Início / CVEs

Vulnerabilidades exploradas (CISA KEV)

CVEs com exploração confirmada pela CISA (Known Exploited Vulnerabilities), com ação exigida e prazos.

5 resultado(s)

Exportar esta busca: RSS · CSV · STIX

CVE-2025-1976 Média · 6.7 KEV Alta · 46 CWE-78 24/04/2025

Broadcom Brocade Fabric OS Code Injection Vulnerability

Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute arbitrary code with full root privileges on Fabric OS versions 9.1.0 through 9.1.1d6.

CVE-2021-40438 Crítica · 9.0 KEV Urgente · 83 Exploit público Ransomware CWE-918 16/09/2021

Apache HTTP Server-Side Request Forgery (SSRF)

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

CVE-2021-22555 Alta · 7.8 KEV Urgente · 76 Exploit público CWE-787 07/07/2021

Linux Kernel Heap Out-of-Bounds Write Vulnerability

A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space

CVE-2018-1273 Crítica · 9.8 KEV Urgente · 83 Exploit público Ransomware CWE-94 11/04/2018

VMware Tanzu Spring Data Commons Property Binder Vulnerability

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.

CVE-2014-0160 Alta · 7.5 KEV Urgente · 79 Exploit público CWE-125 07/04/2014

OpenSSL Information Disclosure Vulnerability

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.