CVE Intelligence
Início / CVEs

Vulnerabilidades exploradas (CISA KEV)

CVEs com exploração confirmada pela CISA (Known Exploited Vulnerabilities), com ação exigida e prazos.

Severidade
Limpar

1.760 resultado(s)

Exportar esta busca: RSS · CSV · STIX
CVE-2019-1129 Alta · 7.8 KEV Alta · 63 Ransomware CWE-59 15/07/2019
Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1130.
CVE-2019-1068 Alta · 8.8 KEV Alta · 62 Exploit público CWE-20 15/07/2019
Microsoft SQL Server Remote Code Execution Vulnerability
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.
CVE-2019-0880 Alta · 7.8 KEV Alta · 53 15/07/2019
Microsoft Windows Privilege Escalation Vulnerability
A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of Privilege Vulnerability'.
CVE-2018-18325 Alta · 7.5 KEV Urgente · 79 Exploit público CWE-326 03/07/2019
DotNetNuke (DNN) Criptografia Fraca de Parâmetros de Entrada (CWE-326)
DNN (também conhecido como DotNetNuke) 9.2 até 9.2.2 usa um algoritmo de criptografia fraco para proteger parâmetros de entrada. NOTA: esta questão existe por causa de uma correção incompleta do CVE-2018-15811.
CVE-2018-15811 Alta · 7.5 KEV Urgente · 79 Exploit público CWE-326 03/07/2019
DotNetNuke (DNN) Força de Criptografia Inadequada
DNN (também conhecido como DotNetNuke) 9.2 até 9.2.1 usa um algoritmo de criptografia fraco para proteger parâmetros de entrada.
CVE-2019-7256 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-78 02/07/2019
Nice Linear eMerge E3-Series OS Command Injection Vulnerability
Linear eMerge E3-Series devices allow Command Injections.
CVE-2019-5786 Média · 6.5 KEV Urgente · 73 Exploit público CWE-416 27/06/2019
Vulnerabilidade de Use-After-Free no Blink do Google Chrome
Problema de tempo de vida de objeto no Blink no Google Chrome anterior à 72.0.3626.121 permitia que um atacante remoto potencialmente realizasse acesso à memória fora dos limites por meio de uma página HTML elaborada.
CVE-2019-1064 Alta · 7.8 KEV Urgente · 71 Exploit público Ransomware CWE-59 12/06/2019
Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could then install programs; view, change or delete data. To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system. The security update addresses the vulnerability by correcting how Windows AppX Deployment Service handles hard links.
CVE-2019-1069 Alta · 7.8 KEV Urgente · 71 Exploit público Ransomware CWE-59 12/06/2019
Microsoft Task Scheduler Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnerability could gain elevated privileges on a victim system. To exploit the vulnerability, an attacker would require unprivileged code execution on a victim system. The security update addresses the vulnerability by correctly validating file operations.
CVE-2010-5330 Crítica · 9.8 KEV Alta · 63 CWE-77 11/06/2019
Ubiquiti AirOS Command Injection Vulnerability
On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.
CVE-2019-10149 Crítica · 9.8 KEV Urgente · 80 Exploit público CWE-78 05/06/2019
Exim Mail Transfer Agent (MTA) Improper Input Validation
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
CVE-2018-13379 Crítica · 9.8 KEV Urgente · 100 Exploit público Ransomware CWE-22 04/06/2019
Fortinet FortiOS SSL VPN Path Traversal Vulnerability
An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.
CVE-2018-13382 Alta · 7.5 KEV Urgente · 83 Exploit público Ransomware CWE-863 04/06/2019
Fortinet FortiOS and FortiProxy Improper Authorization
An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests
CVE-2019-11580 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware 03/06/2019
Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability
Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits remote code execution on systems running a vulnerable version of Crowd or Crowd Data Center. All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x), from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x), from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x), from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x), and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.
CVE-2019-9874 Crítica · 9.8 KEV Alta · 67 Exploit público CWE-502 31/05/2019
Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
CVE-2019-9875 Alta · 8.8 KEV Alta · 56 CWE-502 31/05/2019
Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.
CVE-2019-9670 Crítica · 9.8 KEV Urgente · 93 Exploit público CWE-611 29/05/2019
Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.
CVE-2018-13383 Média · 6.5 KEV Alta · 63 Ransomware CWE-787 29/05/2019
Fortinet FortiOS and FortiProxy Out-of-bounds Write
A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.
CVE-2018-7841 Crítica · 9.8 KEV Urgente · 75 Exploit público CWE-89 22/05/2019
Schneider Electric U.motion Builder SQL Injection Vulnerability
A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.
CVE-2019-11634 Crítica · 9.8 KEV Urgente · 72 Ransomware CWE-284 22/05/2019
Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability
Citrix Workspace App before 1904 for Windows has Incorrect Access Control.
CVE-2019-0903 Alta · 8.8 KEV Alta · 56 16/05/2019
Microsoft GDI Remote Code Execution Vulnerability
A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'.
CVE-2019-0863 Alta · 7.8 KEV Alta · 63 Exploit público 16/05/2019
Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'.
CVE-2019-0708 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-416 16/05/2019
Microsoft Remote Desktop Services Remote Code Execution Vulnerability
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.
CVE-2018-14839 Crítica · 9.8 KEV Alta · 63 CWE-78 14/05/2019
LG N1A1 NAS Remote Command Execution Vulnerability
LG N1A1 NAS 3718.510 is affected by: Remote Command Execution. The impact is: execute arbitrary code (remote). The attack vector is: HTTP POST with parameters.
CVE-2019-3568 Crítica · 9.8 KEV Alta · 63 CWE-787 14/05/2019
WhatsApp VOIP Stack Buffer Overflow Vulnerability
A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.