Vulnerabilidades exploradas (CISA KEV)

CVE-2025-31125 Alta · 7.5 KEV Alta · 66 Exploit público CWE-200 31/03/2025

Exposição de Arquivos Sensíveis no Vite (Vitejs)

O Vite é uma ferramenta de frontend para javascript. O Vite expõe conteúdo de arquivos não permitidos usando ?inline&import ou ?raw?import. Somente apps que expõem explicitamente o servidor de desenvolvimento do Vite na rede (usando --host ou a opção de configuração server.host) são afetados. Esta vulnerabilidade é corrigida nas versões 6.2.4, 6.1.3, 6.0.13, 5.4.16 e 4.5.11.

CVE-2025-2783 Alta · 8.3 KEV Alta · 69 Exploit público 26/03/2025

Google Chromium Mojo Sandbox Escape Vulnerability

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)

CVE-2025-29635 Alta · 7.2 KEV Alta · 60 Exploit público CWE-77 25/03/2025

D-Link DIR-823X Command Injection Vulnerability

A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function, triggering remote command execution.

CVE-2025-2749 Alta · 7.2 KEV Alta · 55 CWE-22 24/03/2025

Kentico Xperience Path Traversal Vulnerability

An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178.

CVE-2025-2747 Crítica · 9.8 KEV Alta · 67 Exploit público CWE-288 24/03/2025

Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.178.

CVE-2025-2746 Crítica · 9.8 KEV Alta · 67 Exploit público CWE-288 24/03/2025

Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172.

CVE-2025-30154 Alta · 8.6 KEV Alta · 57 CWE-506 19/03/2025

Código malicioso embutido na GitHub Action reviewdog/action-setup

reviewdog/action-setup é uma GitHub Action que instala o reviewdog. A versão reviewdog/action-setup@v1 foi comprometida em 11 de março de 2025, entre 18:42 e 20:31 UTC, com código malicioso adicionado que despeja segredos expostos nos logs de workflow do GitHub Actions. Outras actions do reviewdog que usam reviewdog/action-setup@v1 e que também seriam comprometidas, independentemente da versão ou do método de fixação, são: reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep e reviewdog/action-typos.

CVE-2025-30066 Alta · 8.6 KEV Alta · 65 Exploit público CWE-506 15/03/2025

Código malicioso embutido na GitHub Action tj-actions/changed-files

tj-actions changed-files anterior à 46 permite que atacantes remotos descubram segredos lendo logs de actions. (As tags de 1 até v45.0.7 foram afetadas em 2025-03-14 e 2025-03-15 porque foram modificadas por um agente de ameaça para apontar para o commit 0e58ed8, que continha código malicioso updateFeatures.)

CVE-2025-27915 Média · 5.4 KEV Alta · 56 Exploit público CWE-79 12/03/2025

Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.

CVE-2025-21590 Média · 4.4 KEV Alta · 60 CWE-653 12/03/2025

Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability

An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the integrity of the device. A local attacker with access to the shell is able to inject arbitrary code which can compromise an affected device. This issue is not exploitable from the Junos CLI. This issue affects Junos OS: * All versions before 21.2R3-S9, * 21.4 versions before 21.4R3-S10, * 22.2 versions before 22.2R3-S6, * 22.4 versions before 22.4R3-S6, * 23.2 versions before 23.2R2-S3, * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R1-S2, 24.2R2.

CVE-2025-24201 Crítica · 10.0 KEV Alta · 68 Exploit público CWE-787 11/03/2025

Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).

CVE-2025-26633 Alta · 7.0 KEV Urgente · 80 Exploit público Ransomware CWE-707 11/03/2025

Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability

Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.

CVE-2025-24991 Média · 5.5 KEV Alta · 50 CWE-125 11/03/2025

Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability

Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.

CVE-2025-24993 Alta · 7.8 KEV Alta · 53 CWE-122 11/03/2025

Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

CVE-2025-24984 Média · 4.6 KEV Alta · 50 CWE-532 11/03/2025

Microsoft Windows NTFS Information Disclosure Vulnerability

Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.

CVE-2025-24985 Alta · 7.8 KEV Alta · 61 Exploit público CWE-122 11/03/2025

Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability

Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally.

CVE-2025-24983 Alta · 7.0 KEV Alta · 53 CWE-416 11/03/2025

Microsoft Windows Win32k Use-After-Free Vulnerability

Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

CVE-2025-24054 Média · 5.4 KEV Alta · 67 Exploit público CWE-73 11/03/2025

Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

CVE-2025-27363 Alta · 8.1 KEV Alta · 62 Exploit público CWE-787 11/03/2025

FreeType Out-of-Bounds Write Vulnerability

An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.

CVE-2024-54085 Crítica · 9.8 KEV Alta · 69 Exploit público CWE-290 11/03/2025

AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability

AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.

CVE-2025-24813 Crítica · 9.8 KEV Urgente · 80 Exploit público CWE-502 10/03/2025

Falha de Path Equivalence no Apache Tomcat com RCE e Exposição de Arquivos

Equivalência de caminho: 'file.Name' (ponto interno) levando a Execução Remota de Código e/ou divulgação de informações e/ou adição de conteúdo malicioso a arquivos enviados via Default Servlet com escrita habilitada no Apache Tomcat. Este problema afeta o Apache Tomcat: de 11.0.0-M1 até 11.0.2, de 10.1.0-M1 até 10.1.34, de 9.0.0.M1 até 9.0.98. As seguintes versões estavam em fim de vida (EOL) na época em que o CVE foi criado, mas são conhecidas por serem afetadas: de 8.5.0 até 8.5.100. Outras versões mais antigas, também em EOL, podem igualmente ser afetadas. Se todas as condições a seguir fossem verdadeiras, um usuário mal-intencionado conseguia visualizar arquivos sensíveis à segurança e/ou injetar conteúdo nesses arquivos: - escrita habilitada para o default servlet (desabilitada por padrão) - suporte a PUT parcial (habilitado por padrão) - uma URL de destino para uploads sensíveis à segurança que fosse um subdiretório de uma URL de destino para uploads públicos - conhecimento por parte do atacante dos nomes dos arquivos sensíveis enviados - os arquivos sensíveis também sendo enviados via PUT parcial Se todas as condições a seguir fossem verdadeiras, um usuário mal-intencionado conseguia executar código remotamente: - escrita habilitada para o default servlet (desabilitada por padrão) - suporte a PUT parcial (habilitado por padrão) - a aplicação usava a persistência de sessão baseada em arquivo do Tomcat com o local de armazenamento padrão - a aplicação incluía uma biblioteca que pode ser aproveitada em um ataque de desserialização Recomenda-se que os usuários atualizem para a versão 11.0.3, 10.1.35 ou 9.0.99, que corrige o problema.

CVE-2025-1316 Crítica · 9.8 KEV Alta · 63 CWE-78 04/03/2025

Edimax IC-7100 IP Camera OS Command Injection Vulnerability

Edimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the device

CVE-2025-22224 Alta · 8.2 KEV Alta · 52 CWE-367 04/03/2025

VMware ESXi and Workstation TOCTOU Race Condition Vulnerability

VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

CVE-2025-22225 Alta · 8.2 KEV Alta · 60 Ransomware CWE-787 04/03/2025

VMware ESXi Arbitrary Write Vulnerability

VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.

CVE-2025-22226 Média · 6.0 KEV Alta · 49 CWE-125 04/03/2025

VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability

VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process.