitization in the extension file names is present in Drupal core.
Apply updates per vendor instructions.
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.
Apply updates per vendor instructions.
Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file.
Apply updates per vendor instructions.
In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote.
Apply updates per vendor instructions.
Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.
Apply updates per vendor instructions.
The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls.
Apply updates per vendor instructions.
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
Apply updates per vendor instructions.
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
Apply updates per vendor instructions.
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
Apply updates per vendor instructions.
In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request.
Apply updates per vendor instructions.
Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target.
Apply updates per vendor instructions.
Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.
Apply updates per vendor instructions.
A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files.
Apply updates per vendor instructions.
Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands
Apply updates per vendor instructions.
Primetek Primefaces is vulnerable to a weak encryption flaw resulting in remote code execution
Apply updates per vendor instructions.
An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.
Apply updates per vendor instructions.