CVE Intelligence
Início / CVEs

Vulnerabilidades exploradas (CISA KEV)

CVEs com exploração confirmada pela CISA (Known Exploited Vulnerabilities), com ação exigida e prazos.

Severidade
Limpar

1.762 resultado(s)

Exportar esta busca: RSS · CSV · STIX
CVE-2016-0162 Média · 4.3 KEV Alta · 53 12/04/2016
Microsoft Internet Explorer Information Disclosure Vulnerability
Microsoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaScript code, aka "Internet Explorer Information Disclosure Vulnerability."
CVE-2016-0151 Alta · 7.8 KEV Urgente · 74 Exploit público Ransomware CWE-269 12/04/2016
Microsoft Windows CSRSS Security Feature Bypass Vulnerability
The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security Feature Bypass Vulnerability."
CVE-2016-3976 Alta · 7.5 KEV Alta · 67 Exploit público CWE-22 07/04/2016
SAP NetWeaver Directory Traversal Vulnerability
Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet, aka SAP Security Note 2234971.
CVE-2016-1019 Crítica · 9.8 KEV Urgente · 70 Ransomware 07/04/2016
Adobe Flash Player Arbitrary Code Execution Vulnerability
Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.
CVE-2016-1646 Alta · 8.8 KEV Alta · 56 CWE-125 29/03/2016
Google Chromium V8 Out-of-Bounds Read Vulnerability
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted JavaScript code.
CVE-2016-1010 Alta · 8.8 KEV Alta · 56 CWE-190 12/03/2016
Adobe Flash Player and AIR Integer Overflow Vulnerability
Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0963 and CVE-2016-0993.
CVE-2016-0099 Alta · 7.8 KEV Urgente · 86 Exploit público Ransomware CWE-120 09/03/2016
Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability
The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 does not properly process request handles, which allows local users to gain privileges via a crafted application, aka "Secondary Logon Elevation of Privilege Vulnerability."
CVE-2016-2388 Média · 5.3 KEV Alta · 64 Exploit público CWE-200 16/02/2016
SAP NetWeaver Information Disclosure Vulnerability
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.
CVE-2016-2386 Crítica · 9.8 KEV Urgente · 77 Exploit público CWE-89 16/02/2016
SAP NetWeaver SQL Injection Vulnerability
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.
CVE-2016-0752 Alta · 7.5 KEV Urgente · 79 Exploit público CWE-22 16/02/2016
Travessia de diretório no Action View do Ruby on Rails
Vulnerabilidade de travessia de diretório no Action View do Ruby on Rails anteriores a 3.2.22.1, 4.0.x e 4.1.x anteriores a 4.1.14.1, 4.2.x anteriores a 4.2.5.1 e 5.x anteriores a 5.0.0.beta1.1 permite que atacantes remotos leiam arquivos arbitrários explorando o uso irrestrito do método render pela aplicação e fornecendo .. (ponto ponto) em um caminho.
CVE-2016-0984 Alta · 8.8 KEV Alta · 64 Exploit público CWE-416 10/02/2016
Adobe Flash Player and AIR Use-After-Free Vulnerability
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0982, and CVE-2016-0983.
CVE-2016-0040 Alta · 7.8 KEV Urgente · 76 Exploit público 10/02/2016
Microsoft Windows Kernel Privilege Escalation Vulnerability
The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a crafted application, aka "Windows Elevation of Privilege Vulnerability."
CVE-2016-0034 Alta · 8.8 KEV Alta · 66 Ransomware 13/01/2016
Microsoft Silverlight Runtime Remote Code Execution Vulnerability
Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary code or cause a denial of service (object-header corruption) via a crafted web site, aka "Silverlight Runtime Remote Code Execution Vulnerability."
CVE-2015-7450 Crítica · 9.8 KEV Urgente · 93 Exploit público CWE-502 02/01/2016
IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.
Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.
CVE-2015-8651 Alta · 8.8 KEV Alta · 66 CWE-190 28/12/2015
Adobe Flash Player Integer Overflow Vulnerability
Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors.
CVE-2015-7755 Crítica · 9.8 KEV Urgente · 81 Exploit público CWE-287 19/12/2015
Juniper ScreenOS Improper Authentication Vulnerability
Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and 6.3.0r20 before 6.3.0r21 allows remote attackers to obtain administrative access by entering an unspecified password during a (1) SSH or (2) TELNET session.
CVE-2015-6175 Alta · 7.8 KEV Alta · 55 09/12/2015
Microsoft Windows Kernel Privilege Escalation Vulnerability
The kernel in Microsoft Windows 10 Gold allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Elevation of Privilege Vulnerability."
CVE-2015-5287 Alta · 7.8 KEV Urgente · 75 Exploit público CWE-59 07/12/2015
Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.
CVE-2015-5317 Alta · 7.5 KEV Alta · 59 CWE-200 25/11/2015
Divulgação de Informações nas Páginas Fingerprints do Jenkins
As páginas Fingerprints no Jenkins anteriores à 1.638 e LTS anteriores à 1.625.2 podem permitir que atacantes remotos obtenham informações sensíveis sobre nomes de jobs e builds por meio de uma requisição direta.
CVE-2015-4852 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-502 18/11/2015
Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.
CVE-2015-4902 Média · 5.3 KEV Alta · 65 CWE-284 21/10/2015
Oracle Java SE Integrity Check Vulnerability
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.
CVE-2015-7645 Alta · 7.8 KEV Urgente · 74 Exploit público Ransomware 15/10/2015
Adobe Flash Player Arbitrary Code Execution Vulnerability
Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015.
CVE-2015-2546 Alta · 8.2 KEV Urgente · 71 Exploit público Ransomware CWE-119 08/09/2015
Microsoft Win32k Memory Corruption Vulnerability
The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Win32k Memory Corruption Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2511, CVE-2015-2517, and CVE-2015-2518.
CVE-2015-2545 Alta · 7.8 KEV Alta · 56 08/09/2015
Microsoft Office Malformed EPS File Vulnerability
Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted EPS image, aka "Microsoft Office Malformed EPS File Vulnerability."
CVE-2015-2502 Alta · 8.8 KEV Alta · 56 CWE-787 19/08/2015
Microsoft Internet Explorer Memory Corruption Vulnerability
Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," as exploited in the wild in August 2015.