Vulnerabilidades exploradas (CISA KEV)

CVE-2025-48928 Média · 4.0 KEV Alta · 45 CWE-552 28/05/2025

TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability

The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.

CVE-2025-48927 Média · 5.3 KEV Alta · 55 CWE-1188 28/05/2025

TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability

The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.

CVE-2025-34026 Alta · 7.5 KEV Alta · 63 Exploit público CWE-288 21/05/2025

Versa Concerto Improper Authentication Vulnerability

The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.

CVE-2025-4008 Alta · 8.8 KEV Alta · 63 Exploit público CWE-77 21/05/2025

Smartbedded Meteobridge Command Injection Vulnerability

The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C. This web interface exposes an endpoint that is vulnerable to command injection. Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.

CVE-2025-32709 Alta · 7.8 KEV Alta · 59 Exploit público CWE-416 13/05/2025

Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CVE-2025-32706 Alta · 7.8 KEV Alta · 54 CWE-20 13/05/2025

Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability

Improper input validation in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

CVE-2025-30400 Alta · 7.8 KEV Alta · 59 Exploit público CWE-416 13/05/2025

Microsoft Windows DWM Core Library Use-After-Free Vulnerability

Use after free in Windows DWM allows an authorized attacker to elevate privileges locally.

CVE-2025-32701 Alta · 7.8 KEV Alta · 52 CWE-416 13/05/2025

Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability

Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

CVE-2025-30397 Alta · 7.5 KEV Urgente · 70 Exploit público CWE-843 13/05/2025

Microsoft Windows Scripting Engine Type Confusion Vulnerability

Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network.

CVE-2025-4427 Alta · 7.5 KEV Urgente · 79 Exploit público CWE-288 13/05/2025

Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability

An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.

CVE-2025-4428 Alta · 8.8 KEV Urgente · 77 Exploit público CWE-94 13/05/2025

Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.

CVE-2025-32756 Crítica · 9.8 KEV Alta · 69 Exploit público CWE-787 13/05/2025

Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability

A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.7, FortiNDR 7.2.0 through 7.2.4, FortiNDR 7.0.0 through 7.0.6, FortiRecorder 7.2.0 through 7.2.3, FortiRecorder 7.0.0 through 7.0.5, FortiRecorder 6.4.0 through 6.4.5, FortiVoice 7.2.0, FortiVoice 7.0.0 through 7.0.6, FortiVoice 6.4.0 through 6.4.10 allows a remote unauthenticated attacker to execute arbitrary code or commands via sending HTTP requests with specially crafted hash cookie.

CVE-2025-4632 Crítica · 9.8 KEV Urgente · 73 Exploit público CWE-22 13/05/2025

Samsung MagicINFO 9 Server Path Traversal Vulnerability

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority.

CVE-2025-42999 Crítica · 9.1 KEV Alta · 69 Ransomware CWE-502 12/05/2025

SAP NetWeaver Deserialization Vulnerability

SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.

CVE-2025-47729 Média · 4.9 KEV CWE-912 08/05/2025

TeleMessage TM SGNL Hidden Functionality Vulnerability

The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functionality than described in the TeleMessage "End-to-End encryption from the mobile phone through to the corporate archive" documentation, as exploited in the wild in May 2025.

CVE-2025-35939 Média · 5.3 KEV Alta · 52 CWE-472 07/05/2025

Craft CMS: URL de retorno não sanitizada armazenada em arquivos de sessão (CWE-472)

O Craft CMS armazena conteúdo arbitrário fornecido por usuários não autenticados em arquivos de sessão. Esse conteúdo poderia ser acessado e executado, possivelmente usando uma vulnerabilidade independente. O Craft CMS redireciona requisições que exigem autenticação para a página de login e gera um arquivo de sessão no servidor em '/var/lib/php/sessions'. Esses arquivos de sessão são nomeados 'sess_[session_value]', onde '[session_value]' é fornecido ao cliente em um cabeçalho de resposta 'Set-Cookie'. O Craft CMS armazena a URL de retorno solicitada pelo cliente sem sanitizar os parâmetros. Consequentemente, um cliente não autenticado pode introduzir valores arbitrários, como código PHP, em um local de arquivo conhecido no servidor. As versões 5.7.5 e 4.15.3 do Craft CMS foram lançadas para corrigir este problema.

CVE-2025-2776 Crítica · 9.8 KEV Urgente · 73 Exploit público CWE-611 07/05/2025

SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.

CVE-2025-2775 Alta · 7.5 KEV Alta · 69 Exploit público CWE-611 07/05/2025

SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.

CVE-2025-27920 Alta · 8.8 KEV Alta · 56 CWE-24 05/05/2025

Srimax Output Messenger Directory Traversal Vulnerability

Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attackers could access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access.