CVE Intelligence
Início / CVEs

Vulnerabilidades exploradas (CISA KEV)

CVEs com exploração confirmada pela CISA (Known Exploited Vulnerabilities), com ação exigida e prazos.

Severidade
Limpar

97 resultado(s)

Exportar esta busca: RSS · CSV · STIX
CVE-2014-0130 Alta · 7.5 KEV Alta · 62 Exploit público CWE-22 07/05/2014
Vulnerabilidade de Travessia de Diretório no Ruby on Rails em Renderização Implícita
Vulnerabilidade de travessia de diretório em actionpack/lib/abstract_controller/base.rb na implementação de renderização implícita no Ruby on Rails antes da 3.2.18, 4.0.x antes da 4.0.5 e 4.1.x antes da 4.1.1, quando determinadas configurações de globbing de rotas estão habilitadas, permite que atacantes remotos leiam arquivos arbitrários por meio de uma requisição elaborada.
CVE-2014-0196 Média · 5.5 KEV Alta · 67 Exploit público CWE-362 07/05/2014
Linux Kernel Race Condition Vulnerability
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.
CVE-2014-0160 Alta · 7.5 KEV Urgente · 79 Exploit público CWE-125 07/04/2014
OpenSSL Information Disclosure Vulnerability
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
CVE-2014-0502 Alta · 8.8 KEV Alta · 59 CWE-415 21/02/2014
Adobe Flash Player Double Free Vulnerablity
Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2014.
CVE-2014-0497 Crítica · 9.8 KEV Urgente · 80 Exploit público CWE-191 05/02/2014
Adobe Flash Player Integer Underflow Vulnerablity
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2013-1690 Alta · 8.8 KEV Urgente · 76 Exploit público CWE-119 26/06/2013
Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.
CVE-2013-2729 Crítica · 9.8 KEV Urgente · 74 Exploit público CWE-190 16/05/2013
Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-2727.
CVE-2013-1675 Média · 6.5 KEV Alta · 52 CWE-665 16/05/2013
Mozilla Firefox Information Disclosure Vulnerability
Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.
CVE-2013-0643 Alta · 8.8 KEV Alta · 55 CWE-269 26/02/2013
Adobe Flash Player Incorrect Default Permissions Vulnerability
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.
CVE-2013-0648 Alta · 8.8 KEV Alta · 55 26/02/2013
Adobe Flash Player Code Execution Vulnerability
Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.
CVE-2013-0640 Alta · 7.8 KEV Alta · 64 Exploit público CWE-787 13/02/2013
Adobe Reader and Acrobat Memory Corruption Vulnerability
Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document, as exploited in the wild in February 2013.
CVE-2013-0641 Alta · 7.8 KEV Alta · 56 CWE-120 13/02/2013
Adobe Reader Buffer Overflow Vulnerability
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute arbitrary code via a crafted PDF document, as exploited in the wild in February 2013.
CVE-2012-4681 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-284 27/08/2012
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.
CVE-2012-1535 Alta · 7.8 KEV Urgente · 76 Exploit público CWE-20 15/08/2012
Adobe Flash Player Arbitrary Code Execution Vulnerability
Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted SWF content, as exploited in the wild in August 2012 with SWF content in a Word document.
CVE-2012-1723 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-284 16/06/2012
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
CVE-2012-2034 Alta · 7.5 KEV Alta · 55 CWE-119 08/06/2012
Adobe Flash Player Memory Corruption Vulnerability
Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-2037.
CVE-2012-1823 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-77 11/05/2012
PHP-CGI Query String Parameter Vulnerability
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
CVE-2011-3544 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-284 19/10/2011
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.
CVE-2010-3904 Alta · 7.8 KEV Urgente · 76 Exploit público CWE-1284 06/12/2010
Linux Kernel Improper Input Validation Vulnerability
The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.
CVE-2010-1871 Alta · 8.8 KEV Urgente · 76 Exploit público CWE-917 05/08/2010
Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.
CVE-2010-0738 Média · 5.3 KEV Urgente · 83 Exploit público Ransomware CWE-749 28/04/2010
Red Hat JBoss Authentication Bypass Vulnerability
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
CVE-2010-1428 Alta · 7.5 KEV Urgente · 82 Exploit público Ransomware CWE-749 28/04/2010
Red Hat JBoss Information Disclosure Vulnerability
The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to obtain sensitive information via an unspecified request that uses a different method.