Vulnerabilidades exploradas (CISA KEV)

CVE-2023-37580 Média · 6.1 KEV Alta · 57 Exploit público CWE-79 31/07/2023

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.

CVE-2023-38606 Média · 5.5 KEV Alta · 51 26/07/2023

Apple Multiple Products Kernel Unspecified Vulnerability

This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to modify sensitive kernel state. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1.

CVE-2023-37450 Alta · 8.8 KEV Alta · 56 26/07/2023

Apple Multiple Products WebKit Code Execution Vulnerability

The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

CVE-2023-35078 Crítica · 9.8 KEV Urgente · 83 Exploit público Ransomware CWE-287 25/07/2023

Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability

An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.

CVE-2023-38203 Crítica · 9.8 KEV Urgente · 87 Exploit público Ransomware CWE-502 20/07/2023

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.

CVE-2023-3519 Crítica · 9.8 KEV Urgente · 100 Exploit público Ransomware CWE-94 19/07/2023

Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability

Unauthenticated remote code execution

CVE-2023-29298 Alta · 7.5 KEV Alta · 63 Exploit público CWE-284 12/07/2023

Adobe ColdFusion Improper Access Control Vulnerability

Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.

CVE-2023-29300 Crítica · 9.8 KEV Urgente · 87 Exploit público Ransomware CWE-502 12/07/2023

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.

CVE-2023-36884 Alta · 7.5 KEV Urgente · 72 Exploit público Ransomware CWE-362 11/07/2023

Microsoft Windows Search Remote Code Execution Vulnerability

Windows Search Remote Code Execution Vulnerability

CVE-2023-36874 Alta · 7.8 KEV Urgente · 74 Exploit público CWE-59 11/07/2023

Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability

Windows Error Reporting Service Elevation of Privilege Vulnerability

CVE-2023-35311 Alta · 8.8 KEV Alta · 56 CWE-367 11/07/2023

Microsoft Outlook Security Feature Bypass Vulnerability

CVE-2023-32049 Alta · 8.8 KEV Alta · 55 11/07/2023

Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability

Windows SmartScreen Security Feature Bypass Vulnerability

CVE-2023-32046 Alta · 7.8 KEV Alta · 55 11/07/2023

Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability

Windows MSHTML Platform Elevation of Privilege Vulnerability

CVE-2023-24489 Crítica · 9.8 KEV Urgente · 73 Exploit público CWE-284 10/07/2023

Citrix Content Collaboration ShareFile Improper Access Control Vulnerability

A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller.

CVE-2023-34192 Crítica · 9.0 KEV Alta · 64 Exploit público CWE-79 06/07/2023

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.