Início / CVEs
Base de CVEs
Vulnerabilidades publicadas, com severidade, exploração conhecida e fontes oficiais.
CVE-2025-4645
Média · 6.7
CWE-1287 11/11/2025
An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary...
An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
CVE-2025-59278
Alta · 7.8
CWE-1287 14/10/2025
Windows Authentication Elevation of Privilege Vulnerability
Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally.
CVE-2025-59277
Alta · 7.8
CWE-1287 14/10/2025
Windows Authentication Elevation of Privilege Vulnerability
Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally.
CVE-2025-59259
Média · 6.5
CWE-1287 14/10/2025
Windows Local Session Manager (LSM) Denial of Service Vulnerability
Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network.
CVE-2025-59257
Média · 6.5
CWE-1287 14/10/2025
Windows Local Session Manager (LSM) Denial of Service Vulnerability
Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network.
CVE-2025-58729
Média · 6.5
CWE-1287 14/10/2025
Windows Local Session Manager (LSM) Denial of Service Vulnerability
Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network.
CVE-2025-55701
Alta · 7.8
CWE-1287 14/10/2025
Windows Authentication Elevation of Privilege Vulnerability
Improper validation of specified type of input in Microsoft Windows allows an authorized attacker to elevate privileges locally.
CVE-2025-58084
Média · 6.5
CWE-1287 13/10/2025
Mattermost Desktop App crashes when clicking on malformed external URL
Mattermost Desktop App versions <= 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has configured to crash the user's application by sending the user a malformed URL.
CVE-2025-61672
Média · 5.3
CWE-1287 08/10/2025
Synapse: Invalid device keys degrade federation functionality
Synapse is an open source Matrix homeserver implementation. Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attacker registered on the victim homeserver to degrade federation functionality, unpredictably breaking outbound federation to other homeservers. The issue is patched in Synapse 1.138.3, 1.138.4, 1.139.1, and 1.139.2. Note that even though 1.138.3 and 1.139.1 fix the vulnerability, they inadvertently introduced an unrelated regression. For this reason, the maintainers of Synapse recommend skipping these releases and upgrading straight to 1.138.4 and 1.139.2.
CVE-2024-4879
Crítica · 9.8
KEV Urgente · 81 Exploit público CWE-1287 10/07/2024
ServiceNow Improper Input Validation Vulnerability
ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow applied an update to hosted instances, and ServiceNow released the update to our partners and self-hosted customers. Listed below are the patches and hot fixes that address the vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.