Vulnerabilidades exploradas (CISA KEV)

CVE-2021-44077 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-306 29/11/2021

Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.

CVE-2021-38003 Alta · 8.8 KEV Alta · 62 Exploit público CWE-755 23/11/2021

Google Chromium V8 Memory Corruption Vulnerability

Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2021-38000 Média · 6.1 KEV Alta · 52 CWE-601 23/11/2021

Google Chromium Intents Improper Input Validation Vulnerability

Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page.

CVE-2021-44026 Crítica · 9.8 KEV Alta · 69 Exploit público CWE-89 19/11/2021

Roundcube Webmail SQL Injection Vulnerability

Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

CVE-2021-41277 Alta · 7.5 KEV Alta · 69 Exploit público CWE-200 17/11/2021

Metabase GeoJSON API Local File Inclusion Vulnerability

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.

CVE-2021-42321 Alta · 8.8 KEV Urgente · 84 Exploit público Ransomware 09/11/2021

Microsoft Exchange Server Remote Code Execution Vulnerability

CVE-2021-42292 Alta · 7.8 KEV Alta · 62 Exploit público 09/11/2021

Microsoft Excel Security Feature Bypass

Microsoft Excel Security Feature Bypass Vulnerability

CVE-2021-42287 Alta · 7.5 KEV Urgente · 72 Exploit público Ransomware 09/11/2021

Microsoft Active Directory Domain Services Privilege Escalation Vulnerability

Active Directory Domain Services Elevation of Privilege Vulnerability

CVE-2021-42278 Alta · 7.5 KEV Urgente · 72 Exploit público Ransomware 09/11/2021

Microsoft Active Directory Domain Services Privilege Escalation Vulnerability

Active Directory Domain Services Elevation of Privilege Vulnerability

CVE-2021-41379 Média · 5.5 KEV Alta · 63 Ransomware CWE-59 09/11/2021

Microsoft Windows Installer Privilege Escalation Vulnerability

Windows Installer Elevation of Privilege Vulnerability

CVE-2021-42237 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-502 05/11/2021

Sitecore XP Remote Command Execution Vulnerability

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.