CVE Intelligence
Início / CVEs

Vulnerabilidades exploradas (CISA KEV)

CVEs com exploração confirmada pela CISA (Known Exploited Vulnerabilities), com ação exigida e prazos.

Severidade
Limpar

1.762 resultado(s)

Exportar esta busca: RSS · CSV · STIX
CVE-2016-6415 Alta · 7.5 KEV Urgente · 79 Exploit público CWE-200 18/09/2016
Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability
The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain sensitive information from device memory via a Security Association (SA) negotiation request, aka Bug IDs CSCvb29204 and CSCvb36055 or BENIGNCERTAIN.
CVE-2016-3351 Média · 6.5 KEV Alta · 63 Ransomware 14/09/2016
Microsoft Internet Explorer and Edge Information Disclosure Vulnerability
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."
CVE-2016-4657 Alta · 8.8 KEV Urgente · 76 Exploit público CWE-787 25/08/2016
Apple iOS Webkit Memory Corruption Vulnerability
WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
CVE-2016-4656 Alta · 7.8 KEV Urgente · 76 Exploit público CWE-787 25/08/2016
Apple iOS Memory Corruption Vulnerability
The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVE-2016-4655 Média · 5.5 KEV Urgente · 73 Exploit público 25/08/2016
Apple iOS Information Disclosure Vulnerability
The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.
CVE-2016-6367 Alta · 7.8 KEV Alta · 64 Exploit público CWE-77 18/08/2016
Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability
Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.
CVE-2016-6366 Alta · 8.8 KEV Urgente · 76 Exploit público CWE-120 18/08/2016
Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability
Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM devices allows remote authenticated users to execute arbitrary code via crafted IPv4 SNMP packets, aka Bug ID CSCva92151 or EXTRABACON.
CVE-2016-3309 Alta · 7.8 KEV Urgente · 80 Exploit público Ransomware 09/08/2016
Microsoft Windows Kernel Privilege Escalation Vulnerability
The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-3308, CVE-2016-3310, and CVE-2016-3311.
CVE-2016-3643 Alta · 7.8 KEV Alta · 62 Exploit público CWE-264 17/06/2016
SolarWinds Virtualization Manager Privilege Escalation Vulnerability
SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguration of sudo, as demonstrated by "sudo cat /etc/passwd."
CVE-2016-4171 Crítica · 9.8 KEV Alta · 60 16/06/2016
Adobe Flash Player Remote Code Execution Vulnerability
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016.
CVE-2016-3235 Alta · 7.8 KEV Urgente · 76 Exploit público 15/06/2016
Microsoft Office OLE DLL Side Loading Vulnerability
Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Microsoft Office OLE DLL Side Loading Vulnerability."
CVE-2016-4523 Alta · 7.5 KEV Alta · 59 CWE-125 09/06/2016
Trihedral VTScada (formerly VTS) Denial-of-Service Vulnerability
The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via unspecified vectors.
CVE-2016-4437 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-321 07/06/2016
Apache Shiro: execução de código e contorno de acesso
Apache Shiro anterior à 1.2.5, quando uma chave de cifragem não foi configurada para o recurso “remember me”, permite que atacantes remotos executem código arbitrário ou contornem restrições de acesso pretendidas por meio de um parâmetro de requisição não especificado.
CVE-2016-3088 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-434 01/06/2016
Vulnerabilidade de Upload Irrestrito de Arquivos no Apache ActiveMQ
O aplicativo web Fileserver no Apache ActiveMQ da série 5 anterior a 5.14.0 permite que atacantes remotos façam upload e executem arquivos arbitrários por meio de uma requisição HTTP PUT seguida de uma requisição HTTP MOVE.
CVE-2010-5326 Crítica · 10.0 KEV Urgente · 73 CWE-306 13/05/2016
SAP NetWeaver Remote Code Execution Vulnerability
The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack.
CVE-2016-4117 Crítica · 9.8 KEV Urgente · 100 Exploit público Ransomware 10/05/2016
Adobe Flash Player Arbitrary Code Execution Vulnerability
Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.
CVE-2016-0189 Alta · 7.5 KEV Urgente · 86 Exploit público Ransomware CWE-787 10/05/2016
Microsoft Internet Explorer Memory Corruption Vulnerability
The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0187.
CVE-2016-0185 Alta · 7.8 KEV Alta · 64 Exploit público 10/05/2016
Microsoft Windows Media Center Remote Code Execution Vulnerability
Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, and Windows 8.1 allows remote attackers to execute arbitrary code via a crafted Media Center link (aka .mcl) file, aka "Windows Media Center Remote Code Execution Vulnerability."
CVE-2016-3718 Média · 5.5 KEV Alta · 61 Exploit público CWE-918 05/05/2016
ImageMagick Server-Side Request Forgery (SSRF) Vulnerability
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
CVE-2016-3715 Média · 5.5 KEV Alta · 61 Exploit público CWE-552 05/05/2016
ImageMagick Arbitrary File Deletion Vulnerability
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
CVE-2016-3714 Alta · 8.4 KEV Urgente · 79 Exploit público CWE-20 05/05/2016
ImageMagick Improper Input Validation Vulnerability
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."
CVE-2016-3081 Alta · 8.1 KEV Urgente · 76 Exploit público CWE-77 26/04/2016
Apache Struts Command Injection Vulnerability
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
CVE-2016-3427 Crítica · 9.8 KEV Alta · 63 CWE-284 21/04/2016
Oracle Java SE and JRockit Unspecified Vulnerability
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
CVE-2016-0167 Alta · 7.8 KEV Urgente · 75 Ransomware 12/04/2016
Microsoft Win32k Privilege Escalation Vulnerability
The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0143 and CVE-2016-0165.
CVE-2016-0165 Alta · 7.8 KEV Alta · 63 Exploit público 12/04/2016
Microsoft Win32k Privilege Escalation Vulnerability
The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0143 and CVE-2016-0167.