Vulnerabilidades exploradas (CISA KEV)

CVE-2022-40799 Alta · 8.8 KEV Alta · 56 CWE-494 29/11/2022

D-Link DNR-322L Download of Code Without Integrity Check Vulnerability

Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS level commands on the device.

CVE-2022-4135 Crítica · 9.6 KEV Alta · 60 CWE-787 24/11/2022

Estouro de Buffer na Heap da GPU do Google Chromium

Estouro de buffer na heap em GPU no Google Chrome anterior à 107.0.5304.121 permitia que um atacante remoto que tivesse comprometido o processo renderer executasse potencialmente uma fuga do sandbox por meio de uma página HTML elaborada. (Gravidade de segurança do Chromium: Alta)

CVE-2022-41223 Média · 6.8 KEV Alta · 62 Ransomware CWE-94 21/11/2022

Mitel MiVoice Connect Code Injection Vulnerability

The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.

CVE-2022-40765 Média · 6.8 KEV Alta · 62 Ransomware CWE-77 21/11/2022

Mitel MiVoice Connect Command Injection Vulnerability

A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to insufficient restriction of URL parameters.

CVE-2022-23748 Alta · 7.8 KEV Alta · 55 CWE-426 17/11/2022

Dante Discovery Process Control Vulnerability

mDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to load the DLL, from which folder and under what conditions. In these scenarios, a malicious attacker could be using the valid and legitimate executable to load malicious files.

CVE-2022-41128 Alta · 8.8 KEV Alta · 59 CWE-787 09/11/2022

Microsoft Windows Scripting Languages Remote Code Execution Vulnerability

Windows Scripting Languages Remote Code Execution Vulnerability

CVE-2022-41125 Alta · 7.8 KEV Alta · 54 CWE-787 09/11/2022

Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability

Windows CNG Key Isolation Service Elevation of Privilege Vulnerability

CVE-2022-41091 Média · 5.4 KEV Alta · 60 Ransomware CWE-863 09/11/2022

Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability

Windows Mark of the Web Security Feature Bypass Vulnerability

CVE-2022-41073 Alta · 7.8 KEV Alta · 64 Ransomware CWE-787 09/11/2022

Microsoft Windows Print Spooler Privilege Escalation Vulnerability

Windows Print Spooler Elevation of Privilege Vulnerability

CVE-2022-41080 Alta · 8.8 KEV Urgente · 72 Exploit público Ransomware 09/11/2022

Microsoft Exchange Server Privilege Escalation Vulnerability

Microsoft Exchange Server Elevation of Privilege Vulnerability

CVE-2022-41049 Média · 5.4 KEV Alta · 51 09/11/2022

Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability

Windows Mark of the Web Security Feature Bypass Vulnerability

CVE-2022-31199 Crítica · 9.8 KEV Urgente · 76 Exploit público Ransomware CWE-502 07/11/2022

Netwrix Auditor Insecure Object Deserialization Vulnerability

Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Auditor server and agents installed on monitored systems. The remote code execution vulnerabilities exist within the underlying protocol used by the component, and potentially allow an unauthenticated remote attacker to execute arbitrary code as the NT AUTHORITY\SYSTEM user on affected systems, including on systems Netwrix Auditor monitors.

CVE-2022-3723 Alta · 8.8 KEV Alta · 55 CWE-843 01/11/2022

Google Chromium V8 Type Confusion Vulnerability

Type confusion in V8 in Google Chrome prior to 107.0.5304.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2022-42827 Alta · 7.8 KEV Alta · 51 CWE-787 01/11/2022

Apple iOS and iPadOS Out-of-Bounds Write Vulnerability

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, iOS 16.1 and iPadOS 16. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..