Início / CVEs
Vulnerabilidades exploradas (CISA KEV)
CVEs com exploração confirmada pela CISA (Known Exploited Vulnerabilities), com ação exigida e prazos.
CVE-2023-37580
Média · 6.1
KEV Alta · 57 Exploit público CWE-79 31/07/2023
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.
CVE-2023-38606
Média · 5.5
KEV Alta · 51 26/07/2023
Apple Multiple Products Kernel Unspecified Vulnerability
This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to modify sensitive kernel state. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1.
CVE-2023-37450
Alta · 8.8
KEV Alta · 56 26/07/2023
Apple Multiple Products WebKit Code Execution Vulnerability
The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
CVE-2023-35078
Crítica · 9.8
KEV Urgente · 83 Exploit público Ransomware CWE-287 25/07/2023
Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.
CVE-2023-38203
Crítica · 9.8
KEV Urgente · 87 Exploit público Ransomware CWE-502 20/07/2023
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
CVE-2023-3519
Crítica · 9.8
KEV Urgente · 100 Exploit público Ransomware CWE-94 19/07/2023
Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
Unauthenticated remote code execution
CVE-2023-29298
Alta · 7.5
KEV Alta · 63 Exploit público CWE-284 12/07/2023
Adobe ColdFusion Improper Access Control Vulnerability
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.
CVE-2023-29300
Crítica · 9.8
KEV Urgente · 87 Exploit público Ransomware CWE-502 12/07/2023
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
CVE-2023-36884
Alta · 7.5
KEV Urgente · 72 Exploit público Ransomware CWE-362 11/07/2023
Microsoft Windows Search Remote Code Execution Vulnerability
Windows Search Remote Code Execution Vulnerability
CVE-2023-36874
Alta · 7.8
KEV Urgente · 74 Exploit público CWE-59 11/07/2023
Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability
Windows Error Reporting Service Elevation of Privilege Vulnerability
CVE-2023-35311
Alta · 8.8
KEV Alta · 56 CWE-367 11/07/2023
Microsoft Outlook Security Feature Bypass Vulnerability
Microsoft Outlook Security Feature Bypass Vulnerability
CVE-2023-32049
Alta · 8.8
KEV Alta · 55 11/07/2023
Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability
Windows SmartScreen Security Feature Bypass Vulnerability
CVE-2023-32046
Alta · 7.8
KEV Alta · 55 11/07/2023
Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability
Windows MSHTML Platform Elevation of Privilege Vulnerability
CVE-2023-24489
Crítica · 9.8
KEV Urgente · 73 Exploit público CWE-284 10/07/2023
Citrix Content Collaboration ShareFile Improper Access Control Vulnerability
A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller.
CVE-2023-34192
Crítica · 9.0
KEV Alta · 64 Exploit público CWE-79 06/07/2023
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.
CVE-2023-21237
Média · 5.5
KEV CWE-200 28/06/2023
Android Pixel Information Disclosure Vulnerability
In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-251586912
CVE-2023-32409
Alta · 8.6
KEV Alta · 59 23/06/2023
Apple Multiple Products WebKit Sandbox Escape Vulnerability
The issue was addressed with improved bounds checks. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.8 and iPadOS 15.7.8, Safari 16.5, iOS 16.5 and iPadOS 16.5. A remote attacker may be able to break out of Web Content sandbox. Apple is aware of a report that this issue may have been actively exploited.
CVE-2023-32439
Alta · 8.8
KEV Alta · 56 CWE-843 23/06/2023
Apple Multiple Products WebKit Type Confusion Vulnerability
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
CVE-2023-32435
Alta · 8.8
KEV Alta · 56 CWE-787 23/06/2023
Apple Multiple Products WebKit Memory Corruption Vulnerability
A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.7 and iPadOS 15.7.7. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.
CVE-2023-32434
Alta · 7.8
KEV Alta · 62 Exploit público CWE-190 23/06/2023
Apple Multiple Products Integer Overflow Vulnerability
An integer overflow was addressed with improved input validation. This issue is fixed in watchOS 9.5.2, macOS Big Sur 11.7.8, iOS 15.7.7 and iPadOS 15.7.7, macOS Monterey 12.6.7, watchOS 8.8.1, iOS 16.5.1 and iPadOS 16.5.1, macOS Ventura 13.4.1. An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.
CVE-2023-32373
Alta · 8.8
KEV Alta · 55 CWE-416 23/06/2023
Apple Multiple Products WebKit Use-After-Free Vulnerability
A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
CVE-2023-28204
Média · 6.5
KEV Alta · 52 CWE-125 23/06/2023
Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability
An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been actively exploited.
CVE-2023-2533
Alta · 8.8
KEV Alta · 56 CWE-352 20/06/2023
PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in
PaperCut NG/MF, which, under specific conditions, could potentially enable
an attacker to alter security settings or execute arbitrary code. This could
be exploited if the target is an admin with a current login session. Exploiting
this would typically involve the possibility of deceiving an admin into clicking
a specially crafted malicious link, potentially leading to unauthorized changes.
CVE-2023-27992
Crítica · 9.8
KEV Alta · 63 CWE-78 19/06/2023
Zyxel Multiple NAS Devices Command Injection Vulnerability
The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.
CVE-2023-29360
Alta · 8.4
KEV Alta · 62 Exploit público CWE-822 13/06/2023
Microsoft Streaming Service Untrusted Pointer Dereference Vulnerability
Microsoft Streaming Service Elevation of Privilege Vulnerability