Tablero | Alexis Hernandez

Bloque principal

Catálogo operativo de hallazgos KEV

Fuente interna persistida

Progress LoadMaster Command Injection Vulnerability

Sin confirmar

CVE: CVE-2026-8037
Proveedor: Progress
Producto: LoadMaster
Incorporada: 07/08/2026
Objetivo: 10/08/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.

JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

Sin confirmar

CVE: CVE-2026-63077
Proveedor: JetBrains
Producto: TeamCity
Incorporada: 05/08/2026
Objetivo: 08/08/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.

N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

Sin confirmar

CVE: CVE-2026-18556
Proveedor: N-able
Producto: N-central
Incorporada: 04/08/2026
Objetivo: 07/08/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass.

Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

Sin confirmar

CVE: CVE-2026-34486
Proveedor: Apache
Producto: Tomcat
Incorporada: 04/08/2026
Objetivo: 07/08/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.

IBM Langflow Code Injection Vulnerability

Sin confirmar

CVE: CVE-2026-9198
Proveedor: IBM
Producto: Langflow
Incorporada: 04/08/2026
Objetivo: 07/08/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.

N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

Sin confirmar

CVE: CVE-2026-18577
Proveedor: N-able
Producto: N-central
Incorporada: 03/08/2026
Objetivo: 06/08/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556.

Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability

Sin confirmar

CVE: CVE-2026-20316
Proveedor: Cisco
Producto: Secure Firewall Management Center (FMC)
Incorporada: 29/07/2026
Objetivo: 01/08/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.

Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

Sin confirmar

CVE: CVE-2025-68686
Proveedor: Fortinet
Producto: FortiOS
Incorporada: 27/07/2026
Objetivo: 10/08/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.

Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2026-16812
Proveedor: Arista
Producto: VeloCloud Orchestrator
Incorporada: 27/07/2026
Objetivo: 30/07/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

Check Point SmartConsole Improper Authentication Vulnerability

Sin confirmar

CVE: CVE-2026-16232
Proveedor: Check Point
Producto: SmartConsole
Incorporada: 22/07/2026
Objetivo: 25/07/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Sin confirmar

CVE: CVE-2026-50522
Proveedor: Microsoft
Producto: SharePoint
Incorporada: 22/07/2026
Objetivo: 25/07/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.

DD-WRT Stack-Based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2021-27137
Proveedor: DD-WRT
Producto: DD-WRT
Incorporada: 21/07/2026
Objetivo: 24/07/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.

Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability

Sin confirmar

CVE: CVE-2026-0770
Proveedor: Langflow
Producto: Langflow
Incorporada: 21/07/2026
Objetivo: 24/07/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations.

WordPress Core SQL Injection Vulnerability

Sin confirmar

CVE: CVE-2026-60137
Proveedor: WordPress
Producto: Core
Incorporada: 21/07/2026
Objetivo: 04/08/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.

WordPress Core Interpretation Conflict Vulnerability

Sin confirmar

CVE: CVE-2026-63030
Proveedor: WordPress
Producto: Core
Incorporada: 21/07/2026
Objetivo: 24/07/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.

Fortinet FortiSandbox OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2026-25089
Proveedor: Fortinet
Producto: FortiSandbox
Incorporada: 16/07/2026
Objetivo: 19/07/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.

Fortinet FortiSandbox OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2026-39808
Proveedor: Fortinet
Producto: FortiSandbox
Incorporada: 16/07/2026
Objetivo: 19/07/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Sin confirmar

CVE: CVE-2026-58644
Proveedor: Microsoft
Producto: SharePoint
Incorporada: 16/07/2026
Objetivo: 19/07/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.

KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability

Sin confirmar

CVE: CVE-2023-4346
Proveedor: KNX Association
Producto: KNX Protocol Connection Authorization Option 1
Incorporada: 15/07/2026
Objetivo: 29/07/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device.

Oracle E-Business Suite Improper Privilege Management Vulnerability

Sin confirmar

CVE: CVE-2026-46817
Proveedor: Oracle
Producto: E-Business Suite
Incorporada: 15/07/2026
Objetivo: 18/07/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.

SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

Confirmado

CVE: CVE-2026-15409
Proveedor: SonicWall
Producto: SMA1000 Appliances
Incorporada: 14/07/2026
Objetivo: 17/07/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.

SonicWall SMA1000 Appliances Code Injection Vulnerability

Confirmado

CVE: CVE-2026-15410
Proveedor: SonicWall
Producto: SMA1000 Appliances
Incorporada: 14/07/2026
Objetivo: 17/07/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.

Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability

Sin confirmar

CVE: CVE-2026-56155
Proveedor: Microsoft
Producto: Active Directory Federation Services
Incorporada: 14/07/2026
Objetivo: 28/07/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.

Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability

Sin confirmar

CVE: CVE-2026-56164
Proveedor: Microsoft
Producto: SharePoint Server
Incorporada: 14/07/2026
Objetivo: 17/07/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network.

Cisco IOS Cross-Site Request Forgery Vulnerability

Sin confirmar

CVE: CVE-2008-4128
Proveedor: Cisco
Producto: IOS
Incorporada: 13/07/2026
Objetivo: 16/07/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI.

iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability

Sin confirmar

CVE: CVE-2026-48939
Proveedor: iCagenda
Producto: iCagenda
Incorporada: 10/07/2026
Objetivo: 13/07/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.

Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability

Sin confirmar

CVE: CVE-2026-56291
Proveedor: Balbooa
Producto: Forms
Incorporada: 10/07/2026
Objetivo: 13/07/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Balbooa Forms contains an unrestricted upload of file with dangerous type vulnerability that allows an unauthenticated arbitrary file upload which could allow uploading of executable files leading to full RCE.

Adobe ColdFusion Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2026-48282
Proveedor: Adobe
Producto: ColdFusion
Incorporada: 07/07/2026
Objetivo: 10/07/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.

JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability

Sin confirmar

CVE: CVE-2026-48908
Proveedor: JoomShaper
Producto: SP Page Builder
Incorporada: 07/07/2026
Objetivo: 10/07/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.

Langflow Authorization Bypass Through User-Controlled Key Vulnerability

Sin confirmar

CVE: CVE-2026-55255
Proveedor: Langflow
Producto: Langflow
Incorporada: 07/07/2026
Objetivo: 10/07/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request.

Joomlack Page Builder Improper Access Control Vulnerability

Sin confirmar

CVE: CVE-2026-56290
Proveedor: Joomlack
Producto: Page Builder
Incorporada: 07/07/2026
Objetivo: 10/07/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload.

Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability

Sin confirmar

CVE: CVE-2026-45659
Proveedor: Microsoft
Producto: SharePoint Server
Incorporada: 01/07/2026
Objetivo: 04/07/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.

SimpleHelp Authentication Bypass Vulnerability

Sin confirmar

CVE: CVE-2026-48558
Proveedor: SimpleHelp
Producto: SimpleHelp
Incorporada: 29/06/2026
Objetivo: 02/07/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication.

PTC Windchill and FlexPLM Improper Input Validation Vulnerability

Confirmado

CVE: CVE-2026-12569
Proveedor: PTC
Producto: Windchill and FlexPLM
Incorporada: 25/06/2026
Objetivo: 28/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network.

Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability

Sin confirmar

CVE: CVE-2026-20230
Proveedor: Cisco
Producto: Unified Communications Manager
Incorporada: 25/06/2026
Objetivo: 28/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used later to elevate to root.

Lantronix EDS5000 Code Injection Vulnerability

Sin confirmar

CVE: CVE-2025-67038
Proveedor: Lantronix
Producto: EDS5000
Incorporada: 23/06/2026
Objetivo: 26/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Lantronix EDS5000 contains a code injection vulnerability that could allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.

Ubiquiti UniFi OS Improper Access Control Vulnerability

Sin confirmar

CVE: CVE-2026-34908
Proveedor: Ubiquiti
Producto: UniFi OS
Incorporada: 23/06/2026
Objetivo: 26/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.

Ubiquiti UniFi OS Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2026-34909
Proveedor: Ubiquiti
Producto: UniFi OS
Incorporada: 23/06/2026
Objetivo: 26/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account.

Ubiquiti UniFi OS Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2026-34910
Proveedor: Ubiquiti
Producto: UniFi OS
Incorporada: 23/06/2026
Objetivo: 26/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection.

Splunk Enterprise Missing Authentication for Critical Function Vulnerability

Sin confirmar

CVE: CVE-2026-20253
Proveedor: Splunk
Producto: Enterprise
Incorporada: 18/06/2026
Objetivo: 21/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.

Widget Factory Joomla Content Editor Improper Access Control Vulnerability

Sin confirmar

CVE: CVE-2026-48907
Proveedor: Widget Factory
Producto: Joomla Content Editor
Incorporada: 16/06/2026
Objetivo: 19/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users.

Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2026-20262
Proveedor: Cisco
Producto: Catalyst SD-WAN Manager
Incorporada: 15/06/2026
Objetivo: 29/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.

LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability

Sin confirmar

CVE: CVE-2026-54420
Proveedor: LiteSpeed
Producto: cPanel Plugin
Incorporada: 15/06/2026
Objetivo: 18/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: LiteSpeed cPanel plugin contains a UNIX symbolic link (Symlink) following vulnerability that could allow a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS.

Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

Confirmado

CVE: CVE-2026-35273
Proveedor: Oracle
Producto: PeopleSoft Enterprise PeopleTools
Incorporada: 12/06/2026
Objetivo: 15/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.

Ivanti Sentry OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2026-10520
Proveedor: Ivanti
Producto: Sentry
Incorporada: 11/06/2026
Objetivo: 14/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Descripción CISA: Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution. This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors.

Google Chromium V8 Out-of-Bounds Read and Write Vulnerability

Sin confirmar

CVE: CVE-2026-11645
Proveedor: Google
Producto: Chromium V8
Incorporada: 09/06/2026
Objetivo: 23/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Google Chromium V8 out-of-bounds read and write vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability

Sin confirmar

CVE: CVE-2026-20245
Proveedor: Cisco
Producto: Catalyst SD-WAN Manager
Incorporada: 09/06/2026
Objetivo: 23/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system.

Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability

Sin confirmar

CVE: CVE-2026-7473
Proveedor: Arista
Producto: Extensible Operating System
Incorporada: 09/06/2026
Objetivo: 23/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP.

BerriAI LiteLLM Command Injection Vulnerability

Sin confirmar

CVE: CVE-2026-42271
Proveedor: BerriAI
Producto: LiteLLM
Incorporada: 08/06/2026
Objetivo: 22/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host.

Check Point Security Gateway Improper Authentication Vulnerability

Confirmado

CVE: CVE-2026-50751
Proveedor: Check Point
Producto: Security Gateway
Incorporada: 08/06/2026
Objetivo: 11/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.

SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability

Sin confirmar

CVE: CVE-2026-28318
Proveedor: SolarWinds
Producto: Serv-U
Incorporada: 05/06/2026
Objetivo: 19/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication.

Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability

Sin confirmar

CVE: CVE-2026-45247
Proveedor: Mirasvit
Producto: Mirasvit Full Page Cache Warmer
Incorporada: 03/06/2026
Objetivo: 06/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Mirasvit Full Page Cache Warmer contains a deserialization of untrusted data vulnerability that could allow unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie.

Linux Kernel Improper Authentication Vulnerability

Sin confirmar

CVE: CVE-2022-0492
Proveedor: Linux
Producto: Kernel
Incorporada: 02/06/2026
Objetivo: 05/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature.

Android Framework Integer Overflow Vulnerability

Sin confirmar

CVE: CVE-2025-48595
Proveedor: Android
Producto: Framework
Incorporada: 02/06/2026
Objetivo: 05/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Android Framework contains an integer overflow vulnerability that allows for code execution that could allow for local privilege escalation.

Oracle WebLogic Server Unspecified Vulnerability

Sin confirmar

CVE: CVE-2024-21182
Proveedor: Oracle
Producto: WebLogic Server
Incorporada: 01/06/2026
Objetivo: 04/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data.

Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

Confirmado

CVE: CVE-2026-0257
Proveedor: Palo Alto Networks
Producto: PAN-OS
Incorporada: 29/05/2026
Objetivo: 01/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.

TanStack Unspecified Vulnerability

Confirmado

CVE: CVE-2026-45321
Proveedor: TanStack
Producto: TanStack
Incorporada: 27/05/2026
Objetivo: 10/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity.

Nx Console Embedded Malicious Code Vulnerability

Confirmado

CVE: CVE-2026-48027
Proveedor: Nx
Producto: Nx Console
Incorporada: 27/05/2026
Objetivo: 10/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory.

Daemon Tools Lite Embedded Malicious Code Vulnerability

Sin confirmar

CVE: CVE-2026-8398
Proveedor: Daemon
Producto: Daemon Tools Lite
Incorporada: 27/05/2026
Objetivo: 30/05/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Daemon Tools contains an unspecified vulnerability that has a high impact on confidentiality, integrity, and availability.

LiteSpeed cPanel Plugin Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2026-48172
Proveedor: LiteSpeed
Producto: cPanel Plugin
Incorporada: 26/05/2026
Objetivo: 29/05/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges.

Drupal Core SQL Injection Vulnerability

Sin confirmar

CVE: CVE-2026-9082
Proveedor: Drupal
Producto: Core
Incorporada: 22/05/2026
Objetivo: 27/05/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.

Langflow Origin Validation Error Vulnerability

Sin confirmar

CVE: CVE-2025-34291
Proveedor: Langflow
Producto: Langflow
Incorporada: 21/05/2026
Objetivo: 04/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints.

Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability

Sin confirmar

CVE: CVE-2026-34926
Proveedor: Trend Micro
Producto: Apex One
Incorporada: 21/05/2026
Objetivo: 04/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Trend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.

Microsoft Windows Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2008-4250
Proveedor: Microsoft
Producto: Windows
Incorporada: 20/05/2026
Objetivo: 03/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization.

Microsoft DirectX NULL Byte Overwrite Vulnerability

Sin confirmar

CVE: CVE-2009-1537
Proveedor: Microsoft
Producto: DirectX
Incorporada: 20/05/2026
Objetivo: 03/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file.

Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2009-3459
Proveedor: Adobe
Producto: Acrobat and Reader
Incorporada: 20/05/2026
Objetivo: 03/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.

Microsoft Internet Explorer Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2010-0249
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 20/05/2026
Objetivo: 03/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Microsoft Internet Explorer Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2010-0806
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 20/05/2026
Objetivo: 03/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Microsoft Defender Link Following Vulnerability

Sin confirmar

CVE: CVE-2026-41091
Proveedor: Microsoft
Producto: Defender
Incorporada: 20/05/2026
Objetivo: 03/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally.

Microsoft Defender Denial of Service Vulnerability

Sin confirmar

CVE: CVE-2026-45498
Proveedor: Microsoft
Producto: Defender
Incorporada: 20/05/2026
Objetivo: 03/06/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Defender contains an unspecified vulnerability that allows for denial of service.

Microsoft Exchange Server Cross-Site Scripting Vulnerability

Sin confirmar

CVE: CVE-2026-42897
Proveedor: Microsoft
Producto: Microsoft
Incorporada: 15/05/2026
Objetivo: 29/05/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.

Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

Sin confirmar

CVE: CVE-2026-20182
Proveedor: Cisco
Producto: Catalyst SD-WAN
Incorporada: 14/05/2026
Objetivo: 17/05/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlined in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Descripción CISA: Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.

BerriAI LiteLLM SQL Injection Vulnerability

Sin confirmar

CVE: CVE-2026-42208
Proveedor: BerriAI
Producto: LiteLLM
Incorporada: 08/05/2026
Objetivo: 11/05/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages.

Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2026-6973
Proveedor: Ivanti
Producto: Endpoint Manager Mobile (EPMM)
Incorporada: 07/05/2026
Objetivo: 10/05/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution.

Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability

Sin confirmar

CVE: CVE-2026-0300
Proveedor: Palo Alto Networks
Producto: PAN-OS
Incorporada: 06/05/2026
Objetivo: 09/05/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented: - Restrict User-ID Authentication Portal access to only trusted zones. - Disable User-ID Authentication Portal if not required. 5/13/2026: Palo Alto has released a variety of patches. If these are relevant to your environment, please apply the designated patch.
Descripción CISA: Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.

Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

Sin confirmar

CVE: CVE-2026-31431
Proveedor: Linux
Producto: Kernel
Incorporada: 01/05/2026
Objetivo: 15/05/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.

WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

Confirmado

CVE: CVE-2026-41940
Proveedor: WebPros
Producto: cPanel & WHM and WP2 (WordPress Squared)
Incorporada: 30/04/2026
Objetivo: 03/05/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

ConnectWise ScreenConnect Path Traversal Vulnerability

Confirmado

CVE: CVE-2024-1708
Proveedor: ConnectWise
Producto: ScreenConnect
Incorporada: 28/04/2026
Objetivo: 12/05/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.

Microsoft Windows Protection Mechanism Failure Vulnerability

Sin confirmar

CVE: CVE-2026-32202
Proveedor: Microsoft
Producto: Windows
Incorporada: 28/04/2026
Objetivo: 12/05/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network.

SimpleHelp Missing Authorization Vulnerability

Confirmado

CVE: CVE-2024-57726
Proveedor: SimpleHelp
Producto: SimpleHelp
Incorporada: 24/04/2026
Objetivo: 08/05/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.

SimpleHelp Path Traversal Vulnerability

Confirmado

CVE: CVE-2024-57728
Proveedor: SimpleHelp
Producto: SimpleHelp
Incorporada: 24/04/2026
Objetivo: 08/05/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.

Samsung MagicINFO 9 Server Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2024-7399
Proveedor: Samsung
Producto: MagicINFO 9 Server
Incorporada: 24/04/2026
Objetivo: 08/05/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Samsung MagicINFO 9 Server contains a path traversal vulnerability that could allow an attacker to write arbitrary files as system authority.

D-Link DIR-823X Command Injection Vulnerability

Sin confirmar

CVE: CVE-2025-29635
Proveedor: D-Link
Producto: DIR-823X
Incorporada: 24/04/2026
Objetivo: 08/05/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Marimo Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2026-39987
Proveedor: Marimo
Producto: Marimo
Incorporada: 23/04/2026
Objetivo: 07/05/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands.

Microsoft Defender Insufficient Granularity of Access Control Vulnerability

Confirmado

CVE: CVE-2026-33825
Proveedor: Microsoft
Producto: Defender
Incorporada: 22/04/2026
Objetivo: 06/05/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.

PaperCut NG/MF Improper Authentication Vulnerability

Confirmado

CVE: CVE-2023-27351
Proveedor: PaperCut
Producto: NG/MF
Incorporada: 20/04/2026
Objetivo: 04/05/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: PaperCut NG/MF contains an improper authentication vulnerability that could allow remote attackers to bypass authentication on affected installations via the SecurityRequestFilter class.

JetBrains TeamCity Relative Path Traversal Vulnerability

Confirmado

CVE: CVE-2024-27199
Proveedor: JetBrains
Producto: TeamCity
Incorporada: 20/04/2026
Objetivo: 04/05/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed.

Kentico Xperience Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2025-2749
Proveedor: Kentico
Producto: Kentico Xperience
Incorporada: 20/04/2026
Objetivo: 04/05/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Kentico Xperience contains a path traversal vulnerability that could allow an authenticated user's Staging Sync Server to upload arbitrary data to path relative locations.

Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability

Sin confirmar

CVE: CVE-2025-32975
Proveedor: Quest
Producto: KACE Systems Management Appliance (SMA)
Incorporada: 20/04/2026
Objetivo: 04/05/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials.

Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

Sin confirmar

CVE: CVE-2025-48700
Proveedor: Synacor
Producto: Zimbra Collaboration Suite (ZCS)
Incorporada: 20/04/2026
Objetivo: 23/04/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information.

Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability

Sin confirmar

CVE: CVE-2026-20122
Proveedor: Cisco
Producto: Catalyst SD-WAN Manger
Incorporada: 20/04/2026
Objetivo: 23/04/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Descripción CISA: Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.

Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability

Sin confirmar

CVE: CVE-2026-20128
Proveedor: Cisco
Producto: Catalyst SD-WAN Manager
Incorporada: 20/04/2026
Objetivo: 23/04/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Descripción CISA: Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user.

Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

Sin confirmar

CVE: CVE-2026-20133
Proveedor: Cisco
Producto: Catalyst SD-WAN Manager
Incorporada: 20/04/2026
Objetivo: 23/04/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Descripción CISA: Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems.

Apache ActiveMQ Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2026-34197
Proveedor: Apache
Producto: ActiveMQ
Incorporada: 16/04/2026
Objetivo: 30/04/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.

Microsoft Office Remote Code Execution

Sin confirmar

CVE: CVE-2009-0238
Proveedor: Microsoft
Producto: Office
Incorporada: 14/04/2026
Objetivo: 28/04/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that includes a malformed object.

Microsoft SharePoint Server Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2026-32201
Proveedor: Microsoft
Producto: SharePoint Server
Incorporada: 14/04/2026
Objetivo: 28/04/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network.

Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability

Sin confirmar

CVE: CVE-2012-1854
Proveedor: Microsoft
Producto: Visual Basic for Applications (VBA)
Incorporada: 13/04/2026
Objetivo: 27/04/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Visual Basic for Applications (VBA) contains an insecure library loading vulnerability that could allow for remote code execution.

Adobe Acrobat Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2020-9715
Proveedor: Adobe
Producto: Acrobat
Incorporada: 13/04/2026
Objetivo: 27/04/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Adobe Acrobat contains a use-after-free vulnerability that allows for code execution

Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability

Confirmado

CVE: CVE-2023-21529
Proveedor: Microsoft
Producto: Exchange Server
Incorporada: 13/04/2026
Objetivo: 27/04/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution.

Microsoft Windows Out-of-Bounds Read Vulnerability

Sin confirmar

CVE: CVE-2023-36424
Proveedor: Microsoft
Producto: Windows
Incorporada: 13/04/2026
Objetivo: 27/04/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Common Log File System Driver contains an out-of-bounds read vulnerability that could allow a threat actor for privileges escalation

Microsoft Windows Link Following Vulnerability

Sin confirmar

CVE: CVE-2025-60710
Proveedor: Microsoft
Producto: Windows
Incorporada: 13/04/2026
Objetivo: 27/04/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows contains a link following vulnerability that allows for privilege escalation

Fortinet FortiClient EMS SQL Injection Vulnerability

Sin confirmar

CVE: CVE-2026-21643
Proveedor: Fortinet
Producto: FortiClient EMS
Incorporada: 13/04/2026
Objetivo: 16/04/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

Adobe Acrobat and Reader Prototype Pollution Vulnerability

Sin confirmar

CVE: CVE-2026-34621
Proveedor: Adobe
Producto: Acrobat and Reader
Incorporada: 13/04/2026
Objetivo: 27/04/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution.

Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

Sin confirmar

CVE: CVE-2026-1340
Proveedor: Ivanti
Producto: Endpoint Manager Mobile (EPMM)
Incorporada: 08/04/2026
Objetivo: 11/04/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution.

Fortinet FortiClient EMS Improper Access Control Vulnerability

Sin confirmar

CVE: CVE-2026-35616
Proveedor: Fortinet
Producto: FortiClient EMS
Incorporada: 06/04/2026
Objetivo: 09/04/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

TrueConf Client Download of Code Without Integrity Check Vulnerability

Sin confirmar

CVE: CVE-2026-3502
Proveedor: TrueConf
Producto: Client
Incorporada: 02/04/2026
Objetivo: 16/04/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: TrueConf Client contains a download of code without integrity check vulnerability. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.

Google Dawn Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2026-5281
Proveedor: Google
Producto: Dawn
Incorporada: 01/04/2026
Objetivo: 15/04/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Google Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. This vulnerability could affect multiple Chromium-based products including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Citrix NetScaler Out-of-Bounds Read Vulnerability

Sin confirmar

CVE: CVE-2026-3055
Proveedor: Citrix
Producto: NetScaler
Incorporada: 30/03/2026
Objetivo: 02/04/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway) and NetScaler ADC FIPS and NDcPP contain an out-of-bounds reads vulnerability when configured as a SAML IDP leading to memory overread.

F5 BIG-IP Stack-Based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2025-53521
Proveedor: F5
Producto: BIG-IP
Incorporada: 27/03/2026
Objetivo: 30/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution.

Aquasecurity Trivy Embedded Malicious Code Vulnerability

Sin confirmar

CVE: CVE-2026-33634
Proveedor: Aquasecurity
Producto: Trivy
Incorporada: 26/03/2026
Objetivo: 09/04/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Aquasecurity Trivy contains an embedded malicious code vulnerability that could allow an attacker to gain access to everything in the CI/CD environment, including all tokens, SSH keys, cloud credentials, database passwords, and any sensitive configuration in memory.

Langflow Code Injection Vulnerability

Sin confirmar

CVE: CVE-2026-33017
Proveedor: Langflow
Producto: Langflow
Incorporada: 25/03/2026
Objetivo: 08/04/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication.

Apple Multiple Products Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2025-31277
Proveedor: Apple
Producto: Multiple Products
Incorporada: 20/03/2026
Objetivo: 03/04/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS, and tvOS contain a buffer overflow vulnerability that could allow the processing of maliciously crafted web content which may lead to memory corruption.

Craft CMS Code Injection Vulnerability

Sin confirmar

CVE: CVE-2025-32432
Proveedor: Craft CMS
Producto: Craft CMS
Incorporada: 20/03/2026
Objetivo: 03/04/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code.

Apple Multiple Products Improper Locking Vulnerability

Sin confirmar

CVE: CVE-2025-43510
Proveedor: Apple
Producto: Multiple Products
Incorporada: 20/03/2026
Objetivo: 03/04/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a malicious application to cause unexpected changes in memory shared between processes.

Apple Multiple Products Classic Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2025-43520
Proveedor: Apple
Producto: Multiple Products
Incorporada: 20/03/2026
Objetivo: 03/04/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain a classic buffer overflow vulnerability which could allow a malicious application to cause unexpected system termination or write kernel memory.

Laravel Livewire Code Injection Vulnerability

Sin confirmar

CVE: CVE-2025-54068
Proveedor: Laravel
Producto: Livewire
Incorporada: 20/03/2026
Objetivo: 03/04/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Laravel Livewire contain a code injection vulnerability that could allow unauthenticated attackers to achieve remote command execution in specific scenarios.

Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability

Confirmado

CVE: CVE-2026-20131
Proveedor: Cisco
Producto: Secure Firewall Management Center (FMC)
Incorporada: 19/03/2026
Objetivo: 22/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability

Sin confirmar

CVE: CVE-2025-66376
Proveedor: Synacor
Producto: Zimbra Collaboration Suite (ZCS)
Incorporada: 18/03/2026
Objetivo: 01/04/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) @import directives in email HTML.

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Sin confirmar

CVE: CVE-2026-20963
Proveedor: Microsoft
Producto: SharePoint
Incorporada: 18/03/2026
Objetivo: 21/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.

Wing FTP Server Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2025-47813
Proveedor: Wing FTP Server
Producto: Wing FTP Server
Incorporada: 16/03/2026
Objetivo: 30/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Wing FTP Server contains a generation of error message containing sensitive information vulnerability when using a long value in the UID cookie.

Google Skia Out-of-Bounds Write Vulnerability

Sin confirmar

CVE: CVE-2026-3909
Proveedor: Google
Producto: Skia
Incorporada: 13/03/2026
Objetivo: 27/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.

Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability

Sin confirmar

CVE: CVE-2026-3910
Proveedor: Google
Producto: Chromium V8
Incorporada: 13/03/2026
Objetivo: 27/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

n8n Improper Control of Dynamically-Managed Code Resources Vulnerability

Sin confirmar

CVE: CVE-2025-68613
Proveedor: n8n
Producto: n8n
Incorporada: 11/03/2026
Objetivo: 25/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: n8n contains an improper control of dynamically managed code resources vulnerability in its workflow expression evaluation system that allows for remote code execution.

Omnissa Workspace ONE Server-Side Request Forgery

Sin confirmar

CVE: CVE-2021-22054
Proveedor: Omnissa
Producto: Workspace One UEM
Incorporada: 09/03/2026
Objetivo: 23/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Omnissa Workspace One UEM formerly known as VMware Workspace One UEM contains a server-side request forgery (SSRF) vulnerability that could allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.

SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

Confirmado

CVE: CVE-2025-26399
Proveedor: SolarWinds
Producto: Web Help Desk
Incorporada: 09/03/2026
Objetivo: 12/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine.

Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability

Sin confirmar

CVE: CVE-2026-1603
Proveedor: Ivanti
Producto: Endpoint Manager (EPM)
Incorporada: 09/03/2026
Objetivo: 23/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Ivanti Endpoint Manager (EPM) contains an authentication bypass using an alternate path or channel vulnerability that could allow a remote unauthenticated attacker to leak specific stored credential data.

Hikvision Multiple Products Improper Authentication Vulnerability

Sin confirmar

CVE: CVE-2017-7921
Proveedor: Hikvision
Producto: Multiple Products
Incorporada: 05/03/2026
Objetivo: 26/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Multiple Hikvision products contain an improper authentication vulnerability that could allow a malicious user to escalate privileges on the system and gain access to sensitive information.

Rockwell Multiple Products Insufficient Protected Credentials Vulnerability

Sin confirmar

CVE: CVE-2021-22681
Proveedor: Rockwell
Producto: Multiple Products
Incorporada: 05/03/2026
Objetivo: 26/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a key to be discovered. This key is used to verify Logix controllers are communicating with Rockwell Automation design software. If successfully exploited, this vulnerability could allow an unauthorized application to connect with Logix controllers. To leverage this vulnerability, an unauthorized user would require network access to the controller.

Apple Multiple Products Integer Overflow or Wraparound Vulnerability

Sin confirmar

CVE: CVE-2021-30952
Proveedor: Apple
Producto: Multiple Products
Incorporada: 05/03/2026
Objetivo: 26/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple tvOS, macOS, Safari, iPadOS and watchOS contain an integer overflow or wraparound vulnerability due to the processing of maliciously crafted web content that may lead to arbitrary code execution.

Apple iOS and iPadOS Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2023-41974
Proveedor: Apple
Producto: iOS and iPadOS
Incorporada: 05/03/2026
Objetivo: 26/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple iOS and iPadOS contain a use-after-free vulnerability. An app may be able to execute arbitrary code with kernel privileges.

Apple Multiple products Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2023-43000
Proveedor: Apple
Producto: Multiple Products
Incorporada: 05/03/2026
Objetivo: 26/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple macOS, iOS, iPadOS, and Safari 16.6 contain a use-after-free vulnerability due to the processing of maliciously crafted web content that may lead to memory corruption.

Qualcomm Multiple Chipsets Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2026-21385
Proveedor: Qualcomm
Producto: Multiple Chipsets
Incorporada: 03/03/2026
Objetivo: 24/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Multiple Qualcomm chipsets contain a memory corruption vulnerability while using alignments for memory allocation.

Broadcom VMware Aria Operations Command Injection Vulnerability

Sin confirmar

CVE: CVE-2026-22719
Proveedor: Broadcom
Producto: VMware Aria Operations
Incorporada: 03/03/2026
Objetivo: 24/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Broadcom VMware Aria Operations formerly known as vRealize Operations (vROps) contains a command injection vulnerability that allows an unauthenticated attacker to execute arbitrary commands, potentially leading to remote code execution during support‑assisted product migration.

Cisco SD-WAN Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2022-20775
Proveedor: Cisco
Producto: SD-WAN
Incorporada: 25/02/2026
Objetivo: 27/02/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Descripción CISA: Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via improper access controls on commands within the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.

Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability

Sin confirmar

CVE: CVE-2026-20127
Proveedor: Cisco
Producto: Catalyst SD-WAN Controller and Manager
Incorporada: 25/02/2026
Objetivo: 27/02/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Descripción CISA: Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.

Soliton Systems K.K FileZen OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2026-25108
Proveedor: Soliton Systems K.K
Producto: FileZen
Incorporada: 24/02/2026
Objetivo: 17/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Soliton Systems K.K FileZen contains an OS command injection vulnerability when an user logs-in to the affected product and sends a specially crafted HTTP request.

RoundCube Webmail Deserialization of Untrusted Data Vulnerability

Sin confirmar

CVE: CVE-2025-49113
Proveedor: Roundcube
Producto: Webmail
Incorporada: 20/02/2026
Objetivo: 13/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php.

RoundCube Webmail Cross-site Scripting Vulnerability

Sin confirmar

CVE: CVE-2025-68461
Proveedor: Roundcube
Producto: Webmail
Incorporada: 20/02/2026
Objetivo: 13/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document.

GitLab Server-Side Request Forgery (SSRF) Vulnerability

Sin confirmar

CVE: CVE-2021-22175
Proveedor: GitLab
Producto: GitLab
Incorporada: 18/02/2026
Objetivo: 11/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled.

Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability

Sin confirmar

CVE: CVE-2026-22769
Proveedor: Dell
Producto: RecoverPoint for Virtual Machines (RP4VMs)
Incorporada: 18/02/2026
Objetivo: 21/02/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Dell RecoverPoint for Virtual Machines (RP4VMs) contains an use of hard-coded credentials vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access to the underlying operating system and root-level persistence.

Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2008-0015
Proveedor: Microsoft
Producto: Windows
Incorporada: 17/02/2026
Objetivo: 10/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Video ActiveX Control contains a remote code execution vulnerability. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user.

Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability

Sin confirmar

CVE: CVE-2020-7796
Proveedor: Synacor
Producto: Zimbra Collaboration Suite
Incorporada: 17/02/2026
Objetivo: 10/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery vulnerability if WebEx zimlet installed and zimlet JSP is enabled.

TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability

Sin confirmar

CVE: CVE-2024-7694
Proveedor: TeamT5
Producto: ThreatSonar Anti-Ransomware
Incorporada: 17/02/2026
Objetivo: 10/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: TeamT5 ThreatSonar Anti-Ransomware contains an unrestricted upload of file with dangerous type vulnerability. ThreatSonar Anti-Ransomware does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system commands on the server.

Google Chromium CSS Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2026-2441
Proveedor: Google
Producto: Chromium
Incorporada: 17/02/2026
Objetivo: 10/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability

Confirmado

CVE: CVE-2026-1731
Proveedor: BeyondTrust
Producto: Remote Support (RS) and Privileged Remote Access (PRA)
Incorporada: 13/02/2026
Objetivo: 16/02/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption.

Microsoft Configuration Manager SQL Injection Vulnerability

Sin confirmar

CVE: CVE-2024-43468
Proveedor: Microsoft
Producto: Configuration Manager
Incorporada: 12/02/2026
Objetivo: 05/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Configuration Manager contains an SQL injection vulnerability. An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to the target environment which are processed in an unsafe manner enabling the attacker to execute commands on the server and/or underlying database.

Notepad++ Download of Code Without Integrity Check Vulnerability

Sin confirmar

CVE: CVE-2025-15556
Proveedor: Notepad++
Producto: Notepad++
Incorporada: 12/02/2026
Objetivo: 05/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Notepad++ when using the WinGUp updater, contains a download of code without integrity check vulnerability that could allow an attacker to intercept or redirect update traffic to download and execute an attacker-controlled installer. This could lead to arbitrary code execution with the privileges of the user.

SolarWinds Web Help Desk Security Control Bypass Vulnerability

Sin confirmar

CVE: CVE-2025-40536
Proveedor: SolarWinds
Producto: Web Help Desk
Incorporada: 12/02/2026
Objetivo: 15/02/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: SolarWinds Web Help Desk contains a security control bypass vulnerability that could allow an unauthenticated attacker to gain access to certain restricted functionality.

Apple Multiple Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2026-20700
Proveedor: Apple
Producto: Multiple Products
Incorporada: 12/02/2026
Objetivo: 05/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple iOS, macOS, tvOS, watchOS, and visionOS contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow an attacker with memory write the capability to execute arbitrary code.

Microsoft Windows Shell Protection Mechanism Failure Vulnerability

Sin confirmar

CVE: CVE-2026-21510
Proveedor: Microsoft
Producto: Windows
Incorporada: 10/02/2026
Objetivo: 03/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Shell contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.

Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability

Sin confirmar

CVE: CVE-2026-21513
Proveedor: Microsoft
Producto: Windows
Incorporada: 10/02/2026
Objetivo: 03/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft MSHTML Framework contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.

Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability

Sin confirmar

CVE: CVE-2026-21514
Proveedor: Microsoft
Producto: Office
Incorporada: 10/02/2026
Objetivo: 03/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker to elevate privileges locally.

Microsoft Windows Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2026-21519
Proveedor: Microsoft
Producto: Windows
Incorporada: 10/02/2026
Objetivo: 03/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Desktop Windows Manager contains a type confusion vulnerability that could allow an authorized attacker to elevate privileges locally.

Microsoft Windows NULL Pointer Dereference Vulnerability

Sin confirmar

CVE: CVE-2026-21525
Proveedor: Microsoft
Producto: Windows
Incorporada: 10/02/2026
Objetivo: 03/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Remote Access Connection Manager contains a NULL pointer dereference that could allow an unauthorized attacker to deny service locally.

Microsoft Windows Improper Privilege Management Vulnerability

Sin confirmar

CVE: CVE-2026-21533
Proveedor: Microsoft
Producto: Windows
Incorporada: 10/02/2026
Objetivo: 03/03/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Remote Desktop Services contains an improper privilege management vulnerability that could allow an authorized attacker to elevate privileges locally.

React Native Community CLI OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2025-11953
Proveedor: React Native Community
Producto: CLI
Incorporada: 05/02/2026
Objetivo: 26/02/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments.

SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability

Confirmado

CVE: CVE-2026-24423
Proveedor: SmarterTools
Producto: SmarterMail
Incorporada: 05/02/2026
Objetivo: 26/02/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution.

Sangoma FreePBX Improper Authentication Vulnerability

Sin confirmar

CVE: CVE-2019-19006
Proveedor: Sangoma
Producto: FreePBX
Incorporada: 03/02/2026
Objetivo: 24/02/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Sangoma FreePBX contains an improper authentication vulnerability that potentially allows unauthorized users to bypass password authentication and access services provided by the FreePBX admin.

GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability

Sin confirmar

CVE: CVE-2021-39935
Proveedor: GitLab
Producto: Community and Enterprise Editions
Incorporada: 03/02/2026
Objetivo: 24/02/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API.

SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

Sin confirmar

CVE: CVE-2025-40551
Proveedor: SolarWinds
Producto: Web Help Desk
Incorporada: 03/02/2026
Objetivo: 06/02/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.

Sangoma FreePBX OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2025-64328
Proveedor: Sangoma
Producto: FreePBX
Incorporada: 03/02/2026
Objetivo: 24/02/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that could allow for a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to potentially obtain remote access to the system as an asterisk user.

Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

Sin confirmar

CVE: CVE-2026-1281
Proveedor: Ivanti
Producto: Endpoint Manager Mobile (EPMM)
Incorporada: 29/01/2026
Objetivo: 01/02/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution.

Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability

Sin confirmar

CVE: CVE-2026-24858
Proveedor: Fortinet
Producto: Multiple Products
Incorporada: 27/01/2026
Objetivo: 30/01/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.

Linux Kernel Integer Overflow Vulnerability

Sin confirmar

CVE: CVE-2018-14634
Proveedor: Linux
Producto: Kernel
Incorporada: 26/01/2026
Objetivo: 16/02/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Linux Kernel contains an integer overflow vulnerability in the create_elf_tables() function which could allow an unprivileged local user with access to SUID (or otherwise privileged) binary to escalate their privileges on the system.

SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability

Confirmado

CVE: CVE-2025-52691
Proveedor: SmarterTools
Producto: SmarterMail
Incorporada: 26/01/2026
Objetivo: 16/02/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

Microsoft Office Security Feature Bypass Vulnerability

Sin confirmar

CVE: CVE-2026-21509
Proveedor: Microsoft
Producto: Office
Incorporada: 26/01/2026
Objetivo: 16/02/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could allow an unauthorized attacker to bypass a security feature locally. Some of the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.

SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability

Confirmado

CVE: CVE-2026-23760
Proveedor: SmarterTools
Producto: SmarterMail
Incorporada: 26/01/2026
Objetivo: 16/02/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow an unauthenticated attacker to supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.

GNU InetUtils Argument Injection Vulnerability

Sin confirmar

CVE: CVE-2026-24061
Proveedor: GNU
Producto: InetUtils
Incorporada: 26/01/2026
Objetivo: 16/02/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: GNU InetUtils contains an argument injection vulnerability in telnetd that could allow for remote authentication bypass via a "-f root" value for the USER environment variable.

Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability

Sin confirmar

CVE: CVE-2024-37079
Proveedor: Broadcom
Producto: VMware vCenter Server
Incorporada: 23/01/2026
Objetivo: 13/02/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. This could allow a malicious actor with network access to vCenter Server to send specially crafted network packets, potentially leading to remote code execution.

Vite Vitejs Improper Access Control Vulnerability

Sin confirmar

CVE: CVE-2025-31125
Proveedor: Vite
Producto: Vitejs
Incorporada: 22/01/2026
Objetivo: 12/02/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Vite Vitejs contains an improper access control vulnerability that exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Versa Concerto Improper Authentication Vulnerability

Sin confirmar

CVE: CVE-2025-34026
Proveedor: Versa
Producto: Concerto
Incorporada: 22/01/2026
Objetivo: 12/02/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Versa Concerto SD-WAN orchestration platform contains an improper authentication vulnerability in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.

Prettier eslint-config-prettier Embedded Malicious Code Vulnerability

Sin confirmar

CVE: CVE-2025-54313
Proveedor: Prettier
Producto: eslint-config-prettier
Incorporada: 22/01/2026
Objetivo: 12/02/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Prettier eslint-config-prettier contains an embedded malicious code vulnerability. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability

Sin confirmar

CVE: CVE-2025-68645
Proveedor: Synacor
Producto: Zimbra Collaboration Suite (ZCS)
Incorporada: 22/01/2026
Objetivo: 12/02/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Synacor Zimbra Collaboration Suite (ZCS) contains a PHP remote file inclusion vulnerability that could allow for remote attackers to craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.

Cisco Unified Communications Products Code Injection Vulnerability

Sin confirmar

CVE: CVE-2026-20045
Proveedor: Cisco
Producto: Unified Communications Manager
Incorporada: 21/01/2026
Objetivo: 11/02/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance contain a code injection vulnerability that could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root.

Microsoft Windows Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2026-20805
Proveedor: Microsoft
Producto: Windows
Incorporada: 13/01/2026
Objetivo: 03/02/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Desktop Windows Manager contains an information disclosure vulnerability that allows an authorized attacker to disclose information locally.

Gogs Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2025-8110
Proveedor: Gogs
Producto: Gogs
Incorporada: 12/01/2026
Objetivo: 02/02/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Gogs contains a path traversal vulnerability affecting improper Symbolic link handling in the PutContents API that could allow for code execution.

Microsoft Office PowerPoint Code Injection Vulnerability

Sin confirmar

CVE: CVE-2009-0556
Proveedor: Microsoft
Producto: Office
Incorporada: 07/01/2026
Objetivo: 28/01/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Office PowerPoint contains a code injection vulnerability that allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an invalid index value that triggers memory corruption.

Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability

Sin confirmar

CVE: CVE-2025-37164
Proveedor: Hewlett Packard Enterprise (HPE)
Producto: OneView
Incorporada: 07/01/2026
Objetivo: 28/01/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Hewlett Packard Enterprise (HPE) OneView contains a code injection vulnerability that allows a remote unauthenticated user to perform remote code execution.

MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability

Sin confirmar

CVE: CVE-2025-14847
Proveedor: MongoDB
Producto: MongoDB and MongoDB Server
Incorporada: 29/12/2025
Objetivo: 19/01/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This vulnerability may allow a read of uninitialized heap memory by an unauthenticated client.

Digiever DS-2105 Pro Missing Authorization Vulnerability

Sin confirmar

CVE: CVE-2023-52163
Proveedor: Digiever
Producto: DS-2105 Pro
Incorporada: 22/12/2025
Objetivo: 12/01/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Digiever DS-2105 Pro contains a missing authorization vulnerability which could allow for command injection via time_tzsetup.cgi.

WatchGuard Firebox Out of Bounds Write Vulnerability

Sin confirmar

CVE: CVE-2025-14733
Proveedor: WatchGuard
Producto: Firebox
Incorporada: 19/12/2025
Objetivo: 26/12/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: WatchGuard Fireware OS iked process contains an out of bounds write vulnerability in the OS iked process. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary code and affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.

Cisco Multiple Products Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2025-20393
Proveedor: Cisco
Producto: Multiple Products
Incorporada: 17/12/2025
Objetivo: 24/12/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appliances contains an improper input validation vulnerability that allows threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance.

SonicWall SMA1000 Missing Authorization Vulnerability

Sin confirmar

CVE: CVE-2025-40602
Proveedor: SonicWall
Producto: SMA1000 appliance
Incorporada: 17/12/2025
Objetivo: 24/12/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable
Descripción CISA: SonicWall SMA1000 contains a missing authorization vulnerability that could allow for privilege escalation appliance management console (AMC) of affected devices.

ASUS Live Update Embedded Malicious Code Vulnerability

Sin confirmar

CVE: CVE-2025-59374
Proveedor: ASUS
Producto: Live Update
Incorporada: 17/12/2025
Objetivo: 07/01/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: ASUS Live Update contains an embedded malicious code vulnerability client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability

Sin confirmar

CVE: CVE-2025-59718
Proveedor: Fortinet
Producto: Multiple Products
Incorporada: 16/12/2025
Objetivo: 23/12/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message. Please be aware that CVE-2025-59719 pertains to the same problem and is mentioned in the same vendor advisory. Ensure to apply all patches mentioned in the advisory.

Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability

Sin confirmar

CVE: CVE-2025-14611
Proveedor: Gladinet
Producto: CentreStack and Triofox
Incorporada: 15/12/2025
Objetivo: 05/01/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys vulnerability for their implementation of the AES cryptoscheme. This vulnerability degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication.

Apple Multiple Products Use-After-Free WebKit Vulnerability

Sin confirmar

CVE: CVE-2025-43529
Proveedor: Apple
Producto: Multiple Products
Incorporada: 15/12/2025
Objetivo: 05/01/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple iOS, iPadOS, macOS, and other Apple products contain a use-after-free vulnerability in WebKit. Processing maliciously crafted web content may lead to memory corruption. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability

Sin confirmar

CVE: CVE-2018-4063
Proveedor: Sierra Wireless
Producto: AirLink ALEOS
Incorporada: 12/12/2025
Objetivo: 02/01/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Sierra Wireless AirLink ALEOS contains an unrestricted upload of file with dangerous type vulnerability. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Google Chromium Out of Bounds Memory Access Vulnerability

Sin confirmar

CVE: CVE-2025-14174
Proveedor: Google
Producto: Chromium
Incorporada: 12/12/2025
Objetivo: 02/01/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability

Sin confirmar

CVE: CVE-2025-58360
Proveedor: OSGeo
Producto: GeoServer
Incorporada: 11/12/2025
Objetivo: 01/01/2026
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: OSGeo GeoServer contains an improper restriction of XML external entity reference vulnerability that occurs when the application accepts XML input through a specific endpoint /geoserver/wms operation GetMap and could allow an attacker to define external entities within the XML request.

RARLAB WinRAR Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2025-6218
Proveedor: RARLAB
Producto: WinRAR
Incorporada: 09/12/2025
Objetivo: 30/12/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: RARLAB WinRAR contains a path traversal vulnerability allowing an attacker to execute code in the context of the current user.

Microsoft Windows Use After Free Vulnerability

Sin confirmar

CVE: CVE-2025-62221
Proveedor: Microsoft
Producto: Windows
Incorporada: 09/12/2025
Objetivo: 30/12/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Cloud Files Mini Filter Driver contains a use after free vulnerability that can allow an authorized attacker to elevate privileges locally.

D-Link Routers Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2022-37055
Proveedor: D-Link
Producto: Routers
Incorporada: 08/12/2025
Objetivo: 29/12/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: D-Link Routers contains a buffer overflow vulnerability that has a high impact on confidentiality, integrity, and availability. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Array Networks ArrayOS AG OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2025-66644
Proveedor: Array Networks
Producto: ArrayOS AG
Incorporada: 08/12/2025
Objetivo: 29/12/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Array Networks ArrayOS AG contains an OS command injection vulnerability that could allow an attacker to execute arbitrary commands.

Meta React Server Components Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2025-55182
Proveedor: Meta
Producto: React Server Components
Incorporada: 05/12/2025
Objetivo: 12/12/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.

OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability

Sin confirmar

CVE: CVE-2021-26828
Proveedor: OpenPLC
Producto: ScadaBR
Incorporada: 03/12/2025
Objetivo: 24/12/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: OpenPLC ScadaBR contains an unrestricted upload of file with dangerous type vulnerability that allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.

Android Framework Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2025-48572
Proveedor: Android
Producto: Framework
Incorporada: 02/12/2025
Objetivo: 23/12/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Android Framework contains an unspecified vulnerability that allows for privilege escalation.

Android Framework Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2025-48633
Proveedor: Android
Producto: Framework
Incorporada: 02/12/2025
Objetivo: 23/12/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Android Framework contains an unspecified vulnerability that allows for information disclosure.

OpenPLC ScadaBR Cross-site Scripting Vulnerability

Sin confirmar

CVE: CVE-2021-26829
Proveedor: OpenPLC
Producto: ScadaBR
Incorporada: 28/11/2025
Objetivo: 19/12/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: OpenPLC ScadaBR contains a cross-site scripting vulnerability via system_settings.shtm.

Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability

Sin confirmar

CVE: CVE-2025-61757
Proveedor: Oracle
Producto: Fusion Middleware
Incorporada: 21/11/2025
Objetivo: 12/12/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager.

Google Chromium V8 Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2025-13223
Proveedor: Google
Producto: Chromium V8
Incorporada: 19/11/2025
Objetivo: 10/12/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Google Chromium V8 contains a type confusion vulnerability that allows for heap corruption.

Fortinet FortiWeb OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2025-58034
Proveedor: Fortinet
Producto: FortiWeb
Incorporada: 18/11/2025
Objetivo: 25/11/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.

Fortinet FortiWeb Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2025-64446
Proveedor: Fortinet
Producto: FortiWeb
Incorporada: 14/11/2025
Objetivo: 21/11/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.

Gladinet Triofox Improper Access Control Vulnerability

Sin confirmar

CVE: CVE-2025-12480
Proveedor: Gladinet
Producto: Triofox
Incorporada: 12/11/2025
Objetivo: 03/12/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Gladinet Triofox contains an improper access control vulnerability that allows access to initial setup pages even after setup is complete.

Microsoft Windows Race Condition Vulnerability

Sin confirmar

CVE: CVE-2025-62215
Proveedor: Microsoft
Producto: Windows
Incorporada: 12/11/2025
Objetivo: 03/12/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Kernel contains a race condition vulnerability that allows a local attacker with low-level privileges to escalate privileges. Successful exploitation of this vulnerability could enable the attacker to gain SYSTEM-level access.

WatchGuard Firebox Out-of-Bounds Write Vulnerability

Sin confirmar

CVE: CVE-2025-9242
Proveedor: WatchGuard
Producto: Firebox
Incorporada: 12/11/2025
Objetivo: 03/12/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: WatchGuard Firebox contains an out-of-bounds write vulnerability in the OS iked process that may allow a remote unauthenticated attacker to execute arbitrary code.

Samsung Mobile Devices Out-of-Bounds Write Vulnerability

Sin confirmar

CVE: CVE-2025-21042
Proveedor: Samsung
Producto: Mobile Devices
Incorporada: 10/11/2025
Objetivo: 01/12/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so. This vulnerability could allow remote attackers to execute arbitrary code.

Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability

Sin confirmar

CVE: CVE-2025-11371
Proveedor: Gladinet
Producto: CentreStack and Triofox
Incorporada: 04/11/2025
Objetivo: 25/11/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files.

CWP Control Web Panel OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2025-48703
Proveedor: CWP
Producto: Control Web Panel
Incorporada: 04/11/2025
Objetivo: 25/11/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.

XWiki Platform Eval Injection Vulnerability

Sin confirmar

CVE: CVE-2025-24893
Proveedor: XWiki
Producto: Platform
Incorporada: 30/10/2025
Objetivo: 20/11/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a request to SolrSearch.

Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability

Sin confirmar

CVE: CVE-2025-41244
Proveedor: Broadcom
Producto: VMware Aria Operations and VMware Tools
Incorporada: 30/10/2025
Objetivo: 20/11/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

Dassault Systèmes DELMIA Apriso Code Injection Vulnerability

Sin confirmar

CVE: CVE-2025-6204
Proveedor: Dassault Systèmes
Producto: DELMIA Apriso
Incorporada: 28/10/2025
Objetivo: 18/11/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Dassault Systèmes DELMIA Apriso contains a code injection vulnerability that could allow an attacker to execute arbitrary code.

Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability

Sin confirmar

CVE: CVE-2025-6205
Proveedor: Dassault Systèmes
Producto: DELMIA Apriso
Incorporada: 28/10/2025
Objetivo: 18/11/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Dassault Systèmes DELMIA Apriso contains a missing authorization vulnerability that could allow an attacker to gain privileged access to the application.

Adobe Commerce and Magento Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2025-54236
Proveedor: Adobe
Producto: Commerce and Magento
Incorporada: 24/10/2025
Objetivo: 14/11/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.

Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability

Sin confirmar

CVE: CVE-2025-59287
Proveedor: Microsoft
Producto: Windows
Incorporada: 24/10/2025
Objetivo: 14/11/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerability that allows for remote code execution.

Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability

Sin confirmar

CVE: CVE-2025-61932
Proveedor: Motex
Producto: LANSCOPE Endpoint Manager
Incorporada: 22/10/2025
Objetivo: 12/11/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Motex LANSCOPE Endpoint Manager contains an improper verification of source of a communication channel vulnerability allowing an attacker to execute arbitrary code by sending specially crafted packets.

Apple Multiple Products Unspecified Vulnerability

Sin confirmar

CVE: CVE-2022-48503
Proveedor: Apple
Producto: Multiple Products
Incorporada: 20/10/2025
Objetivo: 10/11/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple macOS, iOS, tvOS, Safari, and watchOS contain an unspecified vulnerability in JavaScriptCore that when processing web content may lead to arbitrary code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability

Sin confirmar

CVE: CVE-2025-2746
Proveedor: Kentico
Producto: Xperience CMS
Incorporada: 20/10/2025
Objetivo: 10/11/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.

Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability

Sin confirmar

CVE: CVE-2025-2747
Proveedor: Kentico
Producto: Xperience CMS
Incorporada: 20/10/2025
Objetivo: 10/11/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.

Microsoft Windows SMB Client Improper Access Control Vulnerability

Sin confirmar

CVE: CVE-2025-33073
Proveedor: Microsoft
Producto: Windows
Incorporada: 20/10/2025
Objetivo: 10/11/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate.

Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability

Confirmado

CVE: CVE-2025-61884
Proveedor: Oracle
Producto: E-Business Suite
Incorporada: 20/10/2025
Objetivo: 10/11/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication.

Adobe Experience Manager Forms Code Execution Vulnerability

Sin confirmar

CVE: CVE-2025-54253
Proveedor: Adobe
Producto: Experience Manager (AEM) Forms
Incorporada: 15/10/2025
Objetivo: 05/11/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution.

SKYSEA Client View Improper Authentication Vulnerability

Sin confirmar

CVE: CVE-2016-7836
Proveedor: SKYSEA
Producto: Client View
Incorporada: 14/10/2025
Objetivo: 04/11/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: SKYSEA Client View contains an improper authentication vulnerability that allows remote code execution via a flaw in processing authentication on the TCP connection with the management console program.

Microsoft Windows Untrusted Pointer Dereference Vulnerability

Sin confirmar

CVE: CVE-2025-24990
Proveedor: Microsoft
Producto: Windows
Incorporada: 14/10/2025
Objetivo: 04/11/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Agere Modem Driver contains an untrusted pointer dereference vulnerability that allows for privilege escalation. An attacker who successfully exploited this vulnerability could gain administrator privileges.

IGEL OS Use of a Key Past its Expiration Date Vulnerability

Sin confirmar

CVE: CVE-2025-47827
Proveedor: IGEL
Producto: IGEL OS
Incorporada: 14/10/2025
Objetivo: 04/11/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: IGEL OS contains a use of a key past its expiration date vulnerability that allows for Secure Boot bypass. The igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.

Microsoft Windows Improper Access Control Vulnerability

Sin confirmar

CVE: CVE-2025-59230
Proveedor: Microsoft
Producto: Windows
Incorporada: 14/10/2025
Objetivo: 04/11/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows contains an improper access control vulnerability in Windows Remote Access Connection Manager which could allow an authorized attacker to elevate privileges locally.

Grafana Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2021-43798
Proveedor: Grafana Labs
Producto: Grafana
Incorporada: 09/10/2025
Objetivo: 30/10/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Grafana contains a path traversal vulnerability that could allow access to local files.

Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

Sin confirmar

CVE: CVE-2025-27915
Proveedor: Synacor
Producto: Zimbra Collaboration Suite (ZCS)
Incorporada: 07/10/2025
Objetivo: 28/10/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.

Mozilla Multiple Products Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2010-3765
Proveedor: Mozilla
Producto: Multiple Products
Incorporada: 06/10/2025
Objetivo: 27/10/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Mozilla Firefox, SeaMonkey, and Thunderbird contain an unspecified vulnerability when JavaScript is enabled. This allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption.

Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2010-3962
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 06/10/2025
Objetivo: 27/10/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Internet Explorer contains an uninitialized memory corruption vulnerability that could allow for remote code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Microsoft Windows Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2011-3402
Proveedor: Microsoft
Producto: Windows
Incorporada: 06/10/2025
Objetivo: 27/10/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers that allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page.

Microsoft Windows Out-of-Bounds Write Vulnerability

Sin confirmar

CVE: CVE-2013-3918
Proveedor: Microsoft
Producto: Windows
Incorporada: 06/10/2025
Objetivo: 27/10/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows contains an out-of-bounds write vulnerability in the InformationCardSigninHelper Class ActiveX control, icardie.dll. An attacker could exploit the vulnerability by constructing a specially crafted webpage. When a user views the webpage, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Linux Kernel Heap Out-of-Bounds Write Vulnerability

Sin confirmar

CVE: CVE-2021-22555
Proveedor: Linux
Producto: Kernel
Incorporada: 06/10/2025
Objetivo: 27/10/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Linux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space.

Microsoft Windows Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2021-43226
Proveedor: Microsoft
Producto: Windows
Incorporada: 06/10/2025
Objetivo: 27/10/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Common Log File System Driver contains a privilege escalation vulnerability that could allow a local, privileged attacker to bypass certain security mechanisms.

Oracle E-Business Suite Unspecified Vulnerability

Confirmado

CVE: CVE-2025-61882
Proveedor: Oracle
Producto: E-Business Suite
Incorporada: 06/10/2025
Objetivo: 27/10/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing.

GNU Bash OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2014-6278
Proveedor: GNU
Producto: GNU Bash
Incorporada: 02/10/2025
Objetivo: 23/10/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment.

Juniper ScreenOS Improper Authentication Vulnerability

Sin confirmar

CVE: CVE-2015-7755
Proveedor: Juniper
Producto: ScreenOS
Incorporada: 02/10/2025
Objetivo: 23/10/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Juniper ScreenOS contains an improper authentication vulnerability that could allow unauthorized remote administrative access to the device.

Jenkins Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2017-1000353
Proveedor: Jenkins
Producto: Jenkins
Incorporada: 02/10/2025
Objetivo: 23/10/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism.

Samsung Mobile Devices Out-of-Bounds Write Vulnerability

Sin confirmar

CVE: CVE-2025-21043
Proveedor: Samsung
Producto: Mobile Devices
Incorporada: 02/10/2025
Objetivo: 23/10/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so which allows remote attackers to execute arbitrary code.

Smartbedded Meteobridge Command Injection Vulnerability

Sin confirmar

CVE: CVE-2025-4008
Proveedor: Smartbedded
Producto: Meteobridge
Incorporada: 02/10/2025
Objetivo: 23/10/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Smartbedded Meteobridge contains a command injection vulnerability that could allow remote unauthenticated attackers to gain arbitrary command execution with elevated privileges (root) on affected devices.

Adminer Server-Side Request Forgery Vulnerability

Sin confirmar

CVE: CVE-2021-21311
Proveedor: Adminer
Producto: Adminer
Incorporada: 29/09/2025
Objetivo: 20/10/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Adminer contains a server-side request forgery vulnerability that, when exploited, allows a remote attacker to obtain potentially sensitive information.

Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability

Confirmado

CVE: CVE-2025-10035
Proveedor: Fortra
Producto: GoAnywhere MFT
Incorporada: 29/09/2025
Objetivo: 20/10/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2025-20352
Proveedor: Cisco
Producto: IOS and IOS XE
Incorporada: 29/09/2025
Objetivo: 20/10/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system.

Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability

Sin confirmar

CVE: CVE-2025-32463
Proveedor: Sudo
Producto: Sudo
Incorporada: 29/09/2025
Objetivo: 20/10/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.

Libraesva Email Security Gateway Command Injection Vulnerability

Sin confirmar

CVE: CVE-2025-59689
Proveedor: Libraesva
Producto: Email Security Gateway
Incorporada: 29/09/2025
Objetivo: 20/10/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Libraesva Email Security Gateway (ESG) contains a command injection vulnerability which allows command injection via a compressed e-mail attachment.

Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2025-20333
Proveedor: Cisco
Producto: Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense
Incorporada: 25/09/2025
Objetivo: 26/09/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Descripción CISA: Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution. This vulnerability could be chained with CVE-2025-20362.

Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability

Sin confirmar

CVE: CVE-2025-20362
Proveedor: Cisco
Producto: Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense
Incorporada: 25/09/2025
Objetivo: 26/09/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Descripción CISA: Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333.

Google Chromium V8 Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2025-10585
Proveedor: Google
Producto: Chromium V8
Incorporada: 23/09/2025
Objetivo: 14/10/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Google Chromium contains a type confusion vulnerability in the V8 JavaScript and WebAssembly engine.

Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability

Sin confirmar

CVE: CVE-2025-5086
Proveedor: Dassault Systèmes
Producto: DELMIA Apriso
Incorporada: 11/09/2025
Objetivo: 02/10/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Dassault Systèmes DELMIA Apriso contains a deserialization of untrusted data vulnerability that could lead to a remote code execution.

Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability

Sin confirmar

CVE: CVE-2025-38352
Proveedor: Linux
Producto: Kernel
Incorporada: 04/09/2025
Objetivo: 25/09/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Linux kernel contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that has a high impact on confidentiality, integrity, and availability.

Android Runtime Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2025-48543
Proveedor: Android
Producto: Runtime
Incorporada: 04/09/2025
Objetivo: 25/09/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Android Runtime contains a use-after-free vulnerability potentially allowing a chrome sandbox escape leading to local privilege escalation.

Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability

Sin confirmar

CVE: CVE-2025-53690
Proveedor: Sitecore
Producto: Multiple Products
Incorporada: 04/09/2025
Objetivo: 25/09/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution.

TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability

Sin confirmar

CVE: CVE-2023-50224
Proveedor: TP-Link
Producto: TL-WR841N
Incorporada: 03/09/2025
Objetivo: 24/09/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2025-9377
Proveedor: TP-Link
Producto: Multiple Routers
Incorporada: 03/09/2025
Objetivo: 24/09/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: TP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability

Sin confirmar

CVE: CVE-2020-24363
Proveedor: TP-Link
Producto: TL-WA855RE
Incorporada: 02/09/2025
Objetivo: 23/09/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: TP-link TL-WA855RE contains a missing authentication for critical function vulnerability. This vulnerability could allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Meta Platforms WhatsApp Incorrect Authorization Vulnerability

Sin confirmar

CVE: CVE-2025-55177
Proveedor: Meta Platforms
Producto: WhatsApp
Incorporada: 02/09/2025
Objetivo: 23/09/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Meta Platforms WhatsApp contains an incorrect authorization vulnerability due to an incomplete authorization of linked device synchronization messages. This vulnerability could allow an unrelated user to trigger processing of content from an arbitrary URL on a target’s device.

Sangoma FreePBX Authentication Bypass Vulnerability

Sin confirmar

CVE: CVE-2025-57819
Proveedor: Sangoma
Producto: FreePBX
Incorporada: 29/08/2025
Objetivo: 19/09/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.

Citrix NetScaler Memory Overflow Vulnerability

Sin confirmar

CVE: CVE-2025-7775
Proveedor: Citrix
Producto: NetScaler
Incorporada: 26/08/2025
Objetivo: 28/08/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Citrix NetScaler ADC and NetScaler Gateway contain a memory overflow vulnerability that could allow for remote code execution and/or denial of service.

Citrix Session Recording Improper Privilege Management Vulnerability

Sin confirmar

CVE: CVE-2024-8068
Proveedor: Citrix
Producto: Session Recording
Incorporada: 25/08/2025
Objetivo: 15/09/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Citrix Session Recording contains an improper privilege management vulnerability that could allow for privilege escalation to NetworkService Account access. An attacker must be an authenticated user in the same Windows Active Directory domain as the session recording server domain.

Citrix Session Recording Deserialization of Untrusted Data Vulnerability

Sin confirmar

CVE: CVE-2024-8069
Proveedor: Citrix
Producto: Session Recording
Incorporada: 25/08/2025
Objetivo: 15/09/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Citrix Session Recording contains a deserialization of untrusted data vulnerability that allows limited remote code execution with privilege of a NetworkService Account access. Attacker must be an authenticated user on the same intranet as the session recording server.

Git Link Following Vulnerability

Sin confirmar

CVE: CVE-2025-48384
Proveedor: Git
Producto: Git
Incorporada: 25/08/2025
Objetivo: 15/09/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Git contains a link following vulnerability that stems from Git’s inconsistent handling of carriage return characters in configuration files.

Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability

Sin confirmar

CVE: CVE-2025-43300
Proveedor: Apple
Producto: iOS, iPadOS, and macOS
Incorporada: 21/08/2025
Objetivo: 11/09/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple iOS, iPadOS, and macOS contain an out-of-bounds write vulnerability in the Image I/O framework.

Trend Micro Apex One OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2025-54948
Proveedor: Trend Micro
Producto: Apex One
Incorporada: 18/08/2025
Objetivo: 08/09/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Trend Micro Apex One Management Console (on-premise) contains an OS command injection vulnerability that could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.

N-able N-Central Insecure Deserialization Vulnerability

Sin confirmar

CVE: CVE-2025-8875
Proveedor: N-able
Producto: N-Central
Incorporada: 13/08/2025
Objetivo: 20/08/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: N-able N-Central contains an insecure deserialization vulnerability that could lead to command execution.

N-able N-Central Command Injection Vulnerability

Sin confirmar

CVE: CVE-2025-8876
Proveedor: N-able
Producto: N-Central
Incorporada: 13/08/2025
Objetivo: 20/08/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: N-able N-Central contains a command injection vulnerability via improper sanitization of user input.

Microsoft Office Excel Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2007-0671
Proveedor: Microsoft
Producto: Office
Incorporada: 12/08/2025
Objetivo: 02/09/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Office Excel contains a remote code execution vulnerability that can be exploited when a specially crafted Excel file is opened. This malicious file could be delivered as an email attachment or hosted on a malicious website. An attacker could leverage this vulnerability by creating a specially crafted Excel file, which, when opened, allowing an attacker to execute remote code on the affected system.

Microsoft Internet Explorer Resource Management Errors Vulnerability

Sin confirmar

CVE: CVE-2013-3893
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 12/08/2025
Objetivo: 02/09/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Internet Explorer contains a memory corruption vulnerability that allows for remote code execution. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

RARLAB WinRAR Path Traversal Vulnerability

Confirmado

CVE: CVE-2025-8088
Proveedor: RARLAB
Producto: WinRAR
Incorporada: 12/08/2025
Objetivo: 02/09/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: RARLAB WinRAR contains a path traversal vulnerability affecting the Windows version of WinRAR. This vulnerability could allow an attacker to execute arbitrary code by crafting malicious archive files.

D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability

Sin confirmar

CVE: CVE-2020-25078
Proveedor: D-Link
Producto: DCS-2530L and DCS-2670L Devices
Incorporada: 05/08/2025
Objetivo: 26/08/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: D-Link DCS-2530L and DCS-2670L devices contains an unspecified vulnerability that could allow for remote administrator password disclosure. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability

Sin confirmar

CVE: CVE-2020-25079
Proveedor: D-Link
Producto: DCS-2530L and DCS-2670L Devices
Incorporada: 05/08/2025
Objetivo: 26/08/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: D-Link DCS-2530L and DCS-2670L devices contains a command injection vulnerability in the cgi-bin/ddns_enc.cgi. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

D-Link DNR-322L Download of Code Without Integrity Check Vulnerability

Sin confirmar

CVE: CVE-2022-40799
Proveedor: D-Link
Producto: DNR-322L
Incorporada: 05/08/2025
Objetivo: 26/08/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: D-Link DNR-322L contains a download of code without integrity check vulnerability that could allow an authenticated attacker to execute OS level commands on the device. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability

Sin confirmar

CVE: CVE-2023-2533
Proveedor: PaperCut
Producto: NG/MF
Incorporada: 28/07/2025
Objetivo: 18/08/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: PaperCut NG/MF contains a cross-site request forgery (CSRF) vulnerability, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code.

Cisco Identity Services Engine Injection Vulnerability

Sin confirmar

CVE: CVE-2025-20281
Proveedor: Cisco
Producto: Identity Services Engine
Incorporada: 28/07/2025
Objetivo: 18/08/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device.

Cisco Identity Services Engine Injection Vulnerability

Sin confirmar

CVE: CVE-2025-20337
Proveedor: Cisco
Producto: Identity Services Engine
Incorporada: 28/07/2025
Objetivo: 18/08/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device.

SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability

Sin confirmar

CVE: CVE-2025-2775
Proveedor: SysAid
Producto: SysAid On-Prem
Incorporada: 22/07/2025
Objetivo: 12/08/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.

SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability

Sin confirmar

CVE: CVE-2025-2776
Proveedor: SysAid
Producto: SysAid On-Prem
Incorporada: 22/07/2025
Objetivo: 12/08/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.

Microsoft SharePoint Code Injection Vulnerability

Confirmado

CVE: CVE-2025-49704
Proveedor: Microsoft
Producto: SharePoint
Incorporada: 22/07/2025
Objetivo: 23/07/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Descripción CISA: Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.

Microsoft SharePoint Improper Authentication Vulnerability

Confirmado

CVE: CVE-2025-49706
Proveedor: Microsoft
Producto: SharePoint
Incorporada: 22/07/2025
Objetivo: 23/07/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Descripción CISA: Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706.

CrushFTP Unprotected Alternate Channel Vulnerability

Sin confirmar

CVE: CVE-2025-54309
Proveedor: CrushFTP
Producto: CrushFTP
Incorporada: 22/07/2025
Objetivo: 12/08/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS.

Google Chromium ANGLE and GPU Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2025-6558
Proveedor: Google
Producto: Chromium
Incorporada: 22/07/2025
Objetivo: 12/08/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Google Chromium contains an improper input validation vulnerability in ANGLE and GPU. This vulnerability could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Confirmado

CVE: CVE-2025-53770
Proveedor: Microsoft
Producto: SharePoint
Incorporada: 20/07/2025
Objetivo: 21/07/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Descripción CISA: Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.

Fortinet FortiWeb SQL Injection Vulnerability

Sin confirmar

CVE: CVE-2025-25257
Proveedor: Fortinet
Producto: FortiWeb
Incorporada: 18/07/2025
Objetivo: 08/08/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability

Sin confirmar

CVE: CVE-2025-47812
Proveedor: Wing FTP Server
Producto: Wing FTP Server
Incorporada: 14/07/2025
Objetivo: 04/08/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Wing FTP Server contains an improper neutralization of null byte or NUL character vulnerability that can allow injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default).

Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability

Confirmado

CVE: CVE-2025-5777
Proveedor: Citrix
Producto: NetScaler ADC and Gateway
Incorporada: 10/07/2025
Objetivo: 11/07/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.

Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2014-3931
Proveedor: Looking Glass
Producto: Multi-Router Looking Glass (MRLG)
Incorporada: 07/07/2025
Objetivo: 28/07/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Multi-Router Looking Glass (MRLG) contains a buffer overflow vulnerability that could allow remote attackers to cause an arbitrary memory write and memory corruption.

PHPMailer Command Injection Vulnerability

Sin confirmar

CVE: CVE-2016-10033
Proveedor: PHP
Producto: PHPMailer
Incorporada: 07/07/2025
Objetivo: 28/07/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.

Rails Ruby on Rails Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2019-5418
Proveedor: Rails
Producto: Ruby on Rails
Incorporada: 07/07/2025
Objetivo: 28/07/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents.

Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability

Sin confirmar

CVE: CVE-2019-9621
Proveedor: Synacor
Producto: Zimbra Collaboration Suite (ZCS)
Incorporada: 07/07/2025
Objetivo: 28/07/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery (SSRF) vulnerability via the ProxyServlet component.

Google Chromium V8 Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2025-6554
Proveedor: Google
Producto: Chromium V8
Incorporada: 02/07/2025
Objetivo: 23/07/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Google Chromium V8 contains a type confusion vulnerability that could allow a remote attacker to perform arbitrary read/write via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability

Sin confirmar

CVE: CVE-2025-48927
Proveedor: TeleMessage
Producto: TM SGNL
Incorporada: 01/07/2025
Objetivo: 22/07/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: TeleMessage TM SGNL contains an initialization of a resource with an insecure default vulnerability. This vulnerability relies on how the Spring Boot Actuator is configured with an exposed heap dump endpoint at a /heapdump URI.

TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability

Sin confirmar

CVE: CVE-2025-48928
Proveedor: TeleMessage
Producto: TM SGNL
Incorporada: 01/07/2025
Objetivo: 22/07/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: TeleMessage TM SGNL contains an exposure of core dump file to an unauthorized control sphere Vulnerability. This vulnerability is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump.

Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2025-6543
Proveedor: Citrix
Producto: NetScaler ADC and Gateway
Incorporada: 30/06/2025
Objetivo: 21/07/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Citrix NetScaler ADC and Gateway contain a buffer overflow vulnerability leading to unintended control flow and Denial of Service. NetScaler must be configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.

Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability

Confirmado

CVE: CVE-2019-6693
Proveedor: Fortinet
Producto: FortiOS
Incorporada: 25/06/2025
Objetivo: 16/07/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key.

D-Link DIR-859 Router Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2024-0769
Proveedor: D-Link
Producto: DIR-859 Router
Incorporada: 25/06/2025
Objetivo: 16/07/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: D-Link DIR-859 routers contain a path traversal vulnerability in the file /hedwig.cgi of the component HTTP POST Request Handler. Manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml allows for the leakage of session data potentially enabling privilege escalation and unauthorized control of the device. This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.

AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability

Sin confirmar

CVE: CVE-2024-54085
Proveedor: AMI
Producto: MegaRAC SPx
Incorporada: 25/06/2025
Objetivo: 16/07/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: AMI MegaRAC SPx contains an authentication bypass by spoofing vulnerability in the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.

Linux Kernel Improper Ownership Management Vulnerability

Sin confirmar

CVE: CVE-2023-0386
Proveedor: Linux
Producto: Kernel
Incorporada: 17/06/2025
Objetivo: 08/07/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Linux Kernel contains an improper ownership management vulnerability, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.

TP-Link Multiple Routers Command Injection Vulnerability

Sin confirmar

CVE: CVE-2023-33538
Proveedor: TP-Link
Producto: Multiple Routers
Incorporada: 16/06/2025
Objetivo: 07/07/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Apple Multiple Products Unspecified Vulnerability

Sin confirmar

CVE: CVE-2025-43200
Proveedor: Apple
Producto: Multiple Products
Incorporada: 16/06/2025
Objetivo: 07/07/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple iOS, iPadOS, macOS, watchOS, and visionOS, contain an unspecified vulnerability when processing a maliciously crafted photo or video shared via an iCloud Link.

Wazuh Server Deserialization of Untrusted Data Vulnerability

Sin confirmar

CVE: CVE-2025-24016
Proveedor: Wazuh
Producto: Wazuh Server
Incorporada: 10/06/2025
Objetivo: 01/07/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Wazuh contains a deserialization of untrusted data vulnerability that allows for remote code execution on Wazuh servers.

Microsoft Windows External Control of File Name or Path Vulnerability

Sin confirmar

CVE: CVE-2025-33053
Proveedor: Microsoft
Producto: Windows
Incorporada: 10/06/2025
Objetivo: 01/07/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files.

RoundCube Webmail Cross-Site Scripting Vulnerability

Sin confirmar

CVE: CVE-2024-42009
Proveedor: Roundcube
Producto: Webmail
Incorporada: 09/06/2025
Objetivo: 30/06/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability

Sin confirmar

CVE: CVE-2025-32433
Proveedor: Erlang
Producto: Erlang/OTP
Incorporada: 09/06/2025
Objetivo: 30/06/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. This could allow an attacker to execute arbitrary commands without valid credentials, potentially leading to unauthenticated remote code execution (RCE). By exploiting a flaw in how SSH protocol messages are handled, a malicious actor could gain unauthorized access to affected systems. This vulnerability could affect various products that implement Erlang/OTP SSH server, including—but not limited to—Cisco, NetApp, and SUSE.

Google Chromium V8 Out-of-Bounds Read and Write Vulnerability

Sin confirmar

CVE: CVE-2025-5419
Proveedor: Google
Producto: Chromium V8
Incorporada: 05/06/2025
Objetivo: 26/06/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Google Chromium V8 contains an out-of-bounds read and write vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability

Sin confirmar

CVE: CVE-2025-21479
Proveedor: Qualcomm
Producto: Multiple Chipsets
Incorporada: 03/06/2025
Objetivo: 24/06/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability

Sin confirmar

CVE: CVE-2025-21480
Proveedor: Qualcomm
Producto: Multiple Chipsets
Incorporada: 03/06/2025
Objetivo: 24/06/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

Qualcomm Multiple Chipsets Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2025-27038
Proveedor: Qualcomm
Producto: Multiple Chipsets
Incorporada: 03/06/2025
Objetivo: 24/06/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Multiple Qualcomm chipsets contain a use-after-free vulnerability. This vulnerability allows for memory corruption while rendering graphics using Adreno GPU drivers in Chrome.

ASUS Routers Improper Authentication Vulnerability

Sin confirmar

CVE: CVE-2021-32030
Proveedor: ASUS
Producto: Routers
Incorporada: 02/06/2025
Objetivo: 23/06/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: ASUS Lyra Mini and ASUS GT-AC2900 devices contain an improper authentication vulnerability that allows an attacker to gain unauthorized access to the administrative interface. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

ASUS RT-AX55 Routers OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2023-39780
Proveedor: ASUS
Producto: RT-AX55 Routers
Incorporada: 02/06/2025
Objetivo: 23/06/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: ASUS RT-AX55 devices contain an OS command injection vulnerability that could allow a remote, authenticated attacker to execute arbitrary commands. As represented by CVE-2023-41346.

Craft CMS Code Injection Vulnerability

Sin confirmar

CVE: CVE-2024-56145
Proveedor: Craft CMS
Producto: Craft CMS
Incorporada: 02/06/2025
Objetivo: 23/06/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Craft CMS contains a code injection vulnerability. Users with affected versions are vulnerable to remote code execution if their php.ini configuration has `register_argc_argv` enabled.

Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability

Sin confirmar

CVE: CVE-2025-35939
Proveedor: Craft CMS
Producto: Craft CMS
Incorporada: 02/06/2025
Objetivo: 23/06/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated client to introduce arbitrary values, such as PHP code, to a known local file location on the server. This vulnerability could be chained with CVE-2024-58136 as represented by CVE-2025-32432.

ConnectWise ScreenConnect Improper Authentication Vulnerability

Sin confirmar

CVE: CVE-2025-3935
Proveedor: ConnectWise
Producto: ScreenConnect
Incorporada: 02/06/2025
Objetivo: 23/06/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attack, which could allow remote code execution if machine keys are compromised.

Samsung MagicINFO 9 Server Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2025-4632
Proveedor: Samsung
Producto: MagicINFO 9 Server
Incorporada: 22/05/2025
Objetivo: 12/06/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Samsung MagicINFO 9 Server contains a path traversal vulnerability that allows an attacker to write arbitrary file as system authority.

ZKTeco BioTime Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2023-38950
Proveedor: ZKTeco
Producto: BioTime
Incorporada: 19/05/2025
Objetivo: 09/06/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: ZKTeco BioTime contains a path traversal vulnerability in the iclock API that allows an unauthenticated attacker to read arbitrary files via supplying a crafted payload.

MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability

Sin confirmar

CVE: CVE-2024-11182
Proveedor: MDaemon
Producto: Email Server
Incorporada: 19/05/2025
Objetivo: 09/06/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: MDaemon Email Server contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to load arbitrary JavaScript code via an HTML e-mail message.

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Sin confirmar

CVE: CVE-2024-27443
Proveedor: Synacor
Producto: Zimbra Collaboration Suite (ZCS)
Incorporada: 19/05/2025
Objetivo: 09/06/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Zimbra Collaboration contains a cross-site scripting (XSS) vulnerability in the CalendarInvite feature of the Zimbra webmail classic user interface. An attacker can exploit this vulnerability via an email message containing a crafted calendar header, leading to the execution of arbitrary JavaScript code.

Srimax Output Messenger Directory Traversal Vulnerability

Sin confirmar

CVE: CVE-2025-27920
Proveedor: Srimax
Producto: Output Messenger
Incorporada: 19/05/2025
Objetivo: 09/06/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Srimax Output Messenger contains a directory traversal vulnerability that allows an attacker to access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access.

Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability

Sin confirmar

CVE: CVE-2025-4427
Proveedor: Ivanti
Producto: Endpoint Manager Mobile (EPMM)
Incorporada: 19/05/2025
Objetivo: 09/06/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Ivanti Endpoint Manager Mobile (EPMM) contains an authentication bypass vulnerability in the API component that allows an attacker to access protected resources without proper credentials via crafted API requests. This vulnerability results from an insecure implementation of the Spring Framework open-source library.

Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

Sin confirmar

CVE: CVE-2025-4428
Proveedor: Ivanti
Producto: Endpoint Manager Mobile (EPMM)
Incorporada: 19/05/2025
Objetivo: 09/06/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in the API component that allows an authenticated attacker to remotely execute arbitrary code via crafted API requests. This vulnerability results from an insecure implementation of the Hibernate Validator open-source library, as represented by CVE-2025-35036.

DrayTek Vigor Routers OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2024-12987
Proveedor: DrayTek
Producto: Vigor Routers
Incorporada: 15/05/2025
Objetivo: 05/06/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component web management interface.

SAP NetWeaver Deserialization Vulnerability

Confirmado

CVE: CVE-2025-42999
Proveedor: SAP
Producto: NetWeaver
Incorporada: 15/05/2025
Objetivo: 05/06/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content.

Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2025-32756
Proveedor: Fortinet
Producto: Multiple Products
Incorporada: 14/05/2025
Objetivo: 04/06/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests.

Microsoft Windows Scripting Engine Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2025-30397
Proveedor: Microsoft
Producto: Windows
Incorporada: 13/05/2025
Objetivo: 03/06/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Scripting Engine contains a type confusion vulnerability that allows an unauthorized attacker to execute code over a network via a specially crafted URL.

Microsoft Windows DWM Core Library Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2025-30400
Proveedor: Microsoft
Producto: Windows
Incorporada: 13/05/2025
Objetivo: 03/06/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows DWM Core Library contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.

Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2025-32701
Proveedor: Microsoft
Producto: Windows
Incorporada: 13/05/2025
Objetivo: 03/06/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.

Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2025-32706
Proveedor: Microsoft
Producto: Windows
Incorporada: 13/05/2025
Objetivo: 03/06/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Common Log File System (CLFS) Driver contains a heap-based buffer overflow vulnerability that allows an authorized attacker to elevate privileges locally.

Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2025-32709
Proveedor: Microsoft
Producto: Windows
Incorporada: 13/05/2025
Objetivo: 03/06/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to escalate privileges to administrator.

TeleMessage TM SGNL Hidden Functionality Vulnerability

Sin confirmar

CVE: CVE-2025-47729
Proveedor: TeleMessage
Producto: TM SGNL
Incorporada: 12/05/2025
Objetivo: 02/06/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: TeleMessage TM SGNL contains a hidden functionality vulnerability in which the archiving backend holds cleartext copies of messages from TM SGNL application users.

GeoVision Devices OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2024-11120
Proveedor: GeoVision
Producto: Multiple Devices
Incorporada: 07/05/2025
Objetivo: 28/05/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

GeoVision Devices OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2024-6047
Proveedor: GeoVision
Producto: Multiple Devices
Incorporada: 07/05/2025
Objetivo: 28/05/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

FreeType Out-of-Bounds Write Vulnerability

Sin confirmar

CVE: CVE-2025-27363
Proveedor: FreeType
Producto: FreeType
Incorporada: 06/05/2025
Objetivo: 27/05/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: FreeType contains an out-of-bounds write vulnerability when attempting to parse font subglyph structures related to TrueType GX and variable font files that may allow for arbitrary code execution.

Langflow Missing Authentication Vulnerability

Confirmado

CVE: CVE-2025-3248
Proveedor: Langflow
Producto: Langflow
Incorporada: 05/05/2025
Objetivo: 26/05/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests.

Yiiframework Yii Improper Protection of Alternate Path Vulnerability

Sin confirmar

CVE: CVE-2024-58136
Proveedor: Yiiframework
Producto: Yii
Incorporada: 02/05/2025
Objetivo: 23/05/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Yii Framework contains an improper protection of alternate path vulnerability that may allow a remote attacker to execute arbitrary code. This vulnerability could affect other products that implement Yii, including—but not limited to—Craft CMS, as represented by CVE-2025-32432.

Commvault Command Center Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2025-34028
Proveedor: Commvault
Producto: Command Center
Incorporada: 02/05/2025
Objetivo: 23/05/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code.

SonicWall SMA100 Appliances OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2023-44221
Proveedor: SonicWall
Producto: SMA100 Appliances
Incorporada: 01/05/2025
Objetivo: 22/05/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user.

Apache HTTP Server Improper Escaping of Output Vulnerability

Sin confirmar

CVE: CVE-2024-38475
Proveedor: Apache
Producto: HTTP Server
Incorporada: 01/05/2025
Objetivo: 22/05/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure.

SAP NetWeaver Unrestricted File Upload Vulnerability

Confirmado

CVE: CVE-2025-31324
Proveedor: SAP
Producto: NetWeaver
Incorporada: 29/04/2025
Objetivo: 20/05/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.

Broadcom Brocade Fabric OS Code Injection Vulnerability

Sin confirmar

CVE: CVE-2025-1976
Proveedor: Broadcom
Producto: Brocade Fabric OS
Incorporada: 28/04/2025
Objetivo: 19/05/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Broadcom Brocade Fabric OS contains a code injection vulnerability that allows a local user with administrative privileges to execute arbitrary code with full root privileges.

Commvault Web Server Unspecified Vulnerability

Sin confirmar

CVE: CVE-2025-3928
Proveedor: Commvault
Producto: Web Server
Incorporada: 28/04/2025
Objetivo: 19/05/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells.

Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2025-42599
Proveedor: Qualitia
Producto: Active! Mail
Incorporada: 28/04/2025
Objetivo: 19/05/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Qualitia Active! Mail contains a stack-based buffer overflow vulnerability that allows a remote, unauthenticated attacker to execute arbitrary or trigger a denial-of-service via a specially crafted request.

Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability

Sin confirmar

CVE: CVE-2025-24054
Proveedor: Microsoft
Producto: Windows
Incorporada: 17/04/2025
Objetivo: 08/05/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network.

Apple Multiple Products Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2025-31200
Proveedor: Apple
Producto: Multiple Products
Incorporada: 17/04/2025
Objetivo: 08/05/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple iOS, iPadOS, macOS, and other Apple products contain a memory corruption vulnerability that allows for code execution when processing an audio stream in a maliciously crafted media file.

Apple Multiple Products Arbitrary Read and Write Vulnerability

Sin confirmar

CVE: CVE-2025-31201
Proveedor: Apple
Producto: Multiple Products
Incorporada: 17/04/2025
Objetivo: 08/05/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Pointer Authentication.

SonicWall SMA100 Appliances OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2021-20035
Proveedor: SonicWall
Producto: SMA100 Appliances
Incorporada: 16/04/2025
Objetivo: 07/05/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution.

Linux Kernel Out-of-Bounds Read Vulnerability

Sin confirmar

CVE: CVE-2024-53150
Proveedor: Linux
Producto: Kernel
Incorporada: 09/04/2025
Objetivo: 30/04/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Linux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain potentially sensitive information.

Linux Kernel Out-of-Bounds Access Vulnerability

Sin confirmar

CVE: CVE-2024-53197
Proveedor: Linux
Producto: Kernel
Incorporada: 09/04/2025
Objetivo: 30/04/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Linux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the system to use a malicious USB device to potentially manipulate system memory, escalate privileges, or execute arbitrary code.

Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability

Confirmado

CVE: CVE-2025-29824
Proveedor: Microsoft
Producto: Windows
Incorporada: 08/04/2025
Objetivo: 29/04/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.

Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability

Sin confirmar

CVE: CVE-2025-30406
Proveedor: Gladinet
Producto: CentreStack
Incorporada: 08/04/2025
Objetivo: 29/04/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Gladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys used for ViewState integrity verification. Successful exploitation allows an attacker to forge ViewState payloads for server-side deserialization, allowing for remote code execution.

CrushFTP Authentication Bypass Vulnerability

Confirmado

CVE: CVE-2025-31161
Proveedor: CrushFTP
Producto: CrushFTP
Incorporada: 07/04/2025
Objetivo: 28/04/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise.

Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

Confirmado

CVE: CVE-2025-22457
Proveedor: Ivanti
Producto: Connect Secure, Policy Secure, and ZTA Gateways
Incorporada: 04/04/2025
Objetivo: 11/04/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations as set forth in the CISA instructions linked below.
Descripción CISA: Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution.

Apache Tomcat Path Equivalence Vulnerability

Sin confirmar

CVE: CVE-2025-24813
Proveedor: Apache
Producto: Tomcat
Incorporada: 01/04/2025
Objetivo: 22/04/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486.

Cisco Smart Licensing Utility Static Credential Vulnerability

Sin confirmar

CVE: CVE-2024-20439
Proveedor: Cisco
Producto: Smart Licensing Utility
Incorporada: 31/03/2025
Objetivo: 21/04/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials.

Google Chromium Mojo Sandbox Escape Vulnerability

Sin confirmar

CVE: CVE-2025-2783
Proveedor: Google
Producto: Chromium Mojo
Incorporada: 27/03/2025
Objetivo: 17/04/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability

Sin confirmar

CVE: CVE-2019-9874
Proveedor: Sitecore
Producto: CMS and Experience Platform (XP)
Incorporada: 26/03/2025
Objetivo: 16/04/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.

Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability

Sin confirmar

CVE: CVE-2019-9875
Proveedor: Sitecore
Producto: CMS and Experience Platform (XP)
Incorporada: 26/03/2025
Objetivo: 16/04/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.

reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability

Sin confirmar

CVE: CVE-2025-30154
Proveedor: reviewdog
Producto: action-setup GitHub Action
Incorporada: 24/03/2025
Objetivo: 14/04/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs.

SAP NetWeaver Directory Traversal Vulnerability

Sin confirmar

CVE: CVE-2017-12637
Proveedor: SAP
Producto: NetWeaver
Incorporada: 19/03/2025
Objetivo: 09/04/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.

NAKIVO Backup and Replication Absolute Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2024-48248
Proveedor: NAKIVO
Producto: Backup and Replication
Incorporada: 19/03/2025
Objetivo: 09/04/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: NAKIVO Backup and Replication contains an absolute path traversal vulnerability that enables an attacker to read arbitrary files.

Edimax IC-7100 IP Camera OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2025-1316
Proveedor: Edimax
Producto: IC-7100 IP Camera
Incorporada: 19/03/2025
Objetivo: 09/04/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Edimax IC-7100 IP camera contains an OS command injection vulnerability due to improper input sanitization that allows an attacker to achieve remote code execution via specially crafted requests. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

Confirmado

CVE: CVE-2025-24472
Proveedor: Fortinet
Producto: FortiOS and FortiProxy
Incorporada: 18/03/2025
Objetivo: 08/04/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.

tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability

Sin confirmar

CVE: CVE-2025-30066
Proveedor: tj-actions
Producto: changed-files GitHub Action
Incorporada: 18/03/2025
Objetivo: 08/04/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys.

Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability

Sin confirmar

CVE: CVE-2025-21590
Proveedor: Juniper
Producto: Junos OS
Incorporada: 13/03/2025
Objetivo: 03/04/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Juniper Junos OS contains an improper isolation or compartmentalization vulnerability. This vulnerability could allows a local attacker with high privileges to inject arbitrary code.

Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability

Sin confirmar

CVE: CVE-2025-24201
Proveedor: Apple
Producto: Multiple Products
Incorporada: 13/03/2025
Objetivo: 03/04/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple iOS, iPadOS, macOS, and other Apple products contain an out-of-bounds write vulnerability in WebKit that may allow maliciously crafted web content to break out of Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Microsoft Windows Win32k Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2025-24983
Proveedor: Microsoft
Producto: Windows
Incorporada: 11/03/2025
Objetivo: 01/04/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.

Microsoft Windows NTFS Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2025-24984
Proveedor: Microsoft
Producto: Windows
Incorporada: 11/03/2025
Objetivo: 01/04/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory.

Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability

Sin confirmar

CVE: CVE-2025-24985
Proveedor: Microsoft
Producto: Windows
Incorporada: 11/03/2025
Objetivo: 01/04/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Fast FAT File System Driver contains an integer overflow or wraparound vulnerability that allows an unauthorized attacker to execute code locally.

Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability

Sin confirmar

CVE: CVE-2025-24991
Proveedor: Microsoft
Producto: Windows
Incorporada: 11/03/2025
Objetivo: 01/04/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows New Technology File System (NTFS) contains an out-of-bounds read vulnerability that allows an authorized attacker to disclose information locally.

Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2025-24993
Proveedor: Microsoft
Producto: Windows
Incorporada: 11/03/2025
Objetivo: 01/04/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows New Technology File System (NTFS) contains a heap-based buffer overflow vulnerability that allows an unauthorized attacker to execute code locally.

Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability

Confirmado

CVE: CVE-2025-26633
Proveedor: Microsoft
Producto: Windows
Incorporada: 11/03/2025
Objetivo: 01/04/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally.

Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2024-13159
Proveedor: Ivanti
Producto: Endpoint Manager (EPM)
Incorporada: 10/03/2025
Objetivo: 31/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.

Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2024-13160
Proveedor: Ivanti
Producto: Endpoint Manager (EPM)
Incorporada: 10/03/2025
Objetivo: 31/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.

Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2024-13161
Proveedor: Ivanti
Producto: Endpoint Manager (EPM)
Incorporada: 10/03/2025
Objetivo: 31/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.

Advantive VeraCore Unrestricted File Upload Vulnerability

Sin confirmar

CVE: CVE-2024-57968
Proveedor: Advantive
Producto: VeraCore
Incorporada: 10/03/2025
Objetivo: 31/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Advantive VeraCore contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload files to unintended folders via upload.apsx.

Advantive VeraCore SQL Injection Vulnerability

Sin confirmar

CVE: CVE-2025-25181
Proveedor: Advantive
Producto: VeraCore
Incorporada: 10/03/2025
Objetivo: 31/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Advantive VeraCore contains a SQL injection vulnerability in timeoutWarning.asp that allows a remote attacker to execute arbitrary SQL commands via the PmSess1 parameter.

Linux Kernel Use of Uninitialized Resource Vulnerability

Sin confirmar

CVE: CVE-2024-50302
Proveedor: Linux
Producto: Kernel
Incorporada: 04/03/2025
Objetivo: 25/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: The Linux kernel contains a use of uninitialized resource vulnerability that allows an attacker to leak kernel memory via a specially crafted HID report.

VMware ESXi and Workstation TOCTOU Race Condition Vulnerability

Sin confirmar

CVE: CVE-2025-22224
Proveedor: VMware
Producto: ESXi and Workstation
Incorporada: 04/03/2025
Objetivo: 25/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: VMware ESXi and Workstation contain a time-of-check time-of-use (TOCTOU) race condition vulnerability that leads to an out-of-bounds write. Successful exploitation enables an attacker with local administrative privileges on a virtual machine to execute code as the virtual machine's VMX process running on the host.

VMware ESXi Arbitrary Write Vulnerability

Confirmado

CVE: CVE-2025-22225
Proveedor: VMware
Producto: ESXi
Incorporada: 04/03/2025
Objetivo: 25/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: VMware ESXi contains an arbitrary write vulnerability. Successful exploitation allows an attacker with privileges within the VMX process to trigger an arbitrary kernel write leading to an escape of the sandbox.

VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2025-22226
Proveedor: VMware
Producto: ESXi, Workstation, and Fusion
Incorporada: 04/03/2025
Objetivo: 25/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. Successful exploitation allows an attacker with administrative privileges to a virtual machine to leak memory from the vmx process.

Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability

Confirmado

CVE: CVE-2018-8639
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/03/2025
Objetivo: 24/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Win32k contains an improper resource shutdown or release vulnerability that allows for local, authenticated privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.

Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability

Sin confirmar

CVE: CVE-2022-43769
Proveedor: Hitachi Vantara
Producto: Pentaho Business Analytics (BA) Server
Incorporada: 03/03/2025
Objetivo: 24/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Hitachi Vantara Pentaho BA Server contains a special element injection vulnerability that allows an attacker to inject Spring templates into properties files, allowing for arbitrary command execution.

Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability

Sin confirmar

CVE: CVE-2022-43939
Proveedor: Hitachi Vantara
Producto: Pentaho Business Analytics (BA) Server
Incorporada: 03/03/2025
Objetivo: 24/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Hitachi Vantara Pentaho BA Server contains a use of non-canonical URL paths for authorization decisions vulnerability that enables an attacker to bypass authorization.

Cisco Small Business RV Series Routers Command Injection Vulnerability

Sin confirmar

CVE: CVE-2023-20118
Proveedor: Cisco
Producto: Small Business RV Series Routers
Incorporada: 03/03/2025
Objetivo: 24/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful exploitation could allow an authenticated, remote attacker to gain root-level privileges and access unauthorized data.

Progress WhatsUp Gold Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2024-4885
Proveedor: Progress
Producto: WhatsUp Gold
Incorporada: 03/03/2025
Objetivo: 24/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Progress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacker to achieve remote code execution.

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Sin confirmar

CVE: CVE-2023-34192
Proveedor: Synacor
Producto: Zimbra Collaboration Suite (ZCS)
Incorporada: 25/02/2025
Objetivo: 18/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability that allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.

Microsoft Partner Center Improper Access Control Vulnerability

Sin confirmar

CVE: CVE-2024-49035
Proveedor: Microsoft
Producto: Partner Center
Incorporada: 25/02/2025
Objetivo: 18/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Partner Center contains an improper access control vulnerability that allows an attacker to escalate privileges.

Adobe ColdFusion Deserialization Vulnerability

Sin confirmar

CVE: CVE-2017-3066
Proveedor: Adobe
Producto: ColdFusion
Incorporada: 24/02/2025
Objetivo: 17/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.

Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability

Sin confirmar

CVE: CVE-2024-20953
Proveedor: Oracle
Producto: Agile Product Lifecycle Management (PLM)
Incorporada: 24/02/2025
Objetivo: 17/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Oracle Agile Product Lifecycle Management (PLM) contains a deserialization vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the system.

Microsoft Power Pages Improper Access Control Vulnerability

Sin confirmar

CVE: CVE-2025-24989
Proveedor: Microsoft
Producto: Power Pages
Incorporada: 21/02/2025
Objetivo: 14/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Power Pages contains an improper access control vulnerability that allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control.

Palo Alto Networks PAN-OS File Read Vulnerability

Sin confirmar

CVE: CVE-2025-0111
Proveedor: Palo Alto Networks
Producto: PAN-OS
Incorporada: 20/02/2025
Objetivo: 13/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Palo Alto Networks PAN-OS contains an external control of file name or path vulnerability. Successful exploitation enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user.

Craft CMS Code Injection Vulnerability

Sin confirmar

CVE: CVE-2025-23209
Proveedor: Craft CMS
Producto: Craft CMS
Incorporada: 20/02/2025
Objetivo: 13/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution.

SonicWall SonicOS SSLVPN Improper Authentication Vulnerability

Confirmado

CVE: CVE-2024-53704
Proveedor: SonicWall
Producto: SonicOS
Incorporada: 18/02/2025
Objetivo: 11/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: SonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication.

Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

Sin confirmar

CVE: CVE-2025-0108
Proveedor: Palo Alto Networks
Producto: PAN-OS
Incorporada: 18/02/2025
Objetivo: 11/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. This vulnerability allows an unauthenticated attacker with network access to the management web interface to bypass the authentication normally required and invoke certain PHP scripts.

SimpleHelp Path Traversal Vulnerability

Confirmado

CVE: CVE-2024-57727
Proveedor: SimpleHelp
Producto: SimpleHelp
Incorporada: 13/02/2025
Objetivo: 06/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files may include server configuration files and hashed user passwords.

Mitel SIP Phones Argument Injection Vulnerability

Sin confirmar

CVE: CVE-2024-41710
Proveedor: Mitel
Producto: SIP Phones
Incorporada: 12/02/2025
Objetivo: 05/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, contain an argument injection vulnerability due to insufficient parameter sanitization during the boot process. Successful exploitation may allow an attacker to execute arbitrary commands within the context of the system.

Apple iOS and iPadOS Incorrect Authorization Vulnerability

Sin confirmar

CVE: CVE-2025-24200
Proveedor: Apple
Producto: iOS and iPadOS
Incorporada: 12/02/2025
Objetivo: 05/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple iOS and iPadOS contains an incorrect authorization vulnerability that allows a physical attacker to disable USB Restricted Mode on a locked device.

Zyxel DSL CPE OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2024-40890
Proveedor: Zyxel
Producto: DSL CPE Devices
Incorporada: 11/02/2025
Objetivo: 04/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
Descripción CISA: Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request.

Zyxel DSL CPE OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2024-40891
Proveedor: Zyxel
Producto: DSL CPE Devices
Incorporada: 11/02/2025
Objetivo: 04/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
Descripción CISA: Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet.

Microsoft Windows Storage Link Following Vulnerability

Sin confirmar

CVE: CVE-2025-21391
Proveedor: Microsoft
Producto: Windows
Incorporada: 11/02/2025
Objetivo: 04/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Storage contains a link following vulnerability that could allow for privilege escalation. This vulnerability could allow an attacker to delete data including data that results in the service being unavailable.

Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2025-21418
Proveedor: Microsoft
Producto: Windows
Incorporada: 11/02/2025
Objetivo: 04/03/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.

Trimble Cityworks Deserialization Vulnerability

Sin confirmar

CVE: CVE-2025-0994
Proveedor: Trimble
Producto: Cityworks
Incorporada: 07/02/2025
Objetivo: 28/02/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Trimble Cityworks contains a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer's Microsoft Internet Information Services (IIS) web server.

Sophos XG Firewall Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2020-15069
Proveedor: Sophos
Producto: XG Firewall
Incorporada: 06/02/2025
Objetivo: 27/02/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Sophos XG Firewall contains a buffer overflow vulnerability that allows for remote code execution via the "HTTP/S bookmark" feature.

CyberoamOS (CROS) SQL Injection Vulnerability

Sin confirmar

CVE: CVE-2020-29574
Proveedor: Sophos
Producto: CyberoamOS
Incorporada: 06/02/2025
Objetivo: 27/02/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Descripción CISA: CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely.

Dante Discovery Process Control Vulnerability

Sin confirmar

CVE: CVE-2022-23748
Proveedor: Audinate
Producto: Dante Discovery
Incorporada: 06/02/2025
Objetivo: 27/02/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Dante Discovery contains a process control vulnerability in mDNSResponder.exe that all allows for a DLL sideloading attack. A local attacker can leverage this vulnerability in the Dante Application Library to execute arbitrary code.

Microsoft Outlook Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2024-21413
Proveedor: Microsoft
Producto: Office Outlook
Incorporada: 06/02/2025
Objetivo: 27/02/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode.

7-Zip Mark of the Web Bypass Vulnerability

Sin confirmar

CVE: CVE-2025-0411
Proveedor: 7-Zip
Producto: 7-Zip
Incorporada: 06/02/2025
Objetivo: 27/02/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: 7-Zip contains a protection mechanism failure vulnerability that allows remote attackers to bypass the Mark-of-the-Web security feature to execute arbitrary code in the context of the current user.

Linux Kernel Out-of-Bounds Write Vulnerability

Sin confirmar

CVE: CVE-2024-53104
Proveedor: Linux
Producto: Kernel
Incorporada: 05/02/2025
Objetivo: 26/02/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Linux kernel contains an out-of-bounds write vulnerability in the uvc_parse_streaming component of the USB Video Class (UVC) driver that could allow for physical escalation of privilege.

Paessler PRTG Network Monitor Local File Inclusion Vulnerability

Sin confirmar

CVE: CVE-2018-19410
Proveedor: Paessler
Producto: PRTG Network Monitor
Incorporada: 04/02/2025
Objetivo: 25/02/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Paessler PRTG Network Monitor contains a local file inclusion vulnerability that allows a remote, unauthenticated attacker to create users with read-write privileges (including administrator).

Paessler PRTG Network Monitor OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2018-9276
Proveedor: Paessler
Producto: PRTG Network Monitor
Incorporada: 04/02/2025
Objetivo: 25/02/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Paessler PRTG Network Monitor contains an OS command injection vulnerability that allows an attacker with administrative privileges to execute commands via the PRTG System Administrator web console.

Microsoft .NET Framework Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2024-29059
Proveedor: Microsoft
Producto: .NET Framework
Incorporada: 04/02/2025
Objetivo: 25/02/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef URI to an attacker, ultimately enabling remote code execution.

Apache OFBiz Forced Browsing Vulnerability

Sin confirmar

CVE: CVE-2024-45195
Proveedor: Apache
Producto: OFBiz
Incorporada: 04/02/2025
Objetivo: 25/02/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access.

Apple Multiple Products Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2025-24085
Proveedor: Apple
Producto: Multiple Products
Incorporada: 29/01/2025
Objetivo: 19/02/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple iOS, macOS, and other Apple products contain a user-after-free vulnerability that could allow a malicious application to elevate privileges.

SonicWall SMA1000 Appliances Deserialization Vulnerability

Confirmado

CVE: CVE-2025-23006
Proveedor: SonicWall
Producto: SMA1000 Appliances
Incorporada: 24/01/2025
Objetivo: 14/02/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbitrary OS commands.

JQuery Cross-Site Scripting (XSS) Vulnerability

Sin confirmar

CVE: CVE-2020-11023
Proveedor: JQuery
Producto: JQuery
Incorporada: 23/01/2025
Objetivo: 13/02/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser.

Aviatrix Controllers OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2024-50603
Proveedor: Aviatrix
Producto: Controllers
Incorporada: 16/01/2025
Objetivo: 06/02/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Aviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.

Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

Confirmado

CVE: CVE-2024-55591
Proveedor: Fortinet
Producto: FortiOS and FortiProxy
Incorporada: 14/01/2025
Objetivo: 21/01/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.

Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2025-21333
Proveedor: Microsoft
Producto: Windows
Incorporada: 14/01/2025
Objetivo: 04/02/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Hyper-V NT Kernel Integration VSP contains a heap-based buffer overflow vulnerability that allows a local attacker to gain SYSTEM privileges.

Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2025-21334
Proveedor: Microsoft
Producto: Windows
Incorporada: 14/01/2025
Objetivo: 04/02/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.

Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2025-21335
Proveedor: Microsoft
Producto: Windows
Incorporada: 14/01/2025
Objetivo: 04/02/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.

Qlik Sense HTTP Tunneling Vulnerability

Confirmado

CVE: CVE-2023-48365
Proveedor: Qlik
Producto: Sense
Incorporada: 13/01/2025
Objetivo: 03/02/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.

BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2024-12686
Proveedor: BeyondTrust
Producto: Privileged Remote Access (PRA) and Remote Support (RS)
Incorporada: 13/01/2025
Objetivo: 03/02/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user.

Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

Confirmado

CVE: CVE-2025-0282
Proveedor: Ivanti
Producto: Connect Secure, Policy Secure, and ZTA Gateways
Incorporada: 08/01/2025
Objetivo: 15/01/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.
Descripción CISA: Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.

Oracle WebLogic Server Unspecified Vulnerability

Sin confirmar

CVE: CVE-2020-2883
Proveedor: Oracle
Producto: WebLogic Server
Incorporada: 07/01/2025
Objetivo: 28/01/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an unspecified vulnerability exploitable by an unauthenticated attacker with network access via IIOP or T3.

Mitel MiCollab Path Traversal Vulnerability

Confirmado

CVE: CVE-2024-41713
Proveedor: Mitel
Producto: MiCollab
Incorporada: 07/01/2025
Objetivo: 28/01/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Mitel MiCollab contains a path traversal vulnerability that could allow an attacker to gain unauthorized and unauthenticated access. This vulnerability can be chained with CVE-2024-55550, which allows an unauthenticated, remote attacker to read arbitrary files on the server.

Mitel MiCollab Path Traversal Vulnerability

Confirmado

CVE: CVE-2024-55550
Proveedor: Mitel
Producto: MiCollab
Incorporada: 07/01/2025
Objetivo: 28/01/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Mitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization. This vulnerability can be chained with CVE-2024-41713, which allows an unauthenticated, remote attacker to read arbitrary files on the server.

Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability

Sin confirmar

CVE: CVE-2024-3393
Proveedor: Palo Alto Networks
Producto: PAN-OS
Incorporada: 30/12/2024
Objetivo: 20/01/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability

Sin confirmar

CVE: CVE-2021-44207
Proveedor: Acclaim Systems
Producto: USAHERDS
Incorporada: 23/12/2024
Objetivo: 13/01/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Please contact the product developer for support and vulnerability mitigation.
Descripción CISA: Acclaim Systems USAHERDS contains a hard-coded credentials vulnerability that could allow an attacker to achieve remote code execution on the system that runs the application. The MachineKey must be obtained via a separate vulnerability or other channel.

BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability

Sin confirmar

CVE: CVE-2024-12356
Proveedor: BeyondTrust
Producto: Privileged Remote Access (PRA) and Remote Support (RS)
Incorporada: 19/12/2024
Objetivo: 27/12/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain a command injection vulnerability, which can allow an unauthenticated attacker to inject commands that are run as a site user.

NUUO NVRmini Devices OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2018-14933
Proveedor: NUUO
Producto: NVRmini Devices
Incorporada: 18/12/2024
Objetivo: 08/01/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Descripción CISA: NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.

Reolink Multiple IP Cameras OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2019-11001
Proveedor: Reolink
Producto: Multiple IP Cameras
Incorporada: 18/12/2024
Objetivo: 08/01/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
Descripción CISA: Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W IP cameras contain an authenticated OS command injection vulnerability. This vulnerability allows an authenticated admin to use the "TestEmail" functionality to inject and run OS commands as root.

Reolink RLC-410W IP Camera OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2021-40407
Proveedor: Reolink
Producto: RLC-410W IP Camera
Incorporada: 18/12/2024
Objetivo: 08/01/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
Descripción CISA: Reolink RLC-410W IP cameras contain an authenticated OS command injection vulnerability in the device network settings functionality.

NUUO NVRmini2 Devices Missing Authentication Vulnerability

Sin confirmar

CVE: CVE-2022-23227
Proveedor: NUUO
Producto: NVRmini2 Devices
Incorporada: 18/12/2024
Objetivo: 08/01/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Descripción CISA: NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users.

Cleo Multiple Products Unauthenticated File Upload Vulnerability

Confirmado

CVE: CVE-2024-55956
Proveedor: Cleo
Producto: Multiple Products
Incorporada: 17/12/2024
Objetivo: 07/01/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.

Adobe ColdFusion Improper Access Control Vulnerability

Sin confirmar

CVE: CVE-2024-20767
Proveedor: Adobe
Producto: ColdFusion
Incorporada: 16/12/2024
Objetivo: 06/01/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel.

Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability

Sin confirmar

CVE: CVE-2024-35250
Proveedor: Microsoft
Producto: Windows
Incorporada: 16/12/2024
Objetivo: 06/01/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Kernel-Mode Driver contains an untrusted pointer dereference vulnerability that allows a local attacker to escalate privileges.

Cleo Multiple Products Unrestricted File Upload Vulnerability

Confirmado

CVE: CVE-2024-50623
Proveedor: Cleo
Producto: Multiple Products
Incorporada: 13/12/2024
Objetivo: 03/01/2025
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.

Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2024-49138
Proveedor: Microsoft
Producto: Windows
Incorporada: 10/12/2024
Objetivo: 31/12/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Common Log File System (CLFS) driver contains a heap-based buffer overflow vulnerability that allows a local attacker to escalate privileges.

CyberPanel Incorrect Default Permissions Vulnerability

Confirmado

CVE: CVE-2024-51378
Proveedor: CyberPersons
Producto: CyberPanel
Incorporada: 04/12/2024
Objetivo: 25/12/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property.

North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability

Sin confirmar

CVE: CVE-2023-45727
Proveedor: North Grid
Producto: Proself
Incorporada: 03/12/2024
Objetivo: 24/12/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: North Grid Proself Enterprise/Standard, Gateway, and Mail Sanitize contain an improper restriction of XML External Entity (XXE) reference vulnerability, which could allow a remote, unauthenticated attacker to conduct an XXE attack.

Zyxel Multiple Firewalls Path Traversal Vulnerability

Confirmado

CVE: CVE-2024-11667
Proveedor: Zyxel
Producto: Multiple Firewalls
Incorporada: 03/12/2024
Objetivo: 24/12/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL.

ProjectSend Improper Authentication Vulnerability

Sin confirmar

CVE: CVE-2024-11680
Proveedor: ProjectSend
Producto: ProjectSend
Incorporada: 03/12/2024
Objetivo: 24/12/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.

Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability

Confirmado

CVE: CVE-2023-28461
Proveedor: Array Networks
Producto: AG/vxAG ArrayOS
Incorporada: 25/11/2024
Objetivo: 16/12/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway.

Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability

Sin confirmar

CVE: CVE-2024-21287
Proveedor: Oracle
Producto: Agile Product Lifecycle Management (PLM)
Incorporada: 21/11/2024
Objetivo: 12/12/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Oracle Agile Product Lifecycle Management (PLM) contains an incorrect authorization vulnerability in the Process Extension component of the Software Development Kit. Successful exploitation of this vulnerability may result in unauthenticated file disclosure.

Apple Multiple Products Code Execution Vulnerability

Sin confirmar

CVE: CVE-2024-44308
Proveedor: Apple
Producto: Multiple Products
Incorporada: 21/11/2024
Objetivo: 12/12/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to arbitrary code execution.

Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability

Sin confirmar

CVE: CVE-2024-44309
Proveedor: Apple
Producto: Multiple Products
Incorporada: 21/11/2024
Objetivo: 12/12/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to a cross-site scripting (XSS) attack.

VMware vCenter Server Heap-Based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2024-38812
Proveedor: VMware
Producto: vCenter Server
Incorporada: 20/11/2024
Objetivo: 11/12/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute remote code by sending a specially crafted packet.

VMware vCenter Server Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2024-38813
Proveedor: VMware
Producto: vCenter Server
Incorporada: 20/11/2024
Objetivo: 11/12/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet.

Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability

Confirmado

CVE: CVE-2024-0012
Proveedor: Palo Alto Networks
Producto: PAN-OS
Incorporada: 18/11/2024
Objetivo: 09/12/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, management interface for affected devices should not be exposed to untrusted networks, including the internet.
Descripción CISA: Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators.

Progress Kemp LoadMaster OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2024-1212
Proveedor: Progress
Producto: Kemp LoadMaster
Incorporada: 18/11/2024
Objetivo: 09/12/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution.

Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability

Confirmado

CVE: CVE-2024-9474
Proveedor: Palo Alto Networks
Producto: PAN-OS
Incorporada: 18/11/2024
Objetivo: 09/12/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet.
Descripción CISA: Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators.

Palo Alto Networks Expedition OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2024-9463
Proveedor: Palo Alto Networks
Producto: Expedition
Incorporada: 14/11/2024
Objetivo: 05/12/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.

Palo Alto Networks Expedition SQL Injection Vulnerability

Sin confirmar

CVE: CVE-2024-9465
Proveedor: Palo Alto Networks
Producto: Expedition
Incorporada: 14/11/2024
Objetivo: 05/12/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Palo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.

Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability

Sin confirmar

CVE: CVE-2014-2120
Proveedor: Cisco
Producto: Adaptive Security Appliance (ASA)
Incorporada: 12/11/2024
Objetivo: 03/12/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Cisco Adaptive Security Appliance (ASA) contains a cross-site scripting (XSS) vulnerability in the WebVPN login page. This vulnerability allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.

Atlassian Jira Server and Data Center Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2021-26086
Proveedor: Atlassian
Producto: Jira Server and Data Center
Incorporada: 12/11/2024
Objetivo: 03/12/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Atlassian Jira Server and Data Center contain a path traversal vulnerability that allows a remote attacker to read particular files in the /WEB-INF/web.xml endpoint.

Metabase GeoJSON API Local File Inclusion Vulnerability

Sin confirmar

CVE: CVE-2021-41277
Proveedor: Metabase
Producto: Metabase
Incorporada: 12/11/2024
Objetivo: 03/12/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data.

Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability

Sin confirmar

CVE: CVE-2024-43451
Proveedor: Microsoft
Producto: Windows
Incorporada: 12/11/2024
Objetivo: 03/12/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user.

Microsoft Windows Task Scheduler Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2024-49039
Proveedor: Microsoft
Producto: Windows
Incorporada: 12/11/2024
Objetivo: 03/12/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Task Scheduler contains a privilege escalation vulnerability that can allow an attacker-provided, local application to escalate privileges outside of its AppContainer, and access privileged RPC functions.

Nostromo nhttpd Directory Traversal Vulnerability

Sin confirmar

CVE: CVE-2019-16278
Proveedor: Nostromo
Producto: nhttpd
Incorporada: 07/11/2024
Objetivo: 28/11/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Nostromo nhttpd contains a directory traversal vulnerability in the http_verify() function in a non-chrooted nhttpd server allowing for remote code execution.

Android Framework Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2024-43093
Proveedor: Android
Producto: Framework
Incorporada: 07/11/2024
Objetivo: 28/11/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Android Framework contains an unspecified vulnerability that allows for privilege escalation.

CyberPanel Incorrect Default Permissions Vulnerability

Confirmado

CVE: CVE-2024-51567
Proveedor: CyberPersons
Producto: CyberPanel
Incorporada: 07/11/2024
Objetivo: 28/11/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: CyberPanel contains an incorrect default permissions vulnerability that allows a remote, unauthenticated attacker to execute commands as root.

Palo Alto Networks Expedition Missing Authentication Vulnerability

Sin confirmar

CVE: CVE-2024-5910
Proveedor: Palo Alto Networks
Producto: Expedition
Incorporada: 07/11/2024
Objetivo: 28/11/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data.

PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability

Sin confirmar

CVE: CVE-2024-8956
Proveedor: PTZOptics
Producto: PT30X-SDI/NDI Cameras
Incorporada: 04/11/2024
Objetivo: 25/11/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: PTZOptics PT30X-SDI/NDI cameras contain an insecure direct object reference (IDOR) vulnerability that allows a remote, attacker to bypass authentication for the /cgi-bin/param.cgi CGI script. If combined with CVE-2024-8957, this can lead to remote code execution as root.

PTZOptics PT30X-SDI/NDI Cameras OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2024-8957
Proveedor: PTZOptics
Producto: PT30X-SDI/NDI Cameras
Incorporada: 04/11/2024
Objetivo: 25/11/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: PTZOptics PT30X-SDI/NDI cameras contain an OS command injection vulnerability that allows a remote, authenticated attacker to escalate privileges to root via a crafted payload with the ntp_addr parameter of the /cgi-bin/param.cgi CGI script.

Cisco ASA and FTD Denial-of-Service Vulnerability

Sin confirmar

CVE: CVE-2024-20481
Proveedor: Cisco
Producto: Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
Incorporada: 24/10/2024
Objetivo: 14/11/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a missing release of resource after effective lifetime vulnerability that could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) of the RAVPN service.

RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability

Sin confirmar

CVE: CVE-2024-37383
Proveedor: Roundcube
Producto: Webmail
Incorporada: 24/10/2024
Objetivo: 14/11/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: RoundCube Webmail contains a cross-site scripting (XSS) vulnerability in the handling of SVG animate attributes that allows a remote attacker to run malicious JavaScript code.

Fortinet FortiManager Missing Authentication Vulnerability

Sin confirmar

CVE: CVE-2024-47575
Proveedor: Fortinet
Producto: FortiManager
Incorporada: 23/10/2024
Objetivo: 13/11/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.

Microsoft SharePoint Deserialization Vulnerability

Confirmado

CVE: CVE-2024-38094
Proveedor: Microsoft
Producto: SharePoint
Incorporada: 22/10/2024
Objetivo: 12/11/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft SharePoint contains a deserialization vulnerability that allows for remote code execution.

ScienceLogic SL1 Unspecified Vulnerability

Sin confirmar

CVE: CVE-2024-9537
Proveedor: ScienceLogic
Producto: SL1
Incorporada: 21/10/2024
Objetivo: 11/11/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: ScienceLogic SL1 (formerly EM7) is affected by an unspecified vulnerability involving an unspecified third-party component.

Veeam Backup and Replication Deserialization Vulnerability

Confirmado

CVE: CVE-2024-40711
Proveedor: Veeam
Producto: Backup & Replication
Incorporada: 17/10/2024
Objetivo: 07/11/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution.

SolarWinds Web Help Desk Hardcoded Credential Vulnerability

Sin confirmar

CVE: CVE-2024-28987
Proveedor: SolarWinds
Producto: Web Help Desk
Incorporada: 15/10/2024
Objetivo: 05/11/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: SolarWinds Web Help Desk contains a hardcoded credential vulnerability that could allow a remote, unauthenticated user to access internal functionality and modify data.

Microsoft Windows Kernel TOCTOU Race Condition Vulnerability

Confirmado

CVE: CVE-2024-30088
Proveedor: Microsoft
Producto: Windows
Incorporada: 15/10/2024
Objetivo: 05/11/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Kernel contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that could allow for privilege escalation.

Mozilla Firefox Use-After-Free Vulnerability

Confirmado

CVE: CVE-2024-9680
Proveedor: Mozilla
Producto: Firefox
Incorporada: 15/10/2024
Objetivo: 05/11/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process.

Fortinet Multiple Products Format String Vulnerability

Sin confirmar

CVE: CVE-2024-23113
Proveedor: Fortinet
Producto: Multiple Products
Incorporada: 09/10/2024
Objetivo: 30/10/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.

Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability

Sin confirmar

CVE: CVE-2024-9379
Proveedor: Ivanti
Producto: Cloud Services Appliance (CSA)
Incorporada: 09/10/2024
Objetivo: 30/10/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.
Descripción CISA: Ivanti Cloud Services Appliance (CSA) contains a SQL injection vulnerability in the admin web console in versions prior to 5.0.2, which can allow a remote attacker authenticated as administrator to run arbitrary SQL statements.

Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2024-9380
Proveedor: Ivanti
Producto: Cloud Services Appliance (CSA)
Incorporada: 09/10/2024
Objetivo: 30/10/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.
Descripción CISA: Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin privileges to pass commands to the underlying OS.

Qualcomm Multiple Chipsets Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2024-43047
Proveedor: Qualcomm
Producto: Multiple Chipsets
Incorporada: 08/10/2024
Objetivo: 29/10/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Descripción CISA: Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services while maintaining memory maps of HLOS memory.

Microsoft Windows Management Console Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2024-43572
Proveedor: Microsoft
Producto: Windows
Incorporada: 08/10/2024
Objetivo: 29/10/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Management Console contains unspecified vulnerability that allows for remote code execution.

Microsoft Windows MSHTML Platform Spoofing Vulnerability

Sin confirmar

CVE: CVE-2024-43573
Proveedor: Microsoft
Producto: Windows
Incorporada: 08/10/2024
Objetivo: 29/10/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows MSHTML Platform contains an unspecified spoofing vulnerability which can lead to a loss of confidentiality.

Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability

Sin confirmar

CVE: CVE-2024-45519
Proveedor: Synacor
Producto: Zimbra Collaboration Suite (ZCS)
Incorporada: 03/10/2024
Objetivo: 24/10/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Synacor Zimbra Collaboration Suite (ZCS) contains an unspecified vulnerability in the postjournal service that may allow an unauthenticated user to execute commands.

Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability

Sin confirmar

CVE: CVE-2024-29824
Proveedor: Ivanti
Producto: Endpoint Manager (EPM)
Incorporada: 02/10/2024
Objetivo: 23/10/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Ivanti Endpoint Manager (EPM) contains a SQL injection vulnerability in Core server that allows an unauthenticated attacker within the same network to execute arbitrary code.

SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability

Sin confirmar

CVE: CVE-2019-0344
Proveedor: SAP
Producto: Commerce Cloud
Incorporada: 30/09/2024
Objetivo: 21/10/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: SAP Commerce Cloud (formerly known as Hybris) contains a deserialization of untrusted data vulnerability within the mediaconversion and virtualjdbc extension that allows for code injection.

DrayTek Multiple Vigor Routers OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2020-15415
Proveedor: DrayTek
Producto: Multiple Vigor Routers
Incorporada: 30/09/2024
Objetivo: 21/10/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used.

D-Link DIR-820 Router OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2023-25280
Proveedor: D-Link
Producto: DIR-820 Router
Incorporada: 30/09/2024
Objetivo: 21/10/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Descripción CISA: D-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.

Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability

Sin confirmar

CVE: CVE-2024-7593
Proveedor: Ivanti
Producto: Virtual Traffic Manager
Incorporada: 24/09/2024
Objetivo: 15/10/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Ivanti Virtual Traffic Manager contains an authentication bypass vulnerability that allows a remote, unauthenticated attacker to create a chosen administrator account.

Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2024-8963
Proveedor: Ivanti
Producto: Cloud Services Appliance (CSA)
Incorporada: 19/09/2024
Objetivo: 10/10/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.
Descripción CISA: Ivanti Cloud Services Appliance (CSA) contains a path traversal vulnerability that could allow a remote, unauthenticated attacker to access restricted functionality. If CVE-2024-8963 is used in conjunction with CVE-2024-8190, an attacker could bypass admin authentication and execute arbitrary commands on the appliance.

Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2020-0618
Proveedor: Microsoft
Producto: SQL Server
Incorporada: 18/09/2024
Objetivo: 09/10/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.

Oracle WebLogic Server Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2020-14644
Proveedor: Oracle
Producto: WebLogic Server
Incorporada: 18/09/2024
Objetivo: 09/10/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution.

Oracle ADF Faces Deserialization of Untrusted Data Vulnerability

Sin confirmar

CVE: CVE-2022-21445
Proveedor: Oracle
Producto: ADF Faces
Incorporada: 18/09/2024
Objetivo: 09/10/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Oracle ADF Faces library, included with Oracle JDeveloper Distribution, contains a deserialization of untrusted data vulnerability leading to unauthenticated remote code execution.

Apache HugeGraph-Server Improper Access Control Vulnerability

Sin confirmar

CVE: CVE-2024-27348
Proveedor: Apache
Producto: HugeGraph-Server
Incorporada: 18/09/2024
Objetivo: 09/10/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code.

Adobe Flash Player Incorrect Default Permissions Vulnerability

Sin confirmar

CVE: CVE-2013-0643
Proveedor: Adobe
Producto: Flash Player
Incorporada: 17/09/2024
Objetivo: 08/10/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Descripción CISA: Adobe Flash Player contains an incorrect default permissions vulnerability in the Firefox sandbox that allows a remote attacker to execute arbitrary code via crafted SWF content.

Adobe Flash Player Code Execution Vulnerability

Sin confirmar

CVE: CVE-2013-0648
Proveedor: Adobe
Producto: Flash Player
Incorporada: 17/09/2024
Objetivo: 08/10/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Descripción CISA: Adobe Flash Player contains an unspecified vulnerability in the ExternalInterface ActionScript functionality that allows a remote attacker to execute arbitrary code via crafted SWF content.

Adobe Flash Player Integer Underflow Vulnerablity

Sin confirmar

CVE: CVE-2014-0497
Proveedor: Adobe
Producto: Flash Player
Incorporada: 17/09/2024
Objetivo: 08/10/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Descripción CISA: Adobe Flash Player contains an integer underflow vulnerability that allows a remote attacker to execute arbitrary code.

Adobe Flash Player Double Free Vulnerablity

Sin confirmar

CVE: CVE-2014-0502
Proveedor: Adobe
Producto: Flash Player
Incorporada: 17/09/2024
Objetivo: 08/10/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Descripción CISA: Adobe Flash Player contains a double free vulnerability that allows a remote attacker to execute arbitrary code.

Microsoft Windows MSHTML Platform Spoofing Vulnerability

Sin confirmar

CVE: CVE-2024-43461
Proveedor: Microsoft
Producto: Windows
Incorporada: 16/09/2024
Objetivo: 07/10/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows MSHTML Platform contains a user interface (UI) misrepresentation of critical information vulnerability that allows an attacker to spoof a web page. This vulnerability was exploited in conjunction with CVE-2024-38112.

Progress WhatsUp Gold SQL Injection Vulnerability

Confirmado

CVE: CVE-2024-6670
Proveedor: Progress
Producto: WhatsUp Gold
Incorporada: 16/09/2024
Objetivo: 07/10/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user.

Ivanti Cloud Services Appliance OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2024-8190
Proveedor: Ivanti
Producto: Cloud Services Appliance
Incorporada: 13/09/2024
Objetivo: 04/10/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive future security updates.
Descripción CISA: Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin privileges to pass commands to the underlying OS.

Microsoft Windows Installer Improper Privilege Management Vulnerability

Sin confirmar

CVE: CVE-2024-38014
Proveedor: Microsoft
Producto: Windows
Incorporada: 10/09/2024
Objetivo: 01/10/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Installer contains an improper privilege management vulnerability that could allow an attacker to gain SYSTEM privileges.

Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability

Sin confirmar

CVE: CVE-2024-38217
Proveedor: Microsoft
Producto: Windows
Incorporada: 10/09/2024
Objetivo: 01/10/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Mark of the Web (MOTW) contains a protection mechanism failure vulnerability that allows an attacker to bypass MOTW-based defenses. This can result in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging.

Microsoft Publisher Protection Mechanism Failure Vulnerability

Sin confirmar

CVE: CVE-2024-38226
Proveedor: Microsoft
Producto: Publisher
Incorporada: 10/09/2024
Objetivo: 01/10/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Publisher contains a protection mechanism failure vulnerability that allows attacker to bypass Office macro policies used to block untrusted or malicious files.

ImageMagick Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2016-3714
Proveedor: ImageMagick
Producto: ImageMagick
Incorporada: 09/09/2024
Objetivo: 30/09/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: ImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This allows a remote attacker to execute arbitrary code via shell metacharacters in a crafted image.

Linux Kernel PIE Stack Buffer Corruption Vulnerability

Confirmado

CVE: CVE-2017-1000253
Proveedor: Linux
Producto: Kernel
Incorporada: 09/09/2024
Objetivo: 30/09/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Linux kernel contains a position-independent executable (PIE) stack buffer corruption vulnerability in load_elf_ binary() that allows a local attacker to escalate privileges.

SonicWall SonicOS Improper Access Control Vulnerability

Confirmado

CVE: CVE-2024-40766
Proveedor: SonicWall
Producto: SonicOS
Incorporada: 09/09/2024
Objetivo: 30/09/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash.

Draytek VigorConnect Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2021-20123
Proveedor: DrayTek
Producto: VigorConnect
Incorporada: 03/09/2024
Objetivo: 24/09/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Draytek VigorConnect contains a path traversal vulnerability in the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.

Draytek VigorConnect Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2021-20124
Proveedor: DrayTek
Producto: VigorConnect
Incorporada: 03/09/2024
Objetivo: 24/09/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.

Kingsoft WPS Office Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2024-7262
Proveedor: Kingsoft
Producto: WPS Office
Incorporada: 03/09/2024
Objetivo: 24/09/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Kingsoft WPS Office contains a path traversal vulnerability in promecefpluginhost.exe on Windows that allows an attacker to load an arbitrary Windows library.

Google Chromium V8 Inappropriate Implementation Vulnerability

Sin confirmar

CVE: CVE-2024-7965
Proveedor: Google
Producto: Chromium V8
Incorporada: 28/08/2024
Objetivo: 18/09/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Google Chromium V8 contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Apache OFBiz Incorrect Authorization Vulnerability

Sin confirmar

CVE: CVE-2024-38856
Proveedor: Apache
Producto: OFBiz
Incorporada: 27/08/2024
Objetivo: 17/09/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker.

Google Chromium V8 Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2024-7971
Proveedor: Google
Producto: Chromium V8
Incorporada: 26/08/2024
Objetivo: 16/09/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Versa Director Dangerous File Type Upload Vulnerability

Sin confirmar

CVE: CVE-2024-39717
Proveedor: Versa
Producto: Director
Incorporada: 23/08/2024
Objetivo: 13/09/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: The Versa Director GUI contains an unrestricted upload of file with dangerous type vulnerability that allows administrators with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges to customize the user interface. The “Change Favicon” (Favorite Icon) enables the upload of a .png file, which can be exploited to upload a malicious file with a .png extension disguised as an image.

Microsoft Exchange Server Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2021-31196
Proveedor: Microsoft
Producto: Exchange Server
Incorporada: 21/08/2024
Objetivo: 11/09/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Exchange Server contains an information disclosure vulnerability that allows for remote code execution.

Dahua IP Camera Authentication Bypass Vulnerability

Sin confirmar

CVE: CVE-2021-33044
Proveedor: Dahua
Producto: IP Camera Firmware
Incorporada: 21/08/2024
Objetivo: 11/09/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Dahua IP cameras and related products contain an authentication bypass vulnerability when the NetKeyboard type argument is specified by the client during authentication.

Dahua IP Camera Authentication Bypass Vulnerability

Sin confirmar

CVE: CVE-2021-33045
Proveedor: Dahua
Producto: IP Camera Firmware
Incorporada: 21/08/2024
Objetivo: 11/09/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication.

Linux Kernel Heap-Based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2022-0185
Proveedor: Linux
Producto: Kernel
Incorporada: 21/08/2024
Objetivo: 11/09/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Descripción CISA: Linux kernel contains a heap-based buffer overflow vulnerability in the legacy_parse_param function in the Filesystem Context functionality. This allows an attacker to open a filesystem that does not support the Filesystem Context API and ultimately escalate privileges.

Jenkins Command Line Interface (CLI) Path Traversal Vulnerability

Confirmado

CVE: CVE-2024-23897
Proveedor: Jenkins
Producto: Jenkins Command Line Interface (CLI)
Incorporada: 19/08/2024
Objetivo: 09/09/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution.

SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

Sin confirmar

CVE: CVE-2024-28986
Proveedor: SolarWinds
Producto: Web Help Desk
Incorporada: 15/08/2024
Objetivo: 05/09/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could allow for remote code execution.

Microsoft Windows Kernel Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2024-38106
Proveedor: Microsoft
Producto: Windows
Incorporada: 13/08/2024
Objetivo: 03/09/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Kernel contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Successful exploitation of this vulnerability requires an attacker to win a race condition.

Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2024-38107
Proveedor: Microsoft
Producto: Windows
Incorporada: 13/08/2024
Objetivo: 03/09/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Power Dependency Coordinator contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to obtain SYSTEM privileges.

Microsoft Windows Scripting Engine Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2024-38178
Proveedor: Microsoft
Producto: Windows
Incorporada: 13/08/2024
Objetivo: 03/09/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Scripting Engine contains a memory corruption vulnerability that allows unauthenticated attacker to initiate remote code execution via a specially crafted URL.

Microsoft Project Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2024-38189
Proveedor: Microsoft
Producto: Project
Incorporada: 13/08/2024
Objetivo: 03/09/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Project contains an unspecified vulnerability that allows for remote code execution via a malicious file.

Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2024-38193
Proveedor: Microsoft
Producto: Windows
Incorporada: 13/08/2024
Objetivo: 03/09/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Ancillary Function Driver for WinSock contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.

Microsoft Windows SmartScreen Security Feature Bypass Vulnerability

Sin confirmar

CVE: CVE-2024-38213
Proveedor: Microsoft
Producto: Windows
Incorporada: 13/08/2024
Objetivo: 03/09/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience via a malicious file.

Apache OFBiz Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2024-32113
Proveedor: Apache
Producto: OFBiz
Incorporada: 07/08/2024
Objetivo: 28/08/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution.

Android Kernel Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2024-36971
Proveedor: Android
Producto: Kernel
Incorporada: 07/08/2024
Objetivo: 28/08/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Android contains an unspecified vulnerability in the kernel that allows for remote code execution. This vulnerability resides in Linux Kernel and could impact other products, including but not limited to Android OS.

Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability

Sin confirmar

CVE: CVE-2018-0824
Proveedor: Microsoft
Producto: Windows
Incorporada: 05/08/2024
Objetivo: 26/08/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft COM for Windows contains a deserialization of untrusted data vulnerability that allows for privilege escalation and remote code execution via a specially crafted file or script.

VMware ESXi Authentication Bypass Vulnerability

Confirmado

CVE: CVE-2024-37085
Proveedor: VMware
Producto: ESXi
Incorporada: 30/07/2024
Objetivo: 20/08/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.

Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability

Sin confirmar

CVE: CVE-2023-45249
Proveedor: Acronis
Producto: Cyber Infrastructure (ACI)
Incorporada: 29/07/2024
Objetivo: 19/08/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Acronis Cyber Infrastructure (ACI) allows an unauthenticated user to execute commands remotely due to the use of default passwords.

ServiceNow Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2024-4879
Proveedor: ServiceNow
Producto: Utah, Vancouver, and Washington DC Now Platform
Incorporada: 29/07/2024
Objetivo: 19/08/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: ServiceNow Utah, Vancouver, and Washington DC Now Platform releases contain a jelly template injection vulnerability in UI macros. An unauthenticated user could exploit this vulnerability to execute code remotely.

ServiceNow Incomplete List of Disallowed Inputs Vulnerability

Sin confirmar

CVE: CVE-2024-5217
Proveedor: ServiceNow
Producto: Utah, Vancouver, and Washington DC Now Platform
Incorporada: 29/07/2024
Objetivo: 19/08/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script. An unauthenticated user could exploit this vulnerability to execute code remotely.

Microsoft Internet Explorer Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2012-4792
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 23/07/2024
Objetivo: 13/08/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Microsoft Internet Explorer contains a use-after-free vulnerability that allows a remote attacker to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object.

Twilio Authy Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2024-39891
Proveedor: Twilio
Producto: Authy
Incorporada: 23/07/2024
Objetivo: 13/08/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Twilio Authy contains an information disclosure vulnerability in its API that allows an unauthenticated endpoint to accept a request containing a phone number and respond with information about whether the phone number was registered with Authy.

VMware vCenter Server Incorrect Default File Permissions Vulnerability

Sin confirmar

CVE: CVE-2022-22948
Proveedor: VMware
Producto: vCenter Server
Incorporada: 17/07/2024
Objetivo: 07/08/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: VMware vCenter Server contains an incorrect default file permissions vulnerability that allows a remote, privileged attacker to gain access to sensitive information.

SolarWinds Serv-U Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2024-28995
Proveedor: SolarWinds
Producto: Serv-U
Incorporada: 17/07/2024
Objetivo: 07/08/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: SolarWinds Serv-U contains a path traversal vulnerability that allows an attacker access to read sensitive files on the host machine.

Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability

Sin confirmar

CVE: CVE-2024-34102
Proveedor: Adobe
Producto: Commerce and Magento Open Source
Incorporada: 17/07/2024
Objetivo: 07/08/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution.

OSGeo GeoServer GeoTools Eval Injection Vulnerability

Sin confirmar

CVE: CVE-2024-36401
Proveedor: OSGeo
Producto: GeoServer
Incorporada: 15/07/2024
Objetivo: 05/08/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via specially crafted input.

Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

Confirmado

CVE: CVE-2024-23692
Proveedor: Rejetto
Producto: HTTP File Server
Incorporada: 09/07/2024
Objetivo: 30/07/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Rejetto HTTP File Server contains an improper neutralization of special elements used in a template engine vulnerability. This allows a remote, unauthenticated attacker to execute commands on the affected system by sending a specially crafted HTTP request.

Microsoft Windows Hyper-V Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2024-38080
Proveedor: Microsoft
Producto: Windows
Incorporada: 09/07/2024
Objetivo: 30/07/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Hyper-V contains a privilege escalation vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.

Microsoft Windows MSHTML Platform Spoofing Vulnerability

Sin confirmar

CVE: CVE-2024-38112
Proveedor: Microsoft
Producto: Windows
Incorporada: 09/07/2024
Objetivo: 30/07/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows MSHTML Platform contains a spoofing vulnerability that has a high impact to confidentiality, integrity, and availability.

Cisco NX-OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2024-20399
Proveedor: Cisco
Producto: NX-OS
Incorporada: 02/07/2024
Objetivo: 23/07/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Cisco NX-OS contains a command injection vulnerability in the command line interface (CLI) that could allow an authenticated, local attacker to execute commands as root on the underlying operating system of an affected device.

Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability

Sin confirmar

CVE: CVE-2020-13965
Proveedor: Roundcube
Producto: Webmail
Incorporada: 26/06/2024
Objetivo: 17/07/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate data via a malicious XML attachment.

OSGeo GeoServer JAI-EXT Code Injection Vulnerability

Sin confirmar

CVE: CVE-2022-24816
Proveedor: OSGeo
Producto: JAI-EXT
Incorporada: 26/06/2024
Objetivo: 17/07/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: OSGeo GeoServer JAI-EXT contains a code injection vulnerability that, when programs use jt-jiffle and allow Jiffle script to be provided via network request, could allow remote code execution.

Linux Kernel Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2022-2586
Proveedor: Linux
Producto: Kernel
Incorporada: 26/06/2024
Objetivo: 17/07/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Descripción CISA: Linux Kernel contains a use-after-free vulnerability in the nft_object, allowing local attackers to escalate privileges.

Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability

Confirmado

CVE: CVE-2024-26169
Proveedor: Microsoft
Producto: Windows
Incorporada: 13/06/2024
Objetivo: 04/07/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Descripción CISA: Microsoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.

Android Pixel Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2024-32896
Proveedor: Android
Producto: Pixel
Incorporada: 13/06/2024
Objetivo: 04/07/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Android Pixel contains an unspecified vulnerability in the firmware that allows for privilege escalation.

Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability

Sin confirmar

CVE: CVE-2024-4358
Proveedor: Progress
Producto: Telerik Report Server
Incorporada: 13/06/2024
Objetivo: 04/07/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access.

PHP-CGI OS Command Injection Vulnerability

Confirmado

CVE: CVE-2024-4577
Proveedor: PHP Group
Producto: PHP
Incorporada: 12/06/2024
Objetivo: 03/07/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.

Arm Mali GPU Kernel Driver Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2024-4610
Proveedor: Arm
Producto: Mali GPU Kernel Driver
Incorporada: 12/06/2024
Objetivo: 03/07/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Arm Bifrost and Valhall GPU kernel drivers contain a use-after-free vulnerability that allows a local, non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.

Oracle WebLogic Server OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2017-3506
Proveedor: Oracle
Producto: WebLogic Server
Incorporada: 03/06/2024
Objetivo: 24/06/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document.

Linux Kernel Use-After-Free Vulnerability

Confirmado

CVE: CVE-2024-1086
Proveedor: Linux
Producto: Kernel
Incorporada: 30/05/2024
Objetivo: 20/06/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation.

Check Point Quantum Security Gateways Information Disclosure Vulnerability

Confirmado

CVE: CVE-2024-24919
Proveedor: Check Point
Producto: Quantum Security Gateways
Incorporada: 30/05/2024
Objetivo: 20/06/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. The vulnerability potentially allows an attacker to access information on Gateways connected to the internet, with IPSec VPN, Remote Access VPN or Mobile Access enabled. This issue affects several product lines from Check Point, including CloudGuard Network, Quantum Scalable Chassis, Quantum Security Gateways, and Quantum Spark Appliances.

Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability

Sin confirmar

CVE: CVE-2024-4978
Proveedor: Justice AV Solutions
Producto: Viewer
Incorporada: 29/05/2024
Objetivo: 19/06/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Justice AV Solutions (JAVS) Viewer installer contains a malicious version of ffmpeg.exe, named fffmpeg.exe (SHA256: 421a4ad2615941b177b6ec4ab5e239c14e62af2ab07c6df1741e2a62223223c4). When run, this creates a backdoor connection to a malicious C2 server.

Google Chromium V8 Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2024-5274
Proveedor: Google
Producto: Chromium V8
Incorporada: 28/05/2024
Objetivo: 18/06/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Apache Flink Improper Access Control Vulnerability

Sin confirmar

CVE: CVE-2020-17519
Proveedor: Apache
Producto: Flink
Incorporada: 23/05/2024
Objetivo: 13/06/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apache Flink contains an improper access control vulnerability that allows an attacker to read any file on the local filesystem of the JobManager through its REST interface.

NextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability

Confirmado

CVE: CVE-2023-43208
Proveedor: NextGen Healthcare
Producto: Mirth Connect
Incorporada: 20/05/2024
Objetivo: 10/06/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: NextGen Healthcare Mirth Connect contains a deserialization of untrusted data vulnerability that allows for unauthenticated remote code execution via a specially crafted request.

Google Chromium V8 Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2024-4947
Proveedor: Google
Producto: Chromium V8
Incorporada: 20/05/2024
Objetivo: 10/06/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page.

D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability

Sin confirmar

CVE: CVE-2014-100005
Proveedor: D-Link
Producto: DIR-600 Router
Incorporada: 16/05/2024
Objetivo: 06/06/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Descripción CISA: D-Link DIR-600 routers contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to change router configurations by hijacking an existing administrator session.

D-Link DIR-605 Router Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2021-40655
Proveedor: D-Link
Producto: DIR-605 Router
Incorporada: 16/05/2024
Objetivo: 06/06/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Descripción CISA: D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page.

Google Chromium V8 Out-of-Bounds Memory Write Vulnerability

Sin confirmar

CVE: CVE-2024-4761
Proveedor: Google
Producto: Chromium V8
Incorporada: 16/05/2024
Objetivo: 06/06/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Google Chromium V8 Engine contains an unspecified out-of-bounds memory write vulnerability via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Microsoft Windows MSHTML Platform Security Feature Bypass Vulnerability

Sin confirmar

CVE: CVE-2024-30040
Proveedor: Microsoft
Producto: Windows
Incorporada: 14/05/2024
Objetivo: 04/06/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for a security feature bypass.

Microsoft DWM Core Library Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2024-30051
Proveedor: Microsoft
Producto: DWM Core Library
Incorporada: 14/05/2024
Objetivo: 04/06/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft DWM Core Library contains a privilege escalation vulnerability that allows an attacker to gain SYSTEM privileges.

Google Chromium Visuals Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2024-4671
Proveedor: Google
Producto: Chromium
Incorporada: 13/05/2024
Objetivo: 03/06/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Google Chromium Visuals contains a use-after-free vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

GitLab Community and Enterprise Editions Improper Access Control Vulnerability

Sin confirmar

CVE: CVE-2023-7028
Proveedor: GitLab
Producto: GitLab CE/EE
Incorporada: 01/05/2024
Objetivo: 22/05/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover.

Microsoft SmartScreen Prompt Security Feature Bypass Vulnerability

Sin confirmar

CVE: CVE-2024-29988
Proveedor: Microsoft
Producto: SmartScreen Prompt
Incorporada: 30/04/2024
Objetivo: 21/05/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft SmartScreen Prompt contains a security feature bypass vulnerability that allows an attacker to bypass the Mark of the Web (MotW) feature. This vulnerability can be chained with CVE-2023-38831 and CVE-2024-21412 to execute a malicious file.

Cisco ASA and FTD Denial of Service Vulnerability

Sin confirmar

CVE: CVE-2024-20353
Proveedor: Cisco
Producto: Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
Incorporada: 24/04/2024
Objetivo: 01/05/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an infinite loop vulnerability that can lead to remote denial of service condition.

Cisco ASA and FTD Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2024-20359
Proveedor: Cisco
Producto: Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
Incorporada: 24/04/2024
Objetivo: 01/05/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a privilege escalation vulnerability that can allow local privilege escalation from Administrator to root.

CrushFTP VFS Sandbox Escape Vulnerability

Sin confirmar

CVE: CVE-2024-4040
Proveedor: CrushFTP
Producto: CrushFTP
Incorporada: 24/04/2024
Objetivo: 01/05/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS).

Microsoft Windows Print Spooler Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2022-38028
Proveedor: Microsoft
Producto: Windows
Incorporada: 23/04/2024
Objetivo: 14/05/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Print Spooler service contains a privilege escalation vulnerability. An attacker may modify a JavaScript constraints file and execute it with SYSTEM-level permissions.

Palo Alto Networks PAN-OS Command Injection Vulnerability

Confirmado

CVE: CVE-2024-3400
Proveedor: Palo Alto Networks
Producto: PAN-OS
Incorporada: 12/04/2024
Objetivo: 19/04/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.
Descripción CISA: Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.

D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability

Sin confirmar

CVE: CVE-2024-3272
Proveedor: D-Link
Producto: Multiple NAS Devices
Incorporada: 11/04/2024
Objetivo: 02/05/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Descripción CISA: D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution.

D-Link Multiple NAS Devices Command Injection Vulnerability

Sin confirmar

CVE: CVE-2024-3273
Proveedor: D-Link
Producto: Multiple NAS Devices
Incorporada: 11/04/2024
Objetivo: 02/05/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Descripción CISA: D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution.

Android Pixel Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2024-29745
Proveedor: Android
Producto: Pixel
Incorporada: 04/04/2024
Objetivo: 25/04/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Android Pixel contains an information disclosure vulnerability in the fastboot firmware used to support unlocking, flashing, and locking affected devices.

Android Pixel Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2024-29748
Proveedor: Android
Producto: Pixel
Incorporada: 04/04/2024
Objetivo: 25/04/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Android Pixel contains a privilege escalation vulnerability that allows an attacker to interrupt a factory reset triggered by a device admin app.

Microsoft SharePoint Server Code Injection Vulnerability

Confirmado

CVE: CVE-2023-24955
Proveedor: Microsoft
Producto: SharePoint Server
Incorporada: 26/03/2024
Objetivo: 16/04/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft SharePoint Server contains a code injection vulnerability that allows an authenticated attacker with Site Owner privileges to execute code remotely.

Nice Linear eMerge E3-Series OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2019-7256
Proveedor: Nice
Producto: Linear eMerge E3-Series
Incorporada: 25/03/2024
Objetivo: 15/04/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Contact the vendor for guidance on remediating firmware, per their advisory.
Descripción CISA: Nice Linear eMerge E3-Series contains an OS command injection vulnerability that allows an attacker to conduct remote code execution.

Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability

Confirmado

CVE: CVE-2021-44529
Proveedor: Ivanti
Producto: Endpoint Manager Cloud Service Appliance (EPM CSA)
Incorporada: 25/03/2024
Objetivo: 15/04/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permissions (nobody).

Fortinet FortiClient EMS SQL Injection Vulnerability

Confirmado

CVE: CVE-2023-48788
Proveedor: Fortinet
Producto: FortiClient EMS
Incorporada: 25/03/2024
Objetivo: 15/04/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests.

JetBrains TeamCity Authentication Bypass Vulnerability

Confirmado

CVE: CVE-2024-27198
Proveedor: JetBrains
Producto: TeamCity
Incorporada: 07/03/2024
Objetivo: 28/03/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions.

Apple Multiple Products Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2024-23225
Proveedor: Apple
Producto: Multiple Products
Incorporada: 06/03/2024
Objetivo: 27/03/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS kernel contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections.

Apple Multiple Products Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2024-23296
Proveedor: Apple
Producto: Multiple Products
Incorporada: 06/03/2024
Objetivo: 27/03/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple iOS, iPadOS, macOS, tvOS, and watchOS RTKit contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections.

Sunhillo SureLine OS Command Injection Vulnerablity

Sin confirmar

CVE: CVE-2021-36380
Proveedor: Sunhillo
Producto: SureLine
Incorporada: 05/03/2024
Objetivo: 26/03/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Sunhillo SureLine contains an OS command injection vulnerability that allows an attacker to cause a denial-of-service or utilize the device for persistence on the network via shell metacharacters in ipAddr or dnsAddr in /cgi/networkDiag.cgi.

Android Pixel Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2023-21237
Proveedor: Android
Producto: Pixel
Incorporada: 05/03/2024
Objetivo: 26/03/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Android Pixel contains a vulnerability in the Framework component, where the UI may be misleading or insufficient, providing a means to hide a foreground service notification. This could enable a local attacker to disclose sensitive information.

Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability

Confirmado

CVE: CVE-2024-21338
Proveedor: Microsoft
Producto: Windows
Incorporada: 04/03/2024
Objetivo: 25/03/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.

Microsoft Streaming Service Untrusted Pointer Dereference Vulnerability

Sin confirmar

CVE: CVE-2023-29360
Proveedor: Microsoft
Producto: Streaming Service
Incorporada: 29/02/2024
Objetivo: 21/03/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Streaming Service contains an untrusted pointer dereference vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.

ConnectWise ScreenConnect Authentication Bypass Vulnerability

Confirmado

CVE: CVE-2024-1709
Proveedor: ConnectWise
Producto: ScreenConnect
Incorporada: 22/02/2024
Objetivo: 29/02/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-level account on affected devices.

Cisco ASA and FTD Information Disclosure Vulnerability

Confirmado

CVE: CVE-2020-3259
Proveedor: Cisco
Producto: Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
Incorporada: 15/02/2024
Objetivo: 07/03/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations.

Microsoft Exchange Server Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2024-21410
Proveedor: Microsoft
Producto: Exchange Server
Incorporada: 15/02/2024
Objetivo: 07/03/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.

Microsoft Windows SmartScreen Security Feature Bypass Vulnerability

Sin confirmar

CVE: CVE-2024-21351
Proveedor: Microsoft
Producto: Windows
Incorporada: 13/02/2024
Objetivo: 05/03/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience and inject code to potentially gain code execution, which could lead to some data exposure, lack of system availability, or both.

Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability

Confirmado

CVE: CVE-2024-21412
Proveedor: Microsoft
Producto: Windows
Incorporada: 13/02/2024
Objetivo: 05/03/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass.

Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability

Sin confirmar

CVE: CVE-2023-43770
Proveedor: Roundcube
Producto: Webmail
Incorporada: 12/02/2024
Objetivo: 04/03/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that can lead to information disclosure via malicious link references in plain/text messages.

Fortinet FortiOS Out-of-Bound Write Vulnerability

Confirmado

CVE: CVE-2024-21762
Proveedor: Fortinet
Producto: FortiOS
Incorporada: 09/02/2024
Objetivo: 16/02/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests.

Google Chromium V8 Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2023-4762
Proveedor: Google
Producto: Chromium V8
Incorporada: 06/02/2024
Objetivo: 27/02/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Apple Multiple Products Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2022-48618
Proveedor: Apple
Producto: Multiple Products
Incorporada: 31/01/2024
Objetivo: 21/02/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a time-of-check/time-of-use (TOCTOU) memory corruption vulnerability that allows an attacker with read and write capabilities to bypass Pointer Authentication.

Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability

Confirmado

CVE: CVE-2024-21893
Proveedor: Ivanti
Producto: Connect Secure, Policy Secure, and Neurons
Incorporada: 31/01/2024
Objetivo: 02/02/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication.

Atlassian Confluence Data Center and Server Template Injection Vulnerability

Confirmado

CVE: CVE-2023-22527
Proveedor: Atlassian
Producto: Confluence Data Center and Server
Incorporada: 24/01/2024
Objetivo: 14/02/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution.

Apple Multiple Products WebKit Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2024-23222
Proveedor: Apple
Producto: Multiple Products
Incorporada: 23/01/2024
Objetivo: 13/02/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

VMware vCenter Server Out-of-Bounds Write Vulnerability

Sin confirmar

CVE: CVE-2023-34048
Proveedor: VMware
Producto: vCenter Server
Incorporada: 22/01/2024
Objetivo: 12/02/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol that allows an attacker to conduct remote code execution.

Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability

Confirmado

CVE: CVE-2023-35082
Proveedor: Ivanti
Producto: Endpoint Manager Mobile (EPMM) and MobileIron Core
Incorporada: 18/01/2024
Objetivo: 08/02/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core contain an authentication bypass vulnerability that allows unauthorized users to access restricted functionality or resources of the application.

Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability

Sin confirmar

CVE: CVE-2023-6548
Proveedor: Citrix
Producto: NetScaler ADC and NetScaler Gateway
Incorporada: 17/01/2024
Objetivo: 24/01/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Citrix NetScaler ADC and NetScaler Gateway contain a code injection vulnerability that allows for authenticated remote code execution on the management interface with access to NSIP, CLIP, or SNIP.

Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2023-6549
Proveedor: Citrix
Producto: NetScaler ADC and NetScaler Gateway
Incorporada: 17/01/2024
Objetivo: 07/02/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for a denial-of-service when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.

Google Chromium V8 Out-of-Bounds Memory Access Vulnerability

Sin confirmar

CVE: CVE-2024-0519
Proveedor: Google
Producto: Chromium V8
Incorporada: 17/01/2024
Objetivo: 07/02/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Laravel Deserialization of Untrusted Data Vulnerability

Sin confirmar

CVE: CVE-2018-15133
Proveedor: Laravel
Producto: Laravel Framework
Incorporada: 16/01/2024
Objetivo: 06/02/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Laravel Framework contains a deserialization of untrusted data vulnerability, allowing for remote command execution. This vulnerability may only be exploited if a malicious user has accessed the application encryption key (APP_KEY environment variable).

Microsoft SharePoint Server Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2023-29357
Proveedor: Microsoft
Producto: SharePoint Server
Incorporada: 10/01/2024
Objetivo: 31/01/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them for executing a network attack. This attack bypasses authentication, enabling the attacker to gain administrator privileges.

Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability

Confirmado

CVE: CVE-2023-46805
Proveedor: Ivanti
Producto: Connect Secure and Policy Secure
Incorporada: 10/01/2024
Objetivo: 22/01/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that allows an attacker to access restricted resources by bypassing control checks. This vulnerability can be leveraged in conjunction with CVE-2024-21887, a command injection vulnerability.

Ivanti Connect Secure and Policy Secure Command Injection Vulnerability

Confirmado

CVE: CVE-2024-21887
Proveedor: Ivanti
Producto: Connect Secure and Policy Secure
Incorporada: 10/01/2024
Objetivo: 22/01/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products, which can allow an authenticated administrator to send crafted requests to execute code on affected appliances. This vulnerability can be leveraged in conjunction with CVE-2023-46805, an authenticated bypass issue.

D-Link DSL-2750B Devices Command Injection Vulnerability

Sin confirmar

CVE: CVE-2016-20017
Proveedor: D-Link
Producto: DSL-2750B Devices
Incorporada: 08/01/2024
Objetivo: 29/01/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter.

Joomla! Improper Access Control Vulnerability

Sin confirmar

CVE: CVE-2023-23752
Proveedor: Joomla!
Producto: Joomla!
Incorporada: 08/01/2024
Objetivo: 29/01/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Joomla! contains an improper access control vulnerability that allows unauthorized access to webservice endpoints.

Apache Superset Insecure Default Initialization of Resource Vulnerability

Sin confirmar

CVE: CVE-2023-27524
Proveedor: Apache
Producto: Superset
Incorporada: 08/01/2024
Objetivo: 29/01/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions.

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Confirmado

CVE: CVE-2023-29300
Proveedor: Adobe
Producto: ColdFusion
Incorporada: 08/01/2024
Objetivo: 29/01/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Confirmado

CVE: CVE-2023-38203
Proveedor: Adobe
Producto: ColdFusion
Incorporada: 08/01/2024
Objetivo: 29/01/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.

Apple Multiple Products Code Execution Vulnerability

Sin confirmar

CVE: CVE-2023-41990
Proveedor: Apple
Producto: Multiple Products
Incorporada: 08/01/2024
Objetivo: 29/01/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability that allows for code execution when processing a font file.

Google Chromium WebRTC Heap Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2023-7024
Proveedor: Google
Producto: Chromium WebRTC
Incorporada: 02/01/2024
Objetivo: 23/01/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Google Chromium WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using WebRTC, including but not limited to Google Chrome.

Spreadsheet::ParseExcel Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2023-7101
Proveedor: Spreadsheet::ParseExcel
Producto: Spreadsheet::ParseExcel
Incorporada: 02/01/2024
Objetivo: 23/01/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Spreadsheet::ParseExcel contains a remote code execution vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings within the Excel parsing logic.

QNAP VioStor NVR OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2023-47565
Proveedor: QNAP
Producto: VioStor NVR
Incorporada: 21/12/2023
Objetivo: 11/01/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: QNAP VioStar NVR contains an OS command injection vulnerability that allows authenticated users to execute commands via a network.

FXC AE1021, AE1021PE OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2023-49897
Proveedor: FXC
Producto: AE1021, AE1021PE
Incorporada: 21/12/2023
Objetivo: 11/01/2024
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: FXC AE1021 and AE1021PE contain an OS command injection vulnerability that allows authenticated users to execute commands via a network.

Unitronics Vision PLC and HMI Insecure Default Password Vulnerability

Sin confirmar

CVE: CVE-2023-6448
Proveedor: Unitronics
Producto: Vision PLC and HMI
Incorporada: 11/12/2023
Objetivo: 18/12/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Unitronics Vision Series PLCs and HMIs ship with an insecure default password, which if left unchanged, can allow attackers to execute remote commands.

Qlik Sense HTTP Tunneling Vulnerability

Confirmado

CVE: CVE-2023-41265
Proveedor: Qlik
Producto: Sense
Incorporada: 07/12/2023
Objetivo: 28/12/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Descripción CISA: Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.

Qlik Sense Path Traversal Vulnerability

Confirmado

CVE: CVE-2023-41266
Proveedor: Qlik
Producto: Sense
Incorporada: 07/12/2023
Objetivo: 28/12/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Descripción CISA: Qlik Sense contains a path traversal vulnerability that allows a remote, unauthenticated attacker to create an anonymous session by sending maliciously crafted HTTP requests. This anonymous session could allow the attacker to send further requests to unauthorized endpoints.

Qualcomm Multiple Chipsets Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2022-22071
Proveedor: Qualcomm
Producto: Multiple Chipsets
Incorporada: 05/12/2023
Objetivo: 26/12/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Descripción CISA: Multiple Qualcomm chipsets contain a use-after-free vulnerability when process shell memory is freed using IOCTL munmap call and process initialization is in progress.

Qualcomm Multiple Chipsets Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2023-33063
Proveedor: Qualcomm
Producto: Multiple Chipsets
Incorporada: 05/12/2023
Objetivo: 26/12/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Descripción CISA: Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services during a remote call from HLOS to DSP.

Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability

Sin confirmar

CVE: CVE-2023-33106
Proveedor: Qualcomm
Producto: Multiple Chipsets
Incorporada: 05/12/2023
Objetivo: 26/12/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Descripción CISA: Multiple Qualcomm chipsets contain a use of out-of-range pointer offset vulnerability due to memory corruption in Graphics while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.

Qualcomm Multiple Chipsets Integer Overflow Vulnerability

Sin confirmar

CVE: CVE-2023-33107
Proveedor: Qualcomm
Producto: Multiple Chipsets
Incorporada: 05/12/2023
Objetivo: 26/12/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Descripción CISA: Multiple Qualcomm chipsets contain an integer overflow vulnerability due to memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.

Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability

Sin confirmar

CVE: CVE-2023-42916
Proveedor: Apple
Producto: Multiple Products
Incorporada: 04/12/2023
Objetivo: 25/12/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Descripción CISA: Apple iOS, iPadOS, macOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Apple Multiple Products WebKit Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2023-42917
Proveedor: Apple
Producto: Multiple Products
Incorporada: 04/12/2023
Objetivo: 25/12/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Descripción CISA: Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

ownCloud graphapi Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2023-49103
Proveedor: ownCloud
Producto: ownCloud graphapi
Incorporada: 30/11/2023
Objetivo: 21/12/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: ownCloud graphapi contains an information disclosure vulnerability that can reveal sensitive data stored in phpinfo() via GetPhpInfo.php, including administrative credentials.

Google Skia Integer Overflow Vulnerability

Sin confirmar

CVE: CVE-2023-6345
Proveedor: Google
Producto: Chromium Skia
Incorporada: 30/11/2023
Objetivo: 21/12/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a malicious file. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.

GNU C Library Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2023-4911
Proveedor: GNU
Producto: GNU C Library
Incorporada: 21/11/2023
Objetivo: 12/12/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.

Oracle Fusion Middleware Unspecified Vulnerability

Sin confirmar

CVE: CVE-2020-2551
Proveedor: Oracle
Producto: Fusion Middleware
Incorporada: 16/11/2023
Objetivo: 07/12/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Oracle Fusion Middleware contains an unspecified vulnerability in the WLS Core Components that allows an unauthenticated attacker with network access via IIOP to compromise the WebLogic Server.

Sophos Web Appliance Command Injection Vulnerability

Sin confirmar

CVE: CVE-2023-1671
Proveedor: Sophos
Producto: Web Appliance
Incorporada: 16/11/2023
Objetivo: 07/12/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Sophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution.

Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability

Sin confirmar

CVE: CVE-2023-36584
Proveedor: Microsoft
Producto: Windows
Incorporada: 16/11/2023
Objetivo: 07/12/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.

Microsoft Windows SmartScreen Security Feature Bypass Vulnerability

Sin confirmar

CVE: CVE-2023-36025
Proveedor: Microsoft
Producto: Windows
Incorporada: 14/11/2023
Objetivo: 05/12/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to bypass Windows Defender SmartScreen checks and their associated prompts.

Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2023-36033
Proveedor: Microsoft
Producto: Windows
Incorporada: 14/11/2023
Objetivo: 05/12/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.

Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2023-36036
Proveedor: Microsoft
Producto: Windows
Incorporada: 14/11/2023
Objetivo: 05/12/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Cloud Files Mini Filter Driver contains a privilege escalation vulnerability that could allow an attacker to gain SYSTEM privileges.

Juniper Junos OS EX Series PHP External Variable Modification Vulnerability

Sin confirmar

CVE: CVE-2023-36844
Proveedor: Juniper
Producto: Junos OS
Incorporada: 13/11/2023
Objetivo: 17/11/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Juniper Junos OS on EX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables, leading to partial loss of integrity, which may allow chaining to other vulnerabilities.

Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability

Sin confirmar

CVE: CVE-2023-36845
Proveedor: Juniper
Producto: Junos OS
Incorporada: 13/11/2023
Objetivo: 17/11/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable. Using a crafted request, which sets the variable PHPRC, an attacker is able to modify the PHP execution environment allowing the injection und execution of code.

Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability

Sin confirmar

CVE: CVE-2023-36846
Proveedor: Juniper
Producto: Junos OS
Incorporada: 13/11/2023
Objetivo: 17/11/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.

Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability

Sin confirmar

CVE: CVE-2023-36847
Proveedor: Juniper
Producto: Junos OS
Incorporada: 13/11/2023
Objetivo: 17/11/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Juniper Junos OS on EX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.

Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability

Sin confirmar

CVE: CVE-2023-36851
Proveedor: Juniper
Producto: Junos OS
Incorporada: 13/11/2023
Objetivo: 17/11/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.

SysAid Server Path Traversal Vulnerability

Confirmado

CVE: CVE-2023-47246
Proveedor: SysAid
Producto: SysAid Server
Incorporada: 13/11/2023
Objetivo: 04/12/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: SysAid Server (on-premises version) contains a path traversal vulnerability that leads to code execution.

Service Location Protocol (SLP) Denial-of-Service Vulnerability

Sin confirmar

CVE: CVE-2023-29552
Proveedor: IETF
Producto: Service Location Protocol (SLP)
Incorporada: 08/11/2023
Objetivo: 29/11/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or disable SLP service or port 427/UDP on all systems running on untrusted networks, including those directly connected to the Internet.
Descripción CISA: The Service Location Protocol (SLP) contains a denial-of-service (DoS) vulnerability that could allow an unauthenticated, remote attacker to register services and use spoofed UDP traffic to conduct a denial-of-service (DoS) attack with a significant amplification factor.

Atlassian Confluence Data Center and Server Improper Authorization Vulnerability

Confirmado

CVE: CVE-2023-22518
Proveedor: Atlassian
Producto: Confluence Data Center and Server
Incorporada: 07/11/2023
Objetivo: 28/11/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker. There is no impact on confidentiality since the attacker cannot exfiltrate any data.

Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

Confirmado

CVE: CVE-2023-46604
Proveedor: Apache
Producto: ActiveMQ
Incorporada: 02/11/2023
Objetivo: 23/11/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.

F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability

Confirmado

CVE: CVE-2023-46747
Proveedor: F5
Producto: BIG-IP Configuration Utility
Incorporada: 31/10/2023
Objetivo: 21/11/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748.

F5 BIG-IP Configuration Utility SQL Injection Vulnerability

Sin confirmar

CVE: CVE-2023-46748
Proveedor: F5
Producto: BIG-IP Configuration Utility
Incorporada: 31/10/2023
Objetivo: 21/11/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747.

Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability

Sin confirmar

CVE: CVE-2023-5631
Proveedor: Roundcube
Producto: Webmail
Incorporada: 26/10/2023
Objetivo: 16/11/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code.

Cisco IOS XE Web UI Command Injection Vulnerability

Sin confirmar

CVE: CVE-2023-20273
Proveedor: Cisco
Producto: Cisco IOS XE Web UI
Incorporada: 23/10/2023
Objetivo: 27/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.
Descripción CISA: Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer believed to be related to this activity.

Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability

Confirmado

CVE: CVE-2023-4966
Proveedor: Citrix
Producto: NetScaler ADC and NetScaler Gateway
Incorporada: 18/10/2023
Objetivo: 08/11/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.
Descripción CISA: Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.

Cisco IOS XE Web UI Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2023-20198
Proveedor: Cisco
Producto: IOS XE Web UI
Incorporada: 16/10/2023
Objetivo: 20/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.
Descripción CISA: Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can then use that account to gain control of the affected device.

Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability

Sin confirmar

CVE: CVE-2023-20109
Proveedor: Cisco
Producto: IOS and IOS XE
Incorporada: 10/10/2023
Objetivo: 31/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Cisco IOS and IOS XE contain an out-of-bounds write vulnerability in the Group Encrypted Transport VPN (GET VPN) feature that could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute malicious code or cause a device to crash.

Adobe Acrobat and Reader Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2023-21608
Proveedor: Adobe
Producto: Acrobat and Reader
Incorporada: 10/10/2023
Objetivo: 31/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Adobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in the context of the current user.

Microsoft WordPad Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2023-36563
Proveedor: Microsoft
Producto: WordPad
Incorporada: 10/10/2023
Objetivo: 31/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft WordPad contains an unspecified vulnerability that allows for information disclosure.

Microsoft Skype for Business Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2023-41763
Proveedor: Microsoft
Producto: Skype for Business
Incorporada: 10/10/2023
Objetivo: 31/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Skype for Business contains an unspecified vulnerability that allows for privilege escalation.

HTTP/2 Rapid Reset Attack Vulnerability

Sin confirmar

CVE: CVE-2023-44487
Proveedor: IETF
Producto: HTTP/2
Incorporada: 10/10/2023
Objetivo: 31/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Descripción CISA: HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS).

Atlassian Confluence Data Center and Server Broken Access Control Vulnerability

Confirmado

CVE: CVE-2023-22515
Proveedor: Atlassian
Producto: Confluence Data Center and Server
Incorporada: 05/10/2023
Objetivo: 13/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA.
Descripción CISA: Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.

Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability

Confirmado

CVE: CVE-2023-40044
Proveedor: Progress
Producto: WS_FTP Server
Incorporada: 05/10/2023
Objetivo: 26/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system.

Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2023-42824
Proveedor: Apple
Producto: iOS and iPadOS
Incorporada: 05/10/2023
Objetivo: 26/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple iOS and iPadOS contain an unspecified vulnerability that allows for local privilege escalation.

Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2023-28229
Proveedor: Microsoft
Producto: Windows CNG Key Isolation Service
Incorporada: 04/10/2023
Objetivo: 25/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain specific limited SYSTEM privileges.

JetBrains TeamCity Authentication Bypass Vulnerability

Confirmado

CVE: CVE-2023-42793
Proveedor: JetBrains
Producto: TeamCity
Incorporada: 04/10/2023
Objetivo: 25/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server.

Arm Mali GPU Kernel Driver Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2023-4211
Proveedor: Arm
Producto: Mali GPU Kernel Driver
Incorporada: 03/10/2023
Objetivo: 24/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that allows a local, non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.

Google Chromium libvpx Heap Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2023-5217
Proveedor: Google
Producto: Chromium libvpx
Incorporada: 02/10/2023
Objetivo: 23/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Google Chromium libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using libvpx, including but not limited to Google Chrome.

Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability

Sin confirmar

CVE: CVE-2018-14667
Proveedor: Red Hat
Producto: JBoss RichFaces Framework
Incorporada: 28/09/2023
Objetivo: 19/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

Apple Multiple Products Improper Certificate Validation Vulnerability

Sin confirmar

CVE: CVE-2023-41991
Proveedor: Apple
Producto: Multiple Products
Incorporada: 25/09/2023
Objetivo: 16/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple iOS, iPadOS, macOS, and watchOS contain an improper certificate validation vulnerability that can allow a malicious app to bypass signature validation.

Apple Multiple Products Kernel Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2023-41992
Proveedor: Apple
Producto: Multiple Products
Incorporada: 25/09/2023
Objetivo: 16/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple iOS, iPadOS, macOS, and watchOS contain an unspecified vulnerability that allows for local privilege escalation.

Apple Multiple Products WebKit Code Execution Vulnerability

Sin confirmar

CVE: CVE-2023-41993
Proveedor: Apple
Producto: Multiple Products
Incorporada: 25/09/2023
Objetivo: 16/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2023-41179
Proveedor: Trend Micro
Producto: Apex One and Worry-Free Business Security
Incorporada: 21/09/2023
Objetivo: 12/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Trend Micro Apex One and Worry-Free Business Security contain an unspecified vulnerability in the third-party anti-virus uninstaller that could allow an attacker to manipulate the module to conduct remote code execution. An attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.

MinIO Security Feature Bypass Vulnerability

Sin confirmar

CVE: CVE-2023-28434
Proveedor: MinIO
Producto: MinIO
Incorporada: 19/09/2023
Objetivo: 10/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: MinIO contains a security feature bypass vulnerability that allows an attacker to use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket` to conduct privilege escalation. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access.

Realtek SDK Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2014-8361
Proveedor: Realtek
Producto: SDK
Incorporada: 18/09/2023
Objetivo: 09/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Realtek SDK contains an improper input validation vulnerability in the miniigd SOAP service that allows remote attackers to execute malicious code via a crafted NewInternalClient request.

Zyxel EMG2926 Routers Command Injection Vulnerability

Confirmado

CVE: CVE-2017-6884
Proveedor: Zyxel
Producto: EMG2926 Routers
Incorporada: 18/09/2023
Objetivo: 09/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Zyxel EMG2926 routers contain a command injection vulnerability located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute malicious commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.

Laravel Ignition File Upload Vulnerability

Confirmado

CVE: CVE-2021-3129
Proveedor: Laravel
Producto: Ignition
Incorporada: 18/09/2023
Objetivo: 09/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of file_get_contents() and file_put_contents().

Samsung Mobile Devices Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2022-22265
Proveedor: Samsung
Producto: Mobile Devices
Incorporada: 18/09/2023
Objetivo: 09/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Samsung devices with selected Exynos chipsets contain a use-after-free vulnerability that allows malicious memory write and code execution.

Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability

Sin confirmar

CVE: CVE-2023-26369
Proveedor: Adobe
Producto: Acrobat and Reader
Incorporada: 14/09/2023
Objetivo: 05/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Adobe Acrobat and Reader contains an out-of-bounds write vulnerability that allows for code execution.

Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability

Confirmado

CVE: CVE-2023-20269
Proveedor: Cisco
Producto: Adaptive Security Appliance and Firepower Threat Defense
Incorporada: 13/09/2023
Objetivo: 04/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions for group-lock and vpn-simultaneous-logins or discontinue use of the product for unsupported devices.
Descripción CISA: Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user.

Android Framework Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2023-35674
Proveedor: Android
Producto: Framework
Incorporada: 13/09/2023
Objetivo: 04/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Android Framework contains an unspecified vulnerability that allows for privilege escalation.

Google Chromium WebP Heap-Based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2023-4863
Proveedor: Google
Producto: Chromium WebP
Incorporada: 13/09/2023
Objetivo: 04/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec.

Microsoft Word Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2023-36761
Proveedor: Microsoft
Producto: Word
Incorporada: 12/09/2023
Objetivo: 03/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Word contains an unspecified vulnerability that allows for information disclosure.

Microsoft Streaming Service Proxy Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2023-36802
Proveedor: Microsoft
Producto: Streaming Service Proxy
Incorporada: 12/09/2023
Objetivo: 03/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Streaming Service Proxy contains an unspecified vulnerability that allows for privilege escalation.

Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability

Sin confirmar

CVE: CVE-2023-41061
Proveedor: Apple
Producto: iOS, iPadOS, and watchOS
Incorporada: 11/09/2023
Objetivo: 02/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple iOS, iPadOS, and watchOS contain an unspecified vulnerability due to a validation issue affecting Wallet in which a maliciously crafted attachment may result in code execution. This vulnerability was chained with CVE-2023-41064.

Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2023-41064
Proveedor: Apple
Producto: iOS, iPadOS, and macOS
Incorporada: 11/09/2023
Objetivo: 02/10/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple iOS, iPadOS, and macOS contain a buffer overflow vulnerability in ImageIO when processing a maliciously crafted image, which may lead to code execution. This vulnerability was chained with CVE-2023-41061.

Apache RocketMQ Command Execution Vulnerability

Sin confirmar

CVE: CVE-2023-33246
Proveedor: Apache
Producto: RocketMQ
Incorporada: 06/09/2023
Objetivo: 27/09/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content.

Ignite Realtime Openfire Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2023-32315
Proveedor: Ignite Realtime
Producto: Openfire
Incorporada: 24/08/2023
Objetivo: 14/09/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Ignite Realtime Openfire contains a path traversal vulnerability that allows an unauthenticated attacker to access restricted pages in the Openfire Admin Console reserved for administrative users.

RARLAB WinRAR Code Execution Vulnerability

Confirmado

CVE: CVE-2023-38831
Proveedor: RARLAB
Producto: WinRAR
Incorporada: 24/08/2023
Objetivo: 14/09/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: RARLAB WinRAR contains an unspecified vulnerability that allows an attacker to execute code when a user attempts to view a benign file within a ZIP archive.

Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability

Confirmado

CVE: CVE-2023-27532
Proveedor: Veeam
Producto: Backup & Replication
Incorporada: 22/08/2023
Objetivo: 12/09/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts.

Ivanti Sentry Authentication Bypass Vulnerability

Confirmado

CVE: CVE-2023-38035
Proveedor: Ivanti
Producto: Sentry
Incorporada: 22/08/2023
Objetivo: 12/09/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Sin confirmar

CVE: CVE-2023-26359
Proveedor: Adobe
Producto: ColdFusion
Incorporada: 21/08/2023
Objetivo: 11/09/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user.

Citrix Content Collaboration ShareFile Improper Access Control Vulnerability

Sin confirmar

CVE: CVE-2023-24489
Proveedor: Citrix
Producto: Content Collaboration
Incorporada: 16/08/2023
Objetivo: 06/09/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Citrix Content Collaboration contains an improper access control vulnerability that could allow an unauthenticated attacker to remotely compromise customer-managed ShareFile storage zones controllers.

Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability

Sin confirmar

CVE: CVE-2023-38180
Proveedor: Microsoft
Producto: .NET Core and Visual Studio
Incorporada: 09/08/2023
Objetivo: 30/08/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft .NET Core and Visual Studio contain an unspecified vulnerability that allows for denial-of-service (DoS).

Zyxel P660HN-T1A Routers Command Injection Vulnerability

Sin confirmar

CVE: CVE-2017-18368
Proveedor: Zyxel
Producto: P660HN-T1A Routers
Incorporada: 07/08/2023
Objetivo: 28/08/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Zyxel P660HN-T1A routers contain a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user and exploited via the remote_host parameter of the ViewLog.asp page.

Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2023-35081
Proveedor: Ivanti
Producto: Endpoint Manager Mobile (EPMM)
Incorporada: 31/07/2023
Objetivo: 21/08/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Ivanti Endpoint Manager Mobile (EPMM) contains a path traversal vulnerability that enables an authenticated administrator to perform malicious file writes to the EPMM server. This vulnerability can be used in conjunction with CVE-2023-35078 to bypass authentication and ACLs restrictions (if applicable).

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Sin confirmar

CVE: CVE-2023-37580
Proveedor: Synacor
Producto: Zimbra Collaboration Suite (ZCS)
Incorporada: 27/07/2023
Objetivo: 17/08/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability impacting the confidentiality and integrity of data.

Apple Multiple Products Kernel Unspecified Vulnerability

Sin confirmar

CVE: CVE-2023-38606
Proveedor: Apple
Producto: Multiple Products
Incorporada: 26/07/2023
Objetivo: 16/08/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability allowing an app to modify a sensitive kernel state.

Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability

Confirmado

CVE: CVE-2023-35078
Proveedor: Ivanti
Producto: Endpoint Manager Mobile (EPMM)
Incorporada: 25/07/2023
Objetivo: 15/08/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contains an authentication bypass vulnerability that allows unauthenticated access to specific API paths. An attacker with access to these API paths can access personally identifiable information (PII) such as names, phone numbers, and other mobile device details for users on a vulnerable system. An attacker can also make other configuration changes including installing software and modifying security profiles on registered devices.

Adobe ColdFusion Improper Access Control Vulnerability

Sin confirmar

CVE: CVE-2023-29298
Proveedor: Adobe
Producto: ColdFusion
Incorporada: 20/07/2023
Objetivo: 10/08/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.

Adobe ColdFusion Improper Access Control Vulnerability

Sin confirmar

CVE: CVE-2023-38205
Proveedor: Adobe
Producto: ColdFusion
Incorporada: 20/07/2023
Objetivo: 10/08/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.

Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability

Confirmado

CVE: CVE-2023-3519
Proveedor: Citrix
Producto: NetScaler ADC and NetScaler Gateway
Incorporada: 19/07/2023
Objetivo: 09/08/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Citrix NetScaler ADC and NetScaler Gateway contains a code injection vulnerability that allows for unauthenticated remote code execution.

Microsoft Windows Search Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2023-36884
Proveedor: Microsoft
Producto: Windows
Incorporada: 17/07/2023
Objetivo: 29/08/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Descripción CISA: Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution.

SolarView Compact Command Injection Vulnerability

Sin confirmar

CVE: CVE-2022-29303
Proveedor: SolarView
Producto: Compact
Incorporada: 13/07/2023
Objetivo: 03/08/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Descripción CISA: SolarView Compact contains a command injection vulnerability due to improper validation of input values on the send test mail console of the product's web server.

Apple Multiple Products WebKit Code Execution Vulnerability

Sin confirmar

CVE: CVE-2023-37450
Proveedor: Apple
Producto: Multiple Products
Incorporada: 13/07/2023
Objetivo: 03/08/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Descripción CISA: Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Netwrix Auditor Insecure Object Deserialization Vulnerability

Confirmado

CVE: CVE-2022-31199
Proveedor: Netwrix
Producto: Auditor
Incorporada: 11/07/2023
Objetivo: 01/08/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Descripción CISA: Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\SYSTEM user. Successful exploitation requires that the attacker is able to reach port 9004/TCP, which is commonly blocked by standard enterprise firewalling.

Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2023-32046
Proveedor: Microsoft
Producto: Windows
Incorporada: 11/07/2023
Objetivo: 01/08/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Descripción CISA: Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for privilege escalation.

Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability

Sin confirmar

CVE: CVE-2023-32049
Proveedor: Microsoft
Producto: Windows
Incorporada: 11/07/2023
Objetivo: 01/08/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Descripción CISA: Microsoft Windows Defender SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the Open File - Security Warning prompt.

Microsoft Outlook Security Feature Bypass Vulnerability

Sin confirmar

CVE: CVE-2023-35311
Proveedor: Microsoft
Producto: Outlook
Incorporada: 11/07/2023
Objetivo: 01/08/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Descripción CISA: Microsoft Outlook contains a security feature bypass vulnerability that allows an attacker to bypass the Microsoft Outlook Security Notice prompt.

Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2023-36874
Proveedor: Microsoft
Producto: Windows
Incorporada: 11/07/2023
Objetivo: 01/08/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Descripción CISA: Microsoft Windows Error Reporting Service contains an unspecified vulnerability that allows for privilege escalation.

Arm Mali GPU Kernel Driver Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2021-29256
Proveedor: Arm
Producto: Mali Graphics Processing Unit (GPU)
Incorporada: 07/07/2023
Objetivo: 28/07/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Descripción CISA: Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.

D-Link DIR-859 Router Command Execution Vulnerability

Sin confirmar

CVE: CVE-2019-17621
Proveedor: D-Link
Producto: DIR-859 Router
Incorporada: 29/06/2023
Objetivo: 20/07/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Descripción CISA: D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.

D-Link DWL-2600AP Access Point Command Injection Vulnerability

Sin confirmar

CVE: CVE-2019-20500
Proveedor: D-Link
Producto: DWL-2600AP Access Point
Incorporada: 29/06/2023
Objetivo: 20/07/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Descripción CISA: D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.

Samsung Mobile Devices Unspecified Vulnerability

Sin confirmar

CVE: CVE-2021-25371
Proveedor: Samsung
Producto: Mobile Devices
Incorporada: 29/06/2023
Objetivo: 20/07/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Descripción CISA: Samsung mobile devices contain an unspecified vulnerability within DSP driver that allows attackers to load ELF libraries inside DSP.

Samsung Mobile Devices Improper Boundary Check Vulnerability

Sin confirmar

CVE: CVE-2021-25372
Proveedor: Samsung
Producto: Mobile Devices
Incorporada: 29/06/2023
Objetivo: 20/07/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Descripción CISA: Samsung mobile devices contain an improper boundary check vulnerability within DSP driver that allows for out-of-bounds memory access.

Samsung Mobile Devices Race Condition Vulnerability

Sin confirmar

CVE: CVE-2021-25394
Proveedor: Samsung
Producto: Mobile Devices
Incorporada: 29/06/2023
Objetivo: 20/07/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Descripción CISA: Samsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised.

Samsung Mobile Devices Race Condition Vulnerability

Sin confirmar

CVE: CVE-2021-25395
Proveedor: Samsung
Producto: Mobile Devices
Incorporada: 29/06/2023
Objetivo: 20/07/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Descripción CISA: Samsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised.

Samsung Mobile Devices Out-of-Bounds Read Vulnerability

Sin confirmar

CVE: CVE-2021-25487
Proveedor: Samsung
Producto: Mobile Devices
Incorporada: 29/06/2023
Objetivo: 20/07/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Descripción CISA: Samsung mobile devices contain an out-of-bounds read vulnerability within the modem interface driver due to a lack of boundary checking of a buffer in set_skb_priv(), leading to remote code execution by dereference of an invalid function pointer.

Samsung Mobile Devices Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2021-25489
Proveedor: Samsung
Producto: Mobile Devices
Incorporada: 29/06/2023
Objetivo: 20/07/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Descripción CISA: Samsung mobile devices contain an improper input validation vulnerability within the modem interface driver that results in a format string bug leading to kernel panic.

VMware Tools Authentication Bypass Vulnerability

Sin confirmar

CVE: CVE-2023-20867
Proveedor: VMware
Producto: Tools
Incorporada: 23/06/2023
Objetivo: 14/07/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability.

Zyxel Multiple NAS Devices Command Injection Vulnerability

Sin confirmar

CVE: CVE-2023-27992
Proveedor: Zyxel
Producto: Multiple Network-Attached Storage (NAS) Devices
Incorporada: 23/06/2023
Objetivo: 14/07/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request.

Apple Multiple Products Integer Overflow Vulnerability

Sin confirmar

CVE: CVE-2023-32434
Proveedor: Apple
Producto: Multiple Products
Incorporada: 23/06/2023
Objetivo: 14/07/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS. iPadOS, macOS, and watchOS contain an integer overflow vulnerability that could allow an application to execute code with kernel privileges.

Apple Multiple Products WebKit Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2023-32435
Proveedor: Apple
Producto: Multiple Products
Incorporada: 23/06/2023
Objetivo: 14/07/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Apple Multiple Products WebKit Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2023-32439
Proveedor: Apple
Producto: Multiple Products
Incorporada: 23/06/2023
Objetivo: 14/07/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, iPadOS, macOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Microsoft Win32k Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2016-0165
Proveedor: Microsoft
Producto: Win32k
Incorporada: 22/06/2023
Objetivo: 13/07/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.

Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2016-9079
Proveedor: Mozilla
Producto: Firefox, Firefox ESR, and Thunderbird
Incorporada: 22/06/2023
Objetivo: 13/07/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Mozilla Firefox, Firefox ESR, and Thunderbird contain a use-after-free vulnerability in SVG Animation, targeting Firefox and Tor browser users on Windows.

Roundcube Webmail Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2020-12641
Proveedor: Roundcube
Producto: Roundcube Webmail
Incorporada: 22/06/2023
Objetivo: 13/07/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.

Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability

Sin confirmar

CVE: CVE-2020-35730
Proveedor: Roundcube
Producto: Roundcube Webmail
Incorporada: 22/06/2023
Objetivo: 13/07/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.

Roundcube Webmail SQL Injection Vulnerability

Sin confirmar

CVE: CVE-2021-44026
Proveedor: Roundcube
Producto: Roundcube Webmail
Incorporada: 22/06/2023
Objetivo: 13/07/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Roundcube Webmail is vulnerable to SQL injection via search or search_params.

Vmware Aria Operations for Networks Command Injection Vulnerability

Sin confirmar

CVE: CVE-2023-20887
Proveedor: VMware
Producto: Aria Operations for Networks
Incorporada: 22/06/2023
Objetivo: 13/07/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execution.

Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability

Confirmado

CVE: CVE-2023-27997
Proveedor: Fortinet
Producto: FortiOS and FortiProxy SSL-VPN
Incorporada: 13/06/2023
Objetivo: 04/07/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.

Google Chromium V8 Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2023-3079
Proveedor: Google
Producto: Chromium V8
Incorporada: 07/06/2023
Objetivo: 28/06/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Zyxel Multiple Firewalls Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2023-33009
Proveedor: Zyxel
Producto: Multiple Firewalls
Incorporada: 05/06/2023
Objetivo: 26/06/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the notification function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.

Zyxel Multiple Firewalls Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2023-33010
Proveedor: Zyxel
Producto: Multiple Firewalls
Incorporada: 05/06/2023
Objetivo: 26/06/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the ID processing function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.

Progress MOVEit Transfer SQL Injection Vulnerability

Confirmado

CVE: CVE-2023-34362
Proveedor: Progress
Producto: MOVEit Transfer
Incorporada: 02/06/2023
Objetivo: 23/06/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements.

Zyxel Multiple Firewalls OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2023-28771
Proveedor: Zyxel
Producto: Multiple Firewalls
Incorporada: 31/05/2023
Objetivo: 21/06/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device.

Barracuda Networks ESG Appliance Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2023-2868
Proveedor: Barracuda Networks
Producto: Email Security Gateway (ESG) Appliance
Incorporada: 26/05/2023
Objetivo: 16/06/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection.

Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability

Sin confirmar

CVE: CVE-2023-28204
Proveedor: Apple
Producto: Multiple Products
Incorporada: 22/05/2023
Objetivo: 12/06/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Apple Multiple Products WebKit Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2023-32373
Proveedor: Apple
Producto: Multiple Products
Incorporada: 22/05/2023
Objetivo: 12/06/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Apple Multiple Products WebKit Sandbox Escape Vulnerability

Sin confirmar

CVE: CVE-2023-32409
Proveedor: Apple
Producto: Multiple Products
Incorporada: 22/05/2023
Objetivo: 12/06/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an unspecified vulnerability that can allow a remote attacker to break out of the Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Cisco IOS Denial-of-Service Vulnerability

Sin confirmar

CVE: CVE-2004-1464
Proveedor: Cisco
Producto: IOS
Incorporada: 19/05/2023
Objetivo: 09/06/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Cisco IOS contains an unspecified vulnerability that may block further telnet, reverse telnet, Remote Shell (RSH), Secure Shell (SSH), and in some cases, Hypertext Transport Protocol (HTTP) access to the Cisco device.

Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2016-6415
Proveedor: Cisco
Producto: IOS, IOS XR, and IOS XE
Incorporada: 19/05/2023
Objetivo: 09/06/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Cisco IOS, IOS XR, and IOS XE contain insufficient condition checks in the part of the code that handles Internet Key Exchange version 1 (IKEv1) security negotiation requests. contains an information disclosure vulnerability in the Internet Key Exchange version 1 (IKEv1) that could allow an attacker to retrieve memory contents. Successful exploitation could allow the attacker to retrieve memory contents, which can lead to information disclosure.

Samsung Mobile Devices Insertion of Sensitive Information Into Log File Vulnerability

Sin confirmar

CVE: CVE-2023-21492
Proveedor: Samsung
Producto: Mobile Devices
Incorporada: 19/05/2023
Objetivo: 09/06/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Samsung mobile devices running Android 11, 12, and 13 contain an insertion of sensitive information into log file vulnerability that allows a privileged, local attacker to conduct an address space layout randomization (ASLR) bypass.

Linux Kernel Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2010-3904
Proveedor: Linux
Producto: Kernel
Incorporada: 12/05/2023
Objetivo: 02/06/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Linux Kernel contains an improper input validation vulnerability in the Reliable Datagram Sockets (RDS) protocol implementation that allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.

Linux Kernel Race Condition Vulnerability

Sin confirmar

CVE: CVE-2014-0196
Proveedor: Linux
Producto: Kernel
Incorporada: 12/05/2023
Objetivo: 02/06/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Linux Kernel contains a race condition vulnerability within the n_tty_write function that allows local users to cause a denial-of-service (DoS) or gain privileges via read and write operations with long strings.

Jenkins User Interface (UI) Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2015-5317
Proveedor: Jenkins
Producto: Jenkins User Interface (UI)
Incorporada: 12/05/2023
Objetivo: 02/06/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Jenkins User Interface (UI) contains an information disclosure vulnerability that allows users to see the names of jobs and builds otherwise inaccessible to them on the "Fingerprints" pages.

Oracle Java SE and JRockit Unspecified Vulnerability

Sin confirmar

CVE: CVE-2016-3427
Proveedor: Oracle
Producto: Java SE and JRockit
Incorporada: 12/05/2023
Objetivo: 02/06/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.

Apache Tomcat Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2016-8735
Proveedor: Apache
Producto: Tomcat
Incorporada: 12/05/2023
Objetivo: 02/06/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.

Red Hat Polkit Incorrect Authorization Vulnerability

Sin confirmar

CVE: CVE-2021-3560
Proveedor: Red Hat
Producto: Polkit
Incorporada: 12/05/2023
Objetivo: 02/06/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Red Hat Polkit contains an incorrect authorization vulnerability through the bypassing of credential checks for D-Bus requests, allowing for privilege escalation.

Multiple Ruckus Wireless Products CSRF and RCE Vulnerability

Sin confirmar

CVE: CVE-2023-25717
Proveedor: Ruckus Wireless
Producto: Multiple Products
Incorporada: 12/05/2023
Objetivo: 02/06/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions or disconnect product if it is end-of-life.
Descripción CISA: Ruckus Wireless Access Point (AP) software contains an unspecified vulnerability in the web services component. If the web services component is enabled on the AP, an attacker can perform cross-site request forgery (CSRF) or remote code execution (RCE). This vulnerability impacts Ruckus ZoneDirector, SmartZone, and Solo APs.

Microsoft Win32K Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2023-29336
Proveedor: Microsoft
Producto: Win32k
Incorporada: 09/05/2023
Objetivo: 30/05/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation up to SYSTEM privileges.

Apache Log4j2 Deserialization of Untrusted Data Vulnerability

Confirmado

CVE: CVE-2021-45046
Proveedor: Apache
Producto: Log4j2
Incorporada: 01/05/2023
Objetivo: 22/05/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.

TP-Link Archer AX-21 Command Injection Vulnerability

Sin confirmar

CVE: CVE-2023-1389
Proveedor: TP-Link
Producto: Archer AX21
Incorporada: 01/05/2023
Objetivo: 22/05/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: TP-Link Archer AX-21 contains a command injection vulnerability that allows for remote code execution.

Oracle WebLogic Server Unspecified Vulnerability

Sin confirmar

CVE: CVE-2023-21839
Proveedor: Oracle
Producto: WebLogic Server
Incorporada: 01/05/2023
Objetivo: 22/05/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Oracle WebLogic Server contains an unspecified vulnerability that allows an unauthenticated attacker with network access via T3, IIOP, to compromise Oracle WebLogic Server.

Google Chrome Skia Integer Overflow Vulnerability

Sin confirmar

CVE: CVE-2023-2136
Proveedor: Google
Producto: Chromium Skia
Incorporada: 21/04/2023
Objetivo: 12/05/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.

PaperCut MF/NG Improper Access Control Vulnerability

Confirmado

CVE: CVE-2023-27350
Proveedor: PaperCut
Producto: MF/NG
Incorporada: 21/04/2023
Objetivo: 12/05/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of system.

MinIO Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2023-28432
Proveedor: MinIO
Producto: MinIO
Incorporada: 21/04/2023
Objetivo: 12/05/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: MinIO contains a vulnerability in a cluster deployment where MinIO returns all environment variables, which allows for information disclosure.

Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2017-6742
Proveedor: Cisco
Producto: IOS and IOS XE Software
Incorporada: 19/04/2023
Objetivo: 10/05/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.

Apple macOS Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2019-8526
Proveedor: Apple
Producto: macOS
Incorporada: 17/04/2023
Objetivo: 08/05/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple macOS contains a use-after-free vulnerability that could allow for privilege escalation.

Google Chromium V8 Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2023-2033
Proveedor: Google
Producto: Chromium V8
Incorporada: 17/04/2023
Objetivo: 08/05/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Android Framework Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2023-20963
Proveedor: Android
Producto: Framework
Incorporada: 13/04/2023
Objetivo: 04/05/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Android Framework contains an unspecified vulnerability that allows for privilege escalation after updating an app to a higher Target SDK with no additional execution privileges needed.

Novi Survey Insecure Deserialization Vulnerability

Sin confirmar

CVE: CVE-2023-29492
Proveedor: Novi Survey
Producto: Novi Survey
Incorporada: 13/04/2023
Objetivo: 04/05/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context of the service account.

Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2023-28252
Proveedor: Microsoft
Producto: Windows
Incorporada: 11/04/2023
Objetivo: 02/05/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.

Apple Multiple Products WebKit Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2023-28205
Proveedor: Apple
Producto: Multiple Products
Incorporada: 10/04/2023
Objetivo: 01/05/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, iPadOS, macOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability

Sin confirmar

CVE: CVE-2023-28206
Proveedor: Apple
Producto: iOS, iPadOS, and macOS
Incorporada: 10/04/2023
Objetivo: 01/05/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, iPadOS, and macOS IOSurfaceAccelerator contain an out-of-bounds write vulnerability that allows an app to execute code with kernel privileges.

Microsoft Windows Certificate Dialog Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2019-1388
Proveedor: Microsoft
Producto: Windows
Incorporada: 07/04/2023
Objetivo: 28/04/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Certificate Dialog contains a privilege escalation vulnerability, allowing attackers to run processes in an elevated context.

Veritas Backup Exec Agent File Access Vulnerability

Confirmado

CVE: CVE-2021-27876
Proveedor: Veritas
Producto: Backup Exec Agent
Incorporada: 07/04/2023
Objetivo: 28/04/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Veritas Backup Exec (BE) Agent contains a file access vulnerability that could allow an attacker to specially craft input parameters on a data management protocol command to access files on the BE Agent machine.

Veritas Backup Exec Agent Improper Authentication Vulnerability

Confirmado

CVE: CVE-2021-27877
Proveedor: Veritas
Producto: Backup Exec Agent
Incorporada: 07/04/2023
Objetivo: 28/04/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Veritas Backup Exec (BE) Agent contains an improper authentication vulnerability that could allow an attacker unauthorized access to the BE Agent via SHA authentication scheme.

Veritas Backup Exec Agent Command Execution Vulnerability

Confirmado

CVE: CVE-2021-27878
Proveedor: Veritas
Producto: Backup Exec Agent
Incorporada: 07/04/2023
Objetivo: 28/04/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Veritas Backup Exec (BE) Agent contains a command execution vulnerability that could allow an attacker to use a data management protocol command to execute a command on the BE Agent machine.

Arm Mali GPU Kernel Driver Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2023-26083
Proveedor: Arm
Producto: Mali Graphics Processing Unit (GPU)
Incorporada: 07/04/2023
Objetivo: 28/04/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Arm Mali GPU Kernel Driver contains an information disclosure vulnerability that allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata.

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Sin confirmar

CVE: CVE-2022-27926
Proveedor: Synacor
Producto: Zimbra Collaboration Suite (ZCS)
Incorporada: 03/04/2023
Objetivo: 24/04/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability by allowing an endpoint URL to accept parameters without sanitizing.

Microsoft Internet Explorer Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2013-3163
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 30/03/2023
Objetivo: 20/04/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial of service via a crafted website.

Samba Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2017-7494
Proveedor: Samba
Producto: Samba
Incorporada: 30/03/2023
Objetivo: 20/04/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Samba contains a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share and then cause the server to load and execute it.

Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability

Sin confirmar

CVE: CVE-2021-30900
Proveedor: Apple
Producto: iOS, iPadOS, and macOS
Incorporada: 30/03/2023
Objetivo: 20/04/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple GPU drivers, included in iOS, iPadOS, and macOS, contain an out-of-bounds write vulnerability that may allow a malicious application to execute code with kernel privileges.

Arm Mali GPU Kernel Driver Unspecified Vulnerability

Sin confirmar

CVE: CVE-2022-22706
Proveedor: Arm
Producto: Mali Graphics Processing Unit (GPU)
Incorporada: 30/03/2023
Objetivo: 20/04/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Arm Mali GPU Kernel Driver contains an unspecified vulnerability that allows a non-privileged user to achieve write access to read-only memory pages.

Google Chromium Network Service Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2022-3038
Proveedor: Google
Producto: Chromium Network Service
Incorporada: 30/03/2023
Objetivo: 20/04/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium Network Service contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Arm Mali GPU Kernel Driver Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2022-38181
Proveedor: Arm
Producto: Mali Graphics Processing Unit (GPU)
Incorporada: 30/03/2023
Objetivo: 20/04/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.

Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability

Sin confirmar

CVE: CVE-2022-39197
Proveedor: Fortra
Producto: Cobalt Strike
Incorporada: 30/03/2023
Objetivo: 20/04/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely.

Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2022-42948
Proveedor: Fortra
Producto: Cobalt Strike
Incorporada: 30/03/2023
Objetivo: 20/04/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution.

Linux Kernel Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2023-0266
Proveedor: Linux
Producto: Kernel
Incorporada: 30/03/2023
Objetivo: 20/04/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Linux kernel contains a use-after-free vulnerability that allows for privilege escalation to gain ring0 access from the system user.

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Sin confirmar

CVE: CVE-2023-26360
Proveedor: Adobe
Producto: ColdFusion
Incorporada: 15/03/2023
Objetivo: 05/04/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution.

Fortinet FortiOS Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2022-41328
Proveedor: Fortinet
Producto: FortiOS
Incorporada: 14/03/2023
Objetivo: 04/04/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands.

Microsoft Office Outlook Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2023-23397
Proveedor: Microsoft
Producto: Office
Incorporada: 14/03/2023
Objetivo: 04/04/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user.

Microsoft Windows SmartScreen Security Feature Bypass Vulnerability

Confirmado

CVE: CVE-2023-24880
Proveedor: Microsoft
Producto: Windows
Incorporada: 14/03/2023
Objetivo: 04/04/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.

Plex Media Server Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2020-5741
Proveedor: Plex
Producto: Media Server
Incorporada: 10/03/2023
Objetivo: 31/03/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Plex Media Server contains a remote code execution vulnerability that allows an attacker with access to the server administrator's Plex account to upload a malicious file via the Camera Upload feature and have the media server execute it.

XStream Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2021-39144
Proveedor: XStream
Producto: XStream
Incorporada: 10/03/2023
Objetivo: 31/03/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: XStream contains a remote code execution vulnerability that allows an attacker to manipulate the processed input stream and replace or inject objects that result in the execution of a local command on the server. This vulnerability can affect multiple products, including but not limited to VMware Cloud Foundation.

Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2022-28810
Proveedor: Zoho
Producto: ManageEngine
Incorporada: 07/03/2023
Objetivo: 28/03/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset.

Apache Spark Command Injection Vulnerability

Sin confirmar

CVE: CVE-2022-33891
Proveedor: Apache
Producto: Spark
Incorporada: 07/03/2023
Objetivo: 28/03/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled.

Teclib GLPI Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2022-35914
Proveedor: Teclib
Producto: GLPI
Incorporada: 07/03/2023
Objetivo: 28/03/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Teclib GLPI contains a remote code execution vulnerability in the third-party library, htmlawed.

ZK Framework AuUploader Unspecified Vulnerability

Confirmado

CVE: CVE-2022-36537
Proveedor: ZK Framework
Producto: AuUploader
Incorporada: 27/02/2023
Objetivo: 20/03/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager.

Mitel MiVoice Connect Command Injection Vulnerability

Confirmado

CVE: CVE-2022-40765
Proveedor: Mitel
Producto: MiVoice Connect
Incorporada: 21/02/2023
Objetivo: 14/03/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system.

Mitel MiVoice Connect Code Injection Vulnerability

Confirmado

CVE: CVE-2022-41223
Proveedor: Mitel
Producto: MiVoice Connect
Incorporada: 21/02/2023
Objetivo: 14/03/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application.

IBM Aspera Faspex Code Execution Vulnerability

Confirmado

CVE: CVE-2022-47986
Proveedor: IBM
Producto: Aspera Faspex
Incorporada: 21/02/2023
Objetivo: 14/03/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw.

Cacti Command Injection Vulnerability

Sin confirmar

CVE: CVE-2022-46169
Proveedor: Cacti
Producto: Cacti
Incorporada: 16/02/2023
Objetivo: 09/03/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Cacti contains a command injection vulnerability that allows an unauthenticated user to execute code.

Microsoft Office Publisher Security Feature Bypass Vulnerability

Sin confirmar

CVE: CVE-2023-21715
Proveedor: Microsoft
Producto: Office
Incorporada: 14/02/2023
Objetivo: 07/03/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system.

Microsoft Windows Graphic Component Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2023-21823
Proveedor: Microsoft
Producto: Windows
Incorporada: 14/02/2023
Objetivo: 07/03/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Graphic Component contains an unspecified vulnerability that allows for privilege escalation.

Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2023-23376
Proveedor: Microsoft
Producto: Windows
Incorporada: 14/02/2023
Objetivo: 07/03/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.

Apple Multiple Products WebKit Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2023-23529
Proveedor: Apple
Producto: Multiple Products
Incorporada: 14/02/2023
Objetivo: 07/03/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, MacOS, Safari and iPadOS WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability

Confirmado

CVE: CVE-2015-2291
Proveedor: Intel
Producto: Ethernet Diagnostics Driver for Windows
Incorporada: 10/02/2023
Objetivo: 03/03/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Intel ethernet diagnostics driver for Windows IQVW32.sys and IQVW64.sys contain an unspecified vulnerability that allows for a denial-of-service (DoS).

TerraMaster OS Remote Command Execution Vulnerability

Confirmado

CVE: CVE-2022-24990
Proveedor: TerraMaster
Producto: TerraMaster OS
Incorporada: 10/02/2023
Objetivo: 03/03/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.

Fortra GoAnywhere MFT Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2023-0669
Proveedor: Fortra
Producto: GoAnywhere MFT
Incorporada: 10/02/2023
Objetivo: 03/03/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.

Oracle E-Business Suite Unspecified Vulnerability

Confirmado

CVE: CVE-2022-21587
Proveedor: Oracle
Producto: E-Business Suite
Incorporada: 02/02/2023
Objetivo: 23/02/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.

Multiple SugarCRM Products Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2023-22952
Proveedor: SugarCRM
Producto: Multiple Products
Incorporada: 02/02/2023
Objetivo: 23/02/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.

Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability

Confirmado

CVE: CVE-2017-11357
Proveedor: Telerik
Producto: User Interface (UI) for ASP.NET AJAX
Incorporada: 26/01/2023
Objetivo: 16/02/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution.

Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2022-47966
Proveedor: Zoho
Producto: ManageEngine
Incorporada: 23/01/2023
Objetivo: 13/02/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.

CWP Control Web Panel OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2022-44877
Proveedor: CWP
Producto: Control Web Panel
Incorporada: 17/01/2023
Objetivo: 07/02/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter.

Microsoft Exchange Server Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2022-41080
Proveedor: Microsoft
Producto: Exchange Server
Incorporada: 10/01/2023
Objetivo: 31/01/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution.

Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2023-21674
Proveedor: Microsoft
Producto: Windows
Incorporada: 10/01/2023
Objetivo: 31/01/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Advanced Local Procedure Call (ALPC) contains an unspecified vulnerability that allows for privilege escalation.

TIBCO JasperReports Library Directory Traversal Vulnerability

Sin confirmar

CVE: CVE-2018-18809
Proveedor: TIBCO
Producto: JasperReports
Incorporada: 29/12/2022
Objetivo: 19/01/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: TIBCO JasperReports Library contains a directory-traversal vulnerability that may allow web server users to access contents of the host system.

TIBCO JasperReports Server Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2018-5430
Proveedor: TIBCO
Producto: JasperReports
Incorporada: 29/12/2022
Objetivo: 19/01/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: TIBCO JasperReports Server contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files.

Apple iOS Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2022-42856
Proveedor: Apple
Producto: iOS
Incorporada: 14/12/2022
Objetivo: 04/01/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS contains a type confusion vulnerability when processing maliciously crafted web content leading to code execution.

Veeam Backup & Replication Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2022-26500
Proveedor: Veeam
Producto: Backup & Replication
Incorporada: 13/12/2022
Objetivo: 03/01/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.

Veeam Backup & Replication Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2022-26501
Proveedor: Veeam
Producto: Backup & Replication
Incorporada: 13/12/2022
Objetivo: 03/01/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.

Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability

Sin confirmar

CVE: CVE-2022-27518
Proveedor: Citrix
Producto: Application Delivery Controller (ADC) and Gateway
Incorporada: 13/12/2022
Objetivo: 03/01/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator.

Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability

Confirmado

CVE: CVE-2022-42475
Proveedor: Fortinet
Producto: FortiOS
Incorporada: 13/12/2022
Objetivo: 03/01/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.

Microsoft Defender SmartScreen Security Feature Bypass Vulnerability

Confirmado

CVE: CVE-2022-44698
Proveedor: Microsoft
Producto: Defender
Incorporada: 13/12/2022
Objetivo: 03/01/2023
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.

Google Chromium V8 Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2022-4262
Proveedor: Google
Producto: Chromium V8
Incorporada: 05/12/2022
Objetivo: 26/12/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Oracle Fusion Middleware Unspecified Vulnerability

Sin confirmar

CVE: CVE-2021-35587
Proveedor: Oracle
Producto: Fusion Middleware
Incorporada: 28/11/2022
Objetivo: 19/12/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product.

Google Chromium GPU Heap Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2022-4135
Proveedor: Google
Producto: Chromium GPU
Incorporada: 28/11/2022
Objetivo: 19/12/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium GPU contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability

Sin confirmar

CVE: CVE-2022-41049
Proveedor: Microsoft
Producto: Windows
Incorporada: 14/11/2022
Objetivo: 09/12/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.

Samsung Mobile Devices Improper Access Control Vulnerability

Sin confirmar

CVE: CVE-2021-25337
Proveedor: Samsung
Producto: Mobile Devices
Incorporada: 08/11/2022
Objetivo: 29/11/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Samsung mobile devices contain an improper access control vulnerability in clipboard service which allows untrusted applications to read or write arbitrary files. This vulnerability was chained with CVE-2021-25369 and CVE-2021-25370.

Samsung Mobile Devices Improper Access Control Vulnerability

Sin confirmar

CVE: CVE-2021-25369
Proveedor: Samsung
Producto: Mobile Devices
Incorporada: 08/11/2022
Objetivo: 29/11/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Samsung mobile devices using Mali GPU contains an improper access control vulnerability in sec_log file. Exploitation of the vulnerability exposes sensitive kernel information to the userspace. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25370.

Samsung Mobile Devices Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2021-25370
Proveedor: Samsung
Producto: Mobile Devices
Incorporada: 08/11/2022
Objetivo: 29/11/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Samsung mobile devices using Mali GPU contain an incorrect implementation handling file descriptor in dpu driver. This incorrect implementation results in memory corruption, leading to kernel panic. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25369.

Microsoft Windows Print Spooler Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2022-41073
Proveedor: Microsoft
Producto: Windows
Incorporada: 08/11/2022
Objetivo: 09/12/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Print Spooler contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.

Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability

Confirmado

CVE: CVE-2022-41091
Proveedor: Microsoft
Producto: Windows
Incorporada: 08/11/2022
Objetivo: 09/12/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.

Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2022-41125
Proveedor: Microsoft
Producto: Windows
Incorporada: 08/11/2022
Objetivo: 09/12/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.

Microsoft Windows Scripting Languages Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2022-41128
Proveedor: Microsoft
Producto: Windows
Incorporada: 08/11/2022
Objetivo: 09/12/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows contains an unspecified vulnerability in the JScript9 scripting language which allows for remote code execution.

Google Chromium V8 Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2022-3723
Proveedor: Google
Producto: Chromium V8
Incorporada: 28/10/2022
Objetivo: 18/11/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Apple iOS and iPadOS Out-of-Bounds Write Vulnerability

Sin confirmar

CVE: CVE-2022-42827
Proveedor: Apple
Producto: iOS and iPadOS
Incorporada: 25/10/2022
Objetivo: 15/11/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS and iPadOS kernel contain an out-of-bounds write vulnerability which can allow an application to perform code execution with kernel privileges.

GIGABYTE Multiple Products Unspecified Vulnerability

Confirmado

CVE: CVE-2018-19320
Proveedor: GIGABYTE
Producto: Multiple Products
Incorporada: 24/10/2022
Objetivo: 14/11/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The GDrv low-level driver in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.

GIGABYTE Multiple Products Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2018-19321
Proveedor: GIGABYTE
Producto: Multiple Products
Incorporada: 24/10/2022
Objetivo: 14/11/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.

GIGABYTE Multiple Products Code Execution Vulnerability

Confirmado

CVE: CVE-2018-19322
Proveedor: GIGABYTE
Producto: Multiple Products
Incorporada: 24/10/2022
Objetivo: 14/11/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.

GIGABYTE Multiple Products Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2018-19323
Proveedor: GIGABYTE
Producto: Multiple Products
Incorporada: 24/10/2022
Objetivo: 14/11/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.

Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability

Confirmado

CVE: CVE-2020-3153
Proveedor: Cisco
Producto: AnyConnect Secure
Incorporada: 24/10/2022
Objetivo: 14/11/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks.

Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability

Confirmado

CVE: CVE-2020-3433
Proveedor: Cisco
Producto: AnyConnect Secure
Incorporada: 24/10/2022
Objetivo: 14/11/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Cisco AnyConnect Secure Mobility Client for Windows interprocess communication (IPC) channel allows for insufficient validation of resources that are loaded by the application at run time. An attacker with valid credentials on Windows could execute code on the affected machine with SYSTEM privileges.

Linux Kernel Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2021-3493
Proveedor: Linux
Producto: Kernel
Incorporada: 20/10/2022
Objetivo: 10/11/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The overlayfs stacking file system in Linux kernel does not properly validate the application of file capabilities against user namespaces, which could lead to privilege escalation.

Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability

Sin confirmar

CVE: CVE-2022-41352
Proveedor: Synacor
Producto: Zimbra Collaboration Suite (ZCS)
Incorporada: 20/10/2022
Objetivo: 10/11/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts.

Fortinet Multiple Products Authentication Bypass Vulnerability

Confirmado

CVE: CVE-2022-40684
Proveedor: Fortinet
Producto: Multiple Products
Incorporada: 11/10/2022
Objetivo: 01/11/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

Microsoft Windows COM+ Event System Service Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2022-41033
Proveedor: Microsoft
Producto: Windows COM+ Event System Service
Incorporada: 11/10/2022
Objetivo: 01/11/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows COM+ Event System Service contains an unspecified vulnerability that allows for privilege escalation.

Atlassian Bitbucket Server and Data Center Command Injection Vulnerability

Sin confirmar

CVE: CVE-2022-36804
Proveedor: Atlassian
Producto: Bitbucket Server and Data Center
Incorporada: 30/09/2022
Objetivo: 21/10/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request.

Microsoft Exchange Server Server-Side Request Forgery Vulnerability

Confirmado

CVE: CVE-2022-41040
Proveedor: Microsoft
Producto: Exchange Server
Incorporada: 30/09/2022
Objetivo: 21/10/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Exchange Server allows for server-side request forgery. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution.

Microsoft Exchange Server Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2022-41082
Proveedor: Microsoft
Producto: Exchange Server
Incorporada: 30/09/2022
Objetivo: 21/10/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution.

Sophos Firewall Code Injection Vulnerability

Sin confirmar

CVE: CVE-2022-3236
Proveedor: Sophos
Producto: Firewall
Incorporada: 23/09/2022
Objetivo: 14/10/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution.

Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2022-35405
Proveedor: Zoho
Producto: ManageEngine
Incorporada: 22/09/2022
Objetivo: 13/10/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability that allows for remote code execution.

Microsoft Windows Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2010-2568
Proveedor: Microsoft
Producto: Windows
Incorporada: 15/09/2022
Objetivo: 06/10/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the operating system displays the icon of a malicious shortcut file. An attacker who successfully exploited this vulnerability could execute code as the logged-on user.

Linux Kernel Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2013-2094
Proveedor: Linux
Producto: Kernel
Incorporada: 15/09/2022
Objetivo: 06/10/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Linux kernel fails to check all 64 bits of attr.config passed by user space, resulting to out-of-bounds access of the perf_swevent_enabled array in sw_perf_event_destroy(). Explotation allows for privilege escalation.

Linux Kernel Integer Overflow Vulnerability

Sin confirmar

CVE: CVE-2013-2596
Proveedor: Linux
Producto: Kernel
Incorporada: 15/09/2022
Objetivo: 06/10/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Linux kernel fb_mmap function in drivers/video/fbmem.c contains an integer overflow vulnerability that allows for privilege escalation.

Code Aurora ACDB Audio Driver Stack-based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2013-2597
Proveedor: Code Aurora
Producto: ACDB Audio Driver
Incorporada: 15/09/2022
Objetivo: 06/10/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Code Aurora audio calibration database (acdb) audio driver contains a stack-based buffer overflow vulnerability that allows for privilege escalation. Code Aurora is used in third-party products such as Qualcomm and Android.

Linux Kernel Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2013-6282
Proveedor: Linux
Producto: Kernel
Incorporada: 15/09/2022
Objetivo: 06/10/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The get_user and put_user API functions of the Linux kernel fail to validate the target address when being used on ARM v6k/v7 platforms. This allows an application to read and write kernel memory which could lead to privilege escalation.

Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability

Sin confirmar

CVE: CVE-2022-40139
Proveedor: Trend Micro
Producto: Apex One and Apex One as a Service
Incorporada: 15/09/2022
Objetivo: 06/10/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Trend Micro Apex One and Apex One as a Service contain an improper validation of rollback mechanism components that could lead to remote code execution.

Apple iOS, iPadOS, and macOS Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2022-32917
Proveedor: Apple
Producto: iOS, iPadOS, and macOS
Incorporada: 14/09/2022
Objetivo: 05/10/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple kernel, which is included in iOS, iPadOS, and macOS, contains an unspecified vulnerability where an application may be able to execute code with kernel privileges.

Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2022-37969
Proveedor: Microsoft
Producto: Windows
Incorporada: 14/09/2022
Objetivo: 05/10/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.

Android OS Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2011-1823
Proveedor: Android
Producto: Android OS
Incorporada: 08/09/2022
Objetivo: 29/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The vold volume manager daemon in Android kernel trusts messages from a PF_NETLINK socket, which allows an attacker to execute code and gain root privileges. This vulnerability is associated with GingerBreak and Exploit.AndroidOS.Lotoor.

D-Link DIR-300 Router Cleartext Storage of a Password Vulnerability

Sin confirmar

CVE: CVE-2011-4723
Proveedor: D-Link
Producto: DIR-300 Router
Incorporada: 08/09/2022
Objetivo: 29/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information.

NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability

Sin confirmar

CVE: CVE-2017-5521
Proveedor: NETGEAR
Producto: Multiple Devices
Incorporada: 08/09/2022
Objetivo: 29/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions. If the affected device has since entered end-of-life, it should be disconnected if still in use.
Descripción CISA: Multiple NETGEAR devices are prone to admin password disclosure via simple crafted requests to the web management server.

Fortinet FortiOS and FortiADC Improper Access Control Vulnerability

Confirmado

CVE: CVE-2018-13374
Proveedor: Fortinet
Producto: FortiOS and FortiADC
Incorporada: 08/09/2022
Objetivo: 29/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server.

Oracle WebLogic Server Unspecified Vulnerability

Sin confirmar

CVE: CVE-2018-2628
Proveedor: Oracle
Producto: WebLogic Server
Incorporada: 08/09/2022
Objetivo: 29/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Oracle WebLogic Server contains an unspecified vulnerability which can allow an unauthenticated attacker with T3 network access to compromise the server.

D-Link Multiple Routers OS Command Injection Vulnerability

Confirmado

CVE: CVE-2018-6530
Proveedor: D-Link
Producto: Multiple Routers
Incorporada: 08/09/2022
Objetivo: 29/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use.
Descripción CISA: Multiple D-Link routers contain an unspecified vulnerability that allows for execution of OS commands.

MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2018-7445
Proveedor: MikroTik
Producto: RouterOS
Incorporada: 08/09/2022
Objetivo: 29/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: In MikroTik RouterOS, a stack-based buffer overflow occurs when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system.

Apple iOS, iPadOS, and macOS Input Validation Vulnerability

Sin confirmar

CVE: CVE-2020-9934
Proveedor: Apple
Producto: iOS, iPadOS, and macOS
Incorporada: 08/09/2022
Objetivo: 29/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, iPadOS, and macOS contain an unspecified vulnerability involving input validation which can allow a local attacker to view sensitive user information.

D-Link DIR-820L Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2022-26258
Proveedor: D-Link
Producto: DIR-820L
Incorporada: 08/09/2022
Objetivo: 29/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: D-Link DIR-820L contains an unspecified vulnerability in Device Name parameter in /lan.asp which allows for remote code execution.

QNAP Photo Station Externally Controlled Reference Vulnerability

Confirmado

CVE: CVE-2022-27593
Proveedor: QNAP
Producto: Photo Station
Incorporada: 08/09/2022
Objetivo: 29/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign.

Google Chromium Mojo Insufficient Data Validation Vulnerability

Sin confirmar

CVE: CVE-2022-3075
Proveedor: Google
Producto: Chromium Mojo
Incorporada: 08/09/2022
Objetivo: 29/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium Mojo contains an insufficient data validation vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability

Sin confirmar

CVE: CVE-2020-28949
Proveedor: PEAR
Producto: Archive_Tar
Incorporada: 25/08/2022
Objetivo: 15/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: PEAR Archive_Tar allows an unserialization attack because phar: is blocked but PHAR: is not blocked. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.

PEAR Archive_Tar Improper Link Resolution Vulnerability

Sin confirmar

CVE: CVE-2020-36193
Proveedor: PEAR
Producto: Archive_Tar
Incorporada: 25/08/2022
Objetivo: 15/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: PEAR Archive_Tar Tar.php allows write operations with directory traversal due to inadequate checking of symbolic links. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.

Apple iOS, macOS, watchOS Sandbox Bypass Vulnerability

Sin confirmar

CVE: CVE-2021-31010
Proveedor: Apple
Producto: iOS, macOS, watchOS
Incorporada: 25/08/2022
Objetivo: 15/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: In affected versions of Apple iOS, macOS, and watchOS, a sandboxed process may be able to circumvent sandbox restrictions.

Delta Electronics DOPSoft 2 Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2021-38406
Proveedor: Delta Electronics
Producto: DOPSoft 2
Incorporada: 25/08/2022
Objetivo: 15/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Delta Electronics DOPSoft 2 lacks proper validation of user-supplied data when parsing specific project files (improper input validation) resulting in an out-of-bounds write that allows for code execution.

Grafana Authentication Bypass Vulnerability

Sin confirmar

CVE: CVE-2021-39226
Proveedor: Grafana Labs
Producto: Grafana
Incorporada: 25/08/2022
Objetivo: 15/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Grafana contains an authentication bypass vulnerability that allows authenticated and unauthenticated users to view and delete all snapshot data, potentially resulting in complete snapshot data loss.

WebRTC Heap Buffer Overflow Vulnerability

Confirmado

CVE: CVE-2022-2294
Proveedor: WebRTC
Producto: WebRTC
Incorporada: 25/08/2022
Objetivo: 15/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows an attacker to perform shellcode execution. This vulnerability impacts web browsers using WebRTC including but not limited to Google Chrome.

VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2022-22963
Proveedor: VMware Tanzu
Producto: Spring Cloud
Incorporada: 25/08/2022
Objetivo: 15/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

Apache APISIX Authentication Bypass Vulnerability

Sin confirmar

CVE: CVE-2022-24112
Proveedor: Apache
Producto: APISIX
Incorporada: 25/08/2022
Objetivo: 15/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution.

Apache CouchDB Insecure Default Initialization of Resource Vulnerability

Sin confirmar

CVE: CVE-2022-24706
Proveedor: Apache
Producto: CouchDB
Incorporada: 25/08/2022
Objetivo: 15/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow an attacker to escalate to administrative privileges.

dotCMS Unrestricted Upload of File Vulnerability

Confirmado

CVE: CVE-2022-26352
Proveedor: dotCMS
Producto: dotCMS
Incorporada: 25/08/2022
Objetivo: 15/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: dotCMS ContentResource API contains an unrestricted upload of file with a dangerous type vulnerability that allows for directory traversal, in which the file is saved outside of the intended storage location. Exploitation allows for remote code execution.

Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability

Sin confirmar

CVE: CVE-2022-0028
Proveedor: Palo Alto Networks
Producto: PAN-OS
Incorporada: 22/08/2022
Objetivo: 12/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A Palo Alto Networks PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks.

Palo Alto Networks PAN-OS Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2017-15944
Proveedor: Palo Alto Networks
Producto: PAN-OS
Incorporada: 18/08/2022
Objetivo: 08/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Palo Alto Networks PAN-OS contains multiple, unspecified vulnerabilities which can allow for remote code execution when chained.

Microsoft Windows Runtime Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2022-21971
Proveedor: Microsoft
Producto: Windows
Incorporada: 18/08/2022
Objetivo: 08/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Runtime contains an unspecified vulnerability that allows for remote code execution.

SAP Multiple Products HTTP Request Smuggling Vulnerability

Sin confirmar

CVE: CVE-2022-22536
Proveedor: SAP
Producto: Multiple Products
Incorporada: 18/08/2022
Objetivo: 08/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.

Microsoft Active Directory Domain Services Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2022-26923
Proveedor: Microsoft
Producto: Active Directory
Incorporada: 18/08/2022
Objetivo: 08/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: An authenticated user could manipulate attributes on computer accounts they own or manage, and acquire a certificate from Active Directory Certificate Services that would allow for privilege escalation to SYSTEM.

Google Chromium Intents Insufficient Input Validation Vulnerability

Sin confirmar

CVE: CVE-2022-2856
Proveedor: Google
Producto: Chromium Intents
Incorporada: 18/08/2022
Objetivo: 08/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium Intents contains an insufficient validation of untrusted input vulnerability that allows a remote attacker to browse to a malicious website via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Apple iOS and macOS Out-of-Bounds Write Vulnerability

Sin confirmar

CVE: CVE-2022-32893
Proveedor: Apple
Producto: iOS and macOS
Incorporada: 18/08/2022
Objetivo: 08/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS and macOS contain an out-of-bounds write vulnerability that could allow for remote code execution when processing malicious crafted web content.

Apple iOS and macOS Out-of-Bounds Write Vulnerability

Sin confirmar

CVE: CVE-2022-32894
Proveedor: Apple
Producto: iOS and macOS
Incorporada: 18/08/2022
Objetivo: 08/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS and macOS contain an out-of-bounds write vulnerability that could allow an application to execute code with kernel privileges.

Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability

Confirmado

CVE: CVE-2022-27925
Proveedor: Synacor
Producto: Zimbra Collaboration Suite (ZCS)
Incorporada: 11/08/2022
Objetivo: 01/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution.

Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability

Confirmado

CVE: CVE-2022-37042
Proveedor: Synacor
Producto: Zimbra Collaboration Suite (ZCS)
Incorporada: 11/08/2022
Objetivo: 01/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Synacor Zimbra Collaboration Suite (ZCS) contains an authentication bypass vulnerability in MailboxImportServlet. This vulnerability was chained with CVE-2022-27925 which allows for unauthenticated remote code execution.

RARLAB UnRAR Directory Traversal Vulnerability

Confirmado

CVE: CVE-2022-30333
Proveedor: RARLAB
Producto: UnRAR
Incorporada: 09/08/2022
Objetivo: 30/08/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: RARLAB UnRAR on Linux and UNIX contains a directory traversal vulnerability, allowing an attacker to write to files during an extract (unpack) operation.

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2022-34713
Proveedor: Microsoft
Producto: Windows
Incorporada: 09/08/2022
Objetivo: 30/08/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A remote code execution vulnerability exists when Microsoft Windows MSDT is called using the URL protocol from a calling application.

Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability

Confirmado

CVE: CVE-2022-27924
Proveedor: Synacor
Producto: Zimbra Collaboration Suite (ZCS)
Incorporada: 04/08/2022
Objetivo: 25/08/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to inject memcache commands into a targeted instance which causes an overwrite of arbitrary cached entries.

Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability

Sin confirmar

CVE: CVE-2022-26138
Proveedor: Atlassian
Producto: Confluence
Incorporada: 29/07/2022
Objetivo: 19/08/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group.

Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2022-22047
Proveedor: Microsoft
Producto: Windows
Incorporada: 12/07/2022
Objetivo: 02/08/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows CSRSS contains an unspecified vulnerability that allows for privilege escalation to SYSTEM privileges.

Microsoft Windows LSA Spoofing Vulnerability

Sin confirmar

CVE: CVE-2022-26925
Proveedor: Microsoft
Producto: Windows
Incorporada: 01/07/2022
Objetivo: 22/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply remediation actions outlined in CISA guidance [https://www.cisa.gov/guidance-applying-june-microsoft-patch].
Descripción CISA: Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM.

Apple Multiple Products Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2018-4344
Proveedor: Apple
Producto: Multiple Products
Incorporada: 27/06/2022
Objetivo: 18/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability which can allow for code execution.

Apple Multiple Products Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2019-8605
Proveedor: Apple
Producto: Multiple Products
Incorporada: 27/06/2022
Objetivo: 18/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A use-after-free vulnerability in Apple iOS, macOS, tvOS, and watchOS could allow a malicious application to execute code with system privileges.

Apple Multiple Products Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2020-3837
Proveedor: Apple
Producto: Multiple Products
Incorporada: 27/06/2022
Objetivo: 18/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges.

Apple Multiple Products Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2020-9907
Proveedor: Apple
Producto: Multiple Products
Incorporada: 27/06/2022
Objetivo: 18/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, iPadOS, and tvOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges.

Google Chromium PopupBlocker Security Bypass Vulnerability

Sin confirmar

CVE: CVE-2021-30533
Proveedor: Google
Producto: Chromium PopupBlocker
Incorporada: 27/06/2022
Objetivo: 18/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium PopupBlocker contains an insufficient policy enforcement vulnerability that allows a remote attacker to bypass navigation restrictions via a crafted iframe. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Apple iOS and iPadOS Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2021-30983
Proveedor: Apple
Producto: iOS and iPadOS
Incorporada: 27/06/2022
Objetivo: 18/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS and iPadOS contain a buffer overflow vulnerability that could allow an application to execute code with kernel privileges.

Red Hat Polkit Out-of-Bounds Read and Write Vulnerability

Sin confirmar

CVE: CVE-2021-4034
Proveedor: Red Hat
Producto: Polkit
Incorporada: 27/06/2022
Objetivo: 18/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.

Mitel MiVoice Connect Data Validation Vulnerability

Confirmado

CVE: CVE-2022-29499
Proveedor: Mitel
Producto: MiVoice Connect
Incorporada: 27/06/2022
Objetivo: 18/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation.

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2022-30190
Proveedor: Microsoft
Producto: Windows
Incorporada: 14/06/2022
Objetivo: 05/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.

SAP NetWeaver SQL Injection Vulnerability

Sin confirmar

CVE: CVE-2016-2386
Proveedor: SAP
Producto: NetWeaver
Incorporada: 09/06/2022
Objetivo: 30/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

SAP NetWeaver Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2016-2388
Proveedor: SAP
Producto: NetWeaver
Incorporada: 09/06/2022
Objetivo: 30/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request.

SAP NetWeaver Unrestricted File Upload Vulnerability

Sin confirmar

CVE: CVE-2021-38163
Proveedor: SAP
Producto: NetWeaver
Incorporada: 09/06/2022
Objetivo: 30/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: SAP NetWeaver contains a vulnerability that allows unrestricted file upload.

Microsoft Word Malformed Object Pointer Vulnerability

Sin confirmar

CVE: CVE-2006-2492
Proveedor: Microsoft
Producto: Word
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Word and Microsoft Works Suites contain a malformed object pointer which allows attackers to execute code.

Adobe Acrobat and Reader Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2007-5659
Proveedor: Adobe
Producto: Acrobat and Reader
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Adobe Acrobat and Reader contain a buffer overflow vulnerability that allows remote attackers to execute code via a PDF file with long arguments to unspecified JavaScript methods.

Adobe Acrobat and Reader Unspecified Vulnerability

Sin confirmar

CVE: CVE-2008-0655
Proveedor: Adobe
Producto: Acrobat and Reader
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Adobe Acrobat and Reader contains an unespecified vulnerability described as a design flaw which could allow a specially crafted file to be printed silently an arbitrary number of times.

Microsoft Office Object Record Corruption Vulnerability

Sin confirmar

CVE: CVE-2009-0557
Proveedor: Microsoft
Producto: Office
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Office contains an object record corruption vulnerability that allows remote attackers to execute code via a crafted Excel file with a malformed record object.

Microsoft Office Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2009-0563
Proveedor: Microsoft
Producto: Office
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via a Word document with a crafted tag containing an invalid length field.

Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability

Sin confirmar

CVE: CVE-2009-1862
Proveedor: Adobe
Producto: Acrobat and Reader, Flash Player
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: For Adobe Acrobat and Reader, apply updates per vendor instructions. For Adobe Flash Player, the impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Adobe Acrobat and Reader and Adobe Flash Player allows remote attackers to execute code or cause denial-of-service (DoS).

Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2009-3953
Proveedor: Adobe
Producto: Acrobat and Reader
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Adobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution.

Adobe Acrobat and Reader Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2009-4324
Proveedor: Adobe
Producto: Acrobat and Reader
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Use-after-free vulnerability in Adobe Acrobat and Reader allows remote attackers to execute code via a crafted PDF file.

Adobe Flash Player Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2010-1297
Proveedor: Adobe
Producto: Flash Player
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).

Microsoft PowerPoint Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2010-2572
Proveedor: Microsoft
Producto: PowerPoint
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft PowerPoint contains a buffer overflow vulnerability that alllows for remote code execution.

Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2010-2883
Proveedor: Adobe
Producto: Acrobat and Reader
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Adobe Acrobat and Reader contain a stack-based buffer overflow vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).

Adobe Flash Player Unspecified Vulnerability

Sin confirmar

CVE: CVE-2011-0609
Proveedor: Adobe
Producto: Flash Player
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Adobe Flash Player contains an unspecified vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).

Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2011-2462
Proveedor: Adobe
Producto: Reader and Acrobat
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Universal 3D (U3D) component in Adobe Reader and Acrobat contains a memory corruption vulnerability which could allow remote attackers to execute code or cause denial-of-service (DoS).

Microsoft Windows Authenticode Signature Verification Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2012-0151
Proveedor: Microsoft
Producto: Windows
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Authenticode Signature Verification function in Microsoft Windows (WinVerifyTrust) does not properly validate the digest of a signed portable executable (PE) file, which allows user-assisted remote attackers to execute code.

Adobe Flash Player Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2012-0754
Proveedor: Adobe
Producto: Flash Player
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).

Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability

Sin confirmar

CVE: CVE-2012-0767
Proveedor: Adobe
Producto: Flash Player
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Adobe Flash Player contains a XSS vulnerability that allows remote attackers to inject web script or HTML.

Microsoft XML Core Services Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2012-1889
Proveedor: Microsoft
Producto: XML Core Services
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft XML Core Services contains a memory corruption vulnerability which could allow for remote code execution.

Microsoft Internet Explorer Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2012-4969
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Internet Explorer contains a use-after-free vulnerability that allows remote attackers to execute code via a crafted web site.

Adobe Flash Player Integer Overflow Vulnerability

Sin confirmar

CVE: CVE-2012-5054
Proveedor: Adobe
Producto: Flash Player
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Adobe Flash Player contains an integer overflow vulnerability that allows remote attackers to execute code via malformed arguments.

Microsoft Office Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2013-1331
Proveedor: Microsoft
Producto: Office
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via crafted PNG data in an Office document.

Google Chromium V8 Out-of-Bounds Read Vulnerability

Sin confirmar

CVE: CVE-2016-1646
Proveedor: Google
Producto: Chromium V8
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium V8 Engine contains an out-of-bounds read vulnerability that allows a remote attacker to cause a denial of service or possibly have another unspecified impact via crafted JavaScript code. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Google Chromium V8 Out-of-Bounds Memory Vulnerability

Sin confirmar

CVE: CVE-2016-5198
Proveedor: Google
Producto: Chromium V8
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to perform read/write operations, leading to code execution, via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Google Chromium V8 Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2017-5030
Proveedor: Google
Producto: Chromium V8
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium V8 Engine contains a memory corruption vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Google Chromium V8 Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2017-5070
Proveedor: Google
Producto: Chromium V8
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

NETGEAR Multiple Devices Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2017-6862
Proveedor: NETGEAR
Producto: Multiple Devices
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Multiple NETGEAR devices contain a buffer overflow vulnerability that allows for authentication bypass and remote code execution.

Google Chromium V8 Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2018-17463
Proveedor: Google
Producto: Chromium V8
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium V8 Engine contains an unspecified vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Google Chromium V8 Out-of-Bounds Write Vulnerability

Sin confirmar

CVE: CVE-2018-17480
Proveedor: Google
Producto: Chromium V8
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium V8 Engine contains out-of-bounds write vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Adobe Acrobat and Reader Double Free Vulnerability

Sin confirmar

CVE: CVE-2018-4990
Proveedor: Adobe
Producto: Acrobat and Reader
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Adobe Acrobat and Reader have a double free vulnerability that could lead to remote code execution.

Google Chromium V8 Integer Overflow Vulnerability

Sin confirmar

CVE: CVE-2018-6065
Proveedor: Google
Producto: Chromium V8
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium V8 Engine contains an integer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability

Sin confirmar

CVE: CVE-2019-15271
Proveedor: Cisco
Producto: RV Series Routers
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A deserialization of untrusted data vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an attacker to execute code with root privileges.

Google Chromium V8 Out-of-Bounds Write Vulnerability

Sin confirmar

CVE: CVE-2019-5825
Proveedor: Google
Producto: Chromium V8
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium V8 Engine contains an out-of-bounds write vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

QNAP Photo Station Improper Access Control Vulnerability

Confirmado

CVE: CVE-2019-7192
Proveedor: QNAP
Producto: Photo Station
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing remote attackers to gain unauthorized access to the system.

QNAP QTS Improper Input Validation Vulnerability

Confirmado

CVE: CVE-2019-7193
Proveedor: QNAP
Producto: QTS
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: QNAP QTS contains an improper input validation vulnerability allowing remote attackers to inject code on the system.

QNAP Photo Station Path Traversal Vulnerability

Confirmado

CVE: CVE-2019-7194
Proveedor: QNAP
Producto: Photo Station
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.

QNAP Photo Station Path Traversal Vulnerability

Confirmado

CVE: CVE-2019-7195
Proveedor: QNAP
Producto: Photo Station
Incorporada: 08/06/2022
Objetivo: 22/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.

Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2022-26134
Proveedor: Atlassian
Producto: Confluence Server/Data Center
Incorporada: 02/06/2022
Objetivo: 06/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.
Descripción CISA: Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution.

Red Hat JBoss Authentication Bypass Vulnerability

Confirmado

CVE: CVE-2010-0738
Proveedor: Red Hat
Producto: JBoss
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.

Oracle JRE Unspecified Vulnerability

Sin confirmar

CVE: CVE-2010-0840
Proveedor: Oracle
Producto: Java Runtime Environment (JRE)
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Unspecified vulnerability in the Java Runtime Environment (JRE) in Java SE component allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors.

Red Hat JBoss Information Disclosure Vulnerability

Confirmado

CVE: CVE-2010-1428
Proveedor: Red Hat
Producto: JBoss
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw to gain access to sensitive information.

Oracle Fusion Middleware Unspecified Vulnerability

Confirmado

CVE: CVE-2012-1710
Proveedor: Oracle
Producto: Fusion Middleware
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Designer.

Microsoft Silverlight Double Dereference Vulnerability

Confirmado

CVE: CVE-2013-0074
Proveedor: Microsoft
Producto: Silverlight
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Microsoft Silverlight does not properly validate pointers during HTML object rendering, which allows remote attackers to execute code via a crafted Silverlight application.

Oracle JRE Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2013-0422
Proveedor: Oracle
Producto: Java Runtime Environment (JRE)
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in the way Java restricts the permissions of Java applets could allow an attacker to execute commands on a vulnerable system.

Oracle JRE Sandbox Bypass Vulnerability

Confirmado

CVE: CVE-2013-0431
Proveedor: Oracle
Producto: Java Runtime Environment (JRE)
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle allows remote attackers to bypass the Java security sandbox.

Oracle JRE Unspecified Vulnerability

Sin confirmar

CVE: CVE-2013-2423
Proveedor: Oracle
Producto: Java Runtime Environment (JRE)
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Unspecified vulnerability in hotspot for Java Runtime Environment (JRE) allows remote attackers to affect integrity.

Microsoft Silverlight Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2013-3896
Proveedor: Microsoft
Producto: Silverlight
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Microsoft Silverlight does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application.

IBM InfoSphere BigInsights Invalid Input Vulnerability

Confirmado

CVE: CVE-2013-3993
Proveedor: IBM
Producto: InfoSphere BigInsights
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Certain APIs within BigInsights can take invalid input that might allow attackers unauthorized access to read, write, modify, or delete data.

Microsoft Internet Explorer Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2013-7331
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: An information disclosure vulnerability exists in Internet Explorer which allows resources loaded into memory to be queried. This vulnerability could allow an attacker to detect anti-malware applications.

Adobe Reader and Acrobat Sandbox Bypass Vulnerability

Sin confirmar

CVE: CVE-2014-0546
Proveedor: Adobe
Producto: Reader and Acrobat
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Adobe Reader and Acrobat on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context.

Microsoft Internet Explorer Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2014-2817
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Internet Explorer cotains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site.

Linux Kernel Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2014-3153
Proveedor: Linux
Producto: Kernel
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The futex_requeue function in kernel/futex.c in Linux kernel does not ensure that calls have two different futex addresses, which allows local users to gain privileges.

Microsoft IME Japanese Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2014-4077
Proveedor: Microsoft
Producto: Input Method Editor (IME) Japanese
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Input Method Editor (IME) Japanese is a keyboard with Japanese characters that can be enabled on Windows systems as it is included by default (with the default set as disabled). IME Japanese contains an unspecified vulnerability when IMJPDCT.EXE (IME for Japanese) is installed which allows attackers to bypass a sandbox and perform privilege escalation.

Microsoft Internet Explorer Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2014-4123
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Internet Explorer contains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site.

Microsoft Windows Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2014-4148
Proveedor: Microsoft
Producto: Windows
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A remote code execution vulnerability exists when the Windows kernel-mode driver improperly handles TrueType fonts.

Adobe Flash Player Dereferenced Pointer Vulnerability

Sin confirmar

CVE: CVE-2014-8439
Proveedor: Adobe
Producto: Flash Player
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Adobe Flash Player has a vulnerability in the way it handles a dereferenced memory pointer which could lead to code execution.

Microsoft Windows TS WebProxy Directory Traversal Vulnerability

Sin confirmar

CVE: CVE-2015-0016
Proveedor: Microsoft
Producto: Windows
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Directory traversal vulnerability in the TS WebProxy (TSWbPrxy) component in Microsoft Windows allows remote attackers to escalate privileges.

Microsoft Internet Explorer ASLR Bypass Vulnerability

Sin confirmar

CVE: CVE-2015-0071
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Internet Explorer allows remote attackers to bypass the address space layout randomization (ASLR) protection mechanism via a crafted web site.

Adobe Flash Player ASLR Bypass Vulnerability

Sin confirmar

CVE: CVE-2015-0310
Proveedor: Adobe
Producto: Flash Player
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Adobe Flash Player does not properly restrict discovery of memory addresses, which allows attackers to bypass the address space layout randomization (ASLR) protection mechanism.

Microsoft Windows Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2015-1671
Proveedor: Microsoft
Producto: Windows
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A remote code execution vulnerability exists when components of Windows, .NET Framework, Office, Lync, and Silverlight fail to properly handle TrueType fonts.

Microsoft Windows Mount Manager Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2015-1769
Proveedor: Microsoft
Producto: Windows
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A privilege escalation vulnerability exists when the Windows Mount Manager component improperly processes symbolic links.

Microsoft Win32k Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2015-2360
Proveedor: Microsoft
Producto: Win32k
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Win32k.sys in the kernel-mode drivers in Microsoft Windows allows local users to gain privileges or cause denial-of-service (DoS).

Microsoft Internet Explorer Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2015-2425
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).

Mozilla Firefox Security Feature Bypass Vulnerability

Sin confirmar

CVE: CVE-2015-4495
Proveedor: Mozilla
Producto: Firefox
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Moxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges.

Microsoft Windows Kernel Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2015-6175
Proveedor: Microsoft
Producto: Windows
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The kernel in Microsoft Windows contains a vulnerability that allows local users to gain privileges via a crafted application.

Adobe Flash Player Integer Overflow Vulnerability

Sin confirmar

CVE: CVE-2015-8651
Proveedor: Adobe
Producto: Flash Player
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Integer overflow in Adobe Flash Player allows attackers to execute code.

Microsoft Silverlight Runtime Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2016-0034
Proveedor: Microsoft
Producto: Silverlight
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted products are end-of-life and should be disconnected if still in use.
Descripción CISA: Microsoft Silverlight mishandles negative offsets during decoding, which allows attackers to execute remote code or cause a denial-of-service (DoS).

Adobe Flash Player and AIR Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2016-0984
Proveedor: Adobe
Producto: Flash Player and AIR
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted products are end-of-life and should be disconnected if still in use.
Descripción CISA: Use-after-free vulnerability in Adobe Flash Player and Adobe AIR allows attackers to execute code.

Adobe Flash Player and AIR Integer Overflow Vulnerability

Sin confirmar

CVE: CVE-2016-1010
Proveedor: Adobe
Producto: Flash Player and AIR
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted products are end-of-life and should be disconnected if still in use.
Descripción CISA: Integer overflow vulnerability in Adobe Flash Player and AIR allows attackers to execute code.

Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2016-3393
Proveedor: Microsoft
Producto: Windows
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A remote code execution vulnerability exists due to the way the Windows GDI component handles objects in the memory. An attacker who successfully exploits this vulnerability could take control of the affected system.

Microsoft Windows Open Type Font Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2016-7256
Proveedor: Microsoft
Producto: Windows
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploits this vulnerability could take control of the affected system.

Oracle Solaris Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2019-3010
Proveedor: Oracle
Producto: Solaris
Incorporada: 25/05/2022
Objetivo: 15/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Oracle Solaris component: XScreenSaver contains an unspecified vulnerability that allows for privilege escalation.

Microsoft Internet Explorer Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2016-0162
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 24/05/2022
Objetivo: 14/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: An information disclosure vulnerability exists when Internet Explorer does not properly handle JavaScript. The vulnerability could allow an attacker to detect specific files on the user's computer.

Microsoft Internet Explorer Messaging API Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2016-3298
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 24/05/2022
Objetivo: 14/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: An information disclosure vulnerability exists when the Microsoft Internet Messaging API improperly handles objects in memory. An attacker who successfully exploited this vulnerability could allow the attacker to test for the presence of files on disk.

Microsoft Internet Explorer and Edge Information Disclosure Vulnerability

Confirmado

CVE: CVE-2016-3351
Proveedor: Microsoft
Producto: Internet Explorer and Edge
Incorporada: 24/05/2022
Objetivo: 14/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer.

Apple iOS Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2016-4655
Proveedor: Apple
Producto: iOS
Incorporada: 24/05/2022
Objetivo: 14/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Apple iOS kernel allows attackers to obtain sensitive information from memory via a crafted application.

Apple iOS Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2016-4656
Proveedor: Apple
Producto: iOS
Incorporada: 24/05/2022
Objetivo: 14/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A memory corruption vulnerability in Apple iOS kernel allows attackers to execute code in a privileged context or cause a denial-of-service (DoS) via a crafted application.

Apple iOS Webkit Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2016-4657
Proveedor: Apple
Producto: iOS
Incorporada: 24/05/2022
Objetivo: 14/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS WebKit contains a memory corruption vulnerability that allows attackers to execute remote code or cause a denial-of-service (DoS) via a crafted web site. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2016-6366
Proveedor: Cisco
Producto: Adaptive Security Appliance (ASA)
Incorporada: 24/05/2022
Objetivo: 14/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) code of Cisco ASA software could allow an attacker to cause a reload of the affected system or to remotely execute code.

Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2016-6367
Proveedor: Cisco
Producto: Adaptive Security Appliance (ASA)
Incorporada: 24/05/2022
Objetivo: 14/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in the command-line interface (CLI) parser of Cisco ASA software could allow an authenticated, local attacker to create a denial-of-service (DoS) condition or potentially execute code.

Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2017-0005
Proveedor: Microsoft
Producto: Windows
Incorporada: 24/05/2022
Objetivo: 14/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Graphics Device Interface (GDI) in Microsoft Windows allows local users to gain privileges via a crafted application.

Microsoft XML Core Services Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2017-0022
Proveedor: Microsoft
Producto: XML Core Services
Incorporada: 24/05/2022
Objetivo: 14/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft XML Core Services (MSXML) improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site.

Microsoft Windows SMBv1 Information Disclosure Vulnerability

Confirmado

CVE: CVE-2017-0147
Proveedor: Microsoft
Producto: SMBv1 server
Incorporada: 24/05/2022
Objetivo: 14/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet.

Microsoft Internet Explorer Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2017-0149
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 24/05/2022
Objetivo: 14/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial-of-service (DoS) via a crafted website.

Microsoft Internet Explorer Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2017-0210
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 24/05/2022
Objetivo: 14/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A privilege escalation vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information.

Kaseya VSA SQL Injection Vulnerability

Confirmado

CVE: CVE-2017-18362
Proveedor: Kaseya
Producto: Virtual System/Server Administrator (VSA)
Incorporada: 24/05/2022
Objetivo: 14/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: ConnectWise ManagedITSync integration for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database.

Artifex Ghostscript Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2017-8291
Proveedor: Artifex
Producto: Ghostscript
Incorporada: 24/05/2022
Objetivo: 14/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Artifex Ghostscript allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile.

Microsoft Windows Search Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2017-8543
Proveedor: Microsoft
Producto: Windows
Incorporada: 24/05/2022
Objetivo: 14/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows allows an attacker to take control of the affected system when Windows Search fails to handle objects in memory.

QNAP NAS File Station Cross-Site Scripting Vulnerability

Confirmado

CVE: CVE-2018-19943
Proveedor: QNAP
Producto: Network Attached Storage (NAS)
Incorporada: 24/05/2022
Objetivo: 14/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.

QNAP NAS File Station Command Injection Vulnerability

Confirmado

CVE: CVE-2018-19949
Proveedor: QNAP
Producto: Network Attached Storage (NAS)
Incorporada: 24/05/2022
Objetivo: 14/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.

QNAP NAS File Station Cross-Site Scripting Vulnerability

Confirmado

CVE: CVE-2018-19953
Proveedor: QNAP
Producto: Network Attached Storage (NAS)
Incorporada: 24/05/2022
Objetivo: 14/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.

Microsoft Windows Kernel Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2018-8611
Proveedor: Microsoft
Producto: Windows
Incorporada: 24/05/2022
Objetivo: 14/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory.

Adobe Flash Player Stack-based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2018-5002
Proveedor: Adobe
Producto: Flash Player
Incorporada: 23/05/2022
Objetivo: 13/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Adobe Flash Player have a stack-based buffer overflow vulnerability that could lead to remote code execution.

Microsoft Win32k Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2018-8589
Proveedor: Microsoft
Producto: Win32k
Incorporada: 23/05/2022
Objetivo: 13/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A privilege escalation vulnerability exists when Windows improperly handles calls to Win32k.sys. An attacker who successfully exploited this vulnerability could run remote code in the security context of the local system.

Microsoft Internet Explorer Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2019-0676
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 23/05/2022
Objetivo: 13/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. An attacker who successfully exploited this vulnerability could test for the presence of files on disk.

Microsoft Windows SMB Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2019-0703
Proveedor: Microsoft
Producto: Windows
Incorporada: 23/05/2022
Objetivo: 13/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, which could lead to information disclosure from the server.

Microsoft Windows Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2019-0880
Proveedor: Microsoft
Producto: Windows
Incorporada: 23/05/2022
Objetivo: 13/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls. An attacker who successfully exploited the vulnerability could elevate privileges on an affected system from low-integrity to medium-integrity.

Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2019-1130
Proveedor: Microsoft
Producto: Windows
Incorporada: 23/05/2022
Objetivo: 13/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A privilege escalation vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links.

Mozilla Firefox and Thunderbird Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2019-11707
Proveedor: Mozilla
Producto: Firefox and Thunderbird
Incorporada: 23/05/2022
Objetivo: 13/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash.

Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability

Sin confirmar

CVE: CVE-2019-11708
Proveedor: Mozilla
Producto: Firefox and Thunderbird
Incorporada: 23/05/2022
Objetivo: 13/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Mozilla Firefox and Thunderbird contain a sandbox escape vulnerability that could result in remote code execution.

Google Chrome WebAudio Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2019-13720
Proveedor: Google
Producto: Chrome WebAudio
Incorporada: 23/05/2022
Objetivo: 13/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chrome WebAudio contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2019-1385
Proveedor: Microsoft
Producto: Windows
Incorporada: 23/05/2022
Objetivo: 13/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A privilege escalation vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.

WhatsApp Cross-Site Scripting Vulnerability

Sin confirmar

CVE: CVE-2019-18426
Proveedor: Meta Platforms
Producto: WhatsApp
Incorporada: 23/05/2022
Objetivo: 13/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in WhatsApp Desktop when paired with WhatsApp for iPhone allows cross-site scripting and local file reading.

Google Chrome Blink Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2019-5786
Proveedor: Google
Producto: Chrome Blink
Incorporada: 23/05/2022
Objetivo: 13/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chrome Blink contains a heap use-after-free vulnerability that allows an attacker to potentially perform out of bounds memory access via a crafted HTML page.

Apple Multiple Products Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2019-7286
Proveedor: Apple
Producto: Multiple Products
Incorporada: 23/05/2022
Objetivo: 13/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for privilege escalation.

Apple iOS Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2019-7287
Proveedor: Apple
Producto: iOS
Incorporada: 23/05/2022
Objetivo: 13/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS contains a memory corruption vulnerability which could allow an attacker to perform remote code execution.

WebKitGTK Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2019-8720
Proveedor: WebKitGTK
Producto: WebKitGTK
Incorporada: 23/05/2022
Objetivo: 13/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: WebKitGTK contains a memory corruption vulnerability which can allow an attacker to perform remote code execution.

Microsoft Update Notification Manager Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2020-0638
Proveedor: Microsoft
Producto: Update Notification Manager
Incorporada: 23/05/2022
Objetivo: 13/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Update Notification Manager contains an unspecified vulnerability that allows for privilege escalation.

Microsoft Windows Kernel Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2020-1027
Proveedor: Microsoft
Producto: Windows
Incorporada: 23/05/2022
Objetivo: 13/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.

Android Kernel Race Condition Vulnerability

Sin confirmar

CVE: CVE-2021-0920
Proveedor: Android
Producto: Kernel
Incorporada: 23/05/2022
Objetivo: 13/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Android kernel contains a race condition, which allows for a use-after-free vulnerability. Exploitation can allow for privilege escalation.

Android Kernel Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2021-1048
Proveedor: Android
Producto: Kernel
Incorporada: 23/05/2022
Objetivo: 13/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Android kernel contains a use-after-free vulnerability that allows for privilege escalation.

Apple Multiple Products Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2021-30883
Proveedor: Apple
Producto: Multiple Products
Incorporada: 23/05/2022
Objetivo: 13/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for remote code execution.

Cisco IOS XR Open Port Vulnerability

Sin confirmar

CVE: CVE-2022-20821
Proveedor: Cisco
Producto: IOS XR
Incorporada: 23/05/2022
Objetivo: 13/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Cisco IOS XR software health check opens TCP port 6379 by default on activation. An attacker can connect to the Redis instance on the open port and allow access to the Redis instance that is running within the NOSi container.

VMware Spring Cloud Gateway Code Injection Vulnerability

Sin confirmar

CVE: CVE-2022-22947
Proveedor: VMware
Producto: Spring Cloud Gateway
Incorporada: 16/05/2022
Objetivo: 06/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured.

Zyxel Multiple Firewalls OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2022-30525
Proveedor: Zyxel
Producto: Multiple Firewalls
Incorporada: 16/05/2022
Objetivo: 06/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.

F5 BIG-IP Missing Authentication Vulnerability

Confirmado

CVE: CVE-2022-1388
Proveedor: F5
Producto: BIG-IP
Incorporada: 10/05/2022
Objetivo: 31/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services.

OpenSSL Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2014-0160
Proveedor: OpenSSL
Producto: OpenSSL
Incorporada: 04/05/2022
Objetivo: 25/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information.

Microsoft Internet Explorer Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2014-0322
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 04/05/2022
Objetivo: 25/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute code.

Microsoft Win32k Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2014-4113
Proveedor: Microsoft
Producto: Win32k
Incorporada: 04/05/2022
Objetivo: 25/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.

Apple Multiple Products Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2019-8506
Proveedor: Apple
Producto: Multiple Products
Incorporada: 04/05/2022
Objetivo: 25/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution.

Apple Multiple Products Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2021-1789
Proveedor: Apple
Producto: Multiple Products
Incorporada: 04/05/2022
Objetivo: 25/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution.

Jenkins Script Security Plugin Sandbox Bypass Vulnerability

Sin confirmar

CVE: CVE-2019-1003029
Proveedor: Jenkins
Producto: Script Security Plugin
Incorporada: 25/04/2022
Objetivo: 16/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Jenkins Script Security Plugin contains a protection mechanism failure, allowing an attacker to bypass the sandbox.

Microsoft Win32k Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2021-40450
Proveedor: Microsoft
Producto: Win32k
Incorporada: 25/04/2022
Objetivo: 16/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.

Microsoft Win32k Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2021-41357
Proveedor: Microsoft
Producto: Win32k
Incorporada: 25/04/2022
Objetivo: 16/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.

Linux Kernel Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2022-0847
Proveedor: Linux
Producto: Kernel
Incorporada: 25/04/2022
Objetivo: 16/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Linux kernel contains an improper initialization vulnerability where an unprivileged local user could escalate their privileges on the system. This vulnerability has the moniker of "Dirty Pipe."

Microsoft Windows User Profile Service Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2022-21919
Proveedor: Microsoft
Producto: Windows
Incorporada: 25/04/2022
Objetivo: 16/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.

Microsoft Windows User Profile Service Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2022-26904
Proveedor: Microsoft
Producto: Windows
Incorporada: 25/04/2022
Objetivo: 16/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.

WSO2 Multiple Products Unrestrictive Upload of File Vulnerability

Confirmado

CVE: CVE-2022-29464
Proveedor: WSO2
Producto: Multiple Products
Incorporada: 25/04/2022
Objetivo: 16/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution.

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Confirmado

CVE: CVE-2018-6882
Proveedor: Synacor
Producto: Zimbra Collaboration Suite (ZCS)
Incorporada: 19/04/2022
Objetivo: 10/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that might allow remote attackers to inject arbitrary web script or HTML.

WhatsApp VOIP Stack Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2019-3568
Proveedor: Meta Platforms
Producto: WhatsApp
Incorporada: 19/04/2022
Objetivo: 10/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number.

Microsoft Windows Print Spooler Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2022-22718
Proveedor: Microsoft
Producto: Windows
Incorporada: 19/04/2022
Objetivo: 10/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Print Spooler contains an unspecified vulnerability which allow for privilege escalation.

Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2007-3010
Proveedor: Alcatel
Producto: OmniPCX Enterprise
Incorporada: 15/04/2022
Objetivo: 06/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server allows remote attackers to execute arbitrary commands.

Ubiquiti AirOS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2010-5330
Proveedor: Ubiquiti
Producto: AirOS
Incorporada: 15/04/2022
Objetivo: 06/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi.

InduSoft Web Studio NTWebServer Directory Traversal Vulnerability

Sin confirmar

CVE: CVE-2014-0780
Proveedor: InduSoft
Producto: Web Studio
Incorporada: 15/04/2022
Objetivo: 06/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: InduSoft Web Studio NTWebServer contains a directory traversal vulnerability that allows remote attackers to read administrative passwords in APP files, allowing for remote code execution.

Trihedral VTScada (formerly VTS) Denial-of-Service Vulnerability

Sin confirmar

CVE: CVE-2016-4523
Proveedor: Trihedral
Producto: VTScada (formerly VTS)
Incorporada: 15/04/2022
Objetivo: 06/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The WAP interface in Trihedral VTScada (formerly VTS) allows remote attackers to cause a denial-of-service (DoS).

Schneider Electric U.motion Builder SQL Injection Vulnerability

Sin confirmar

CVE: CVE-2018-7841
Proveedor: Schneider Electric
Producto: U.motion Builder
Incorporada: 15/04/2022
Objetivo: 06/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: A SQL Injection vulnerability exists in U.motion Builder software which could cause unwanted code execution when an improper set of characters is entered.

D-Link DNS-320 Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2019-16057
Proveedor: D-Link
Producto: DNS-320 Storage Device
Incorporada: 15/04/2022
Objetivo: 06/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution.

Crestron Multiple Products Command Injection Vulnerability

Sin confirmar

CVE: CVE-2019-3929
Proveedor: Crestron
Producto: Multiple Products
Incorporada: 15/04/2022
Objetivo: 06/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Multiple Crestron products are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.

Google Chromium V8 Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2022-1364
Proveedor: Google
Producto: Chromium V8
Incorporada: 15/04/2022
Objetivo: 06/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

VMware Multiple Products Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2022-22960
Proveedor: VMware
Producto: Multiple Products
Incorporada: 15/04/2022
Objetivo: 06/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts.

VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability

Confirmado

CVE: CVE-2022-22954
Proveedor: VMware
Producto: Workspace ONE Access and Identity Manager
Incorporada: 14/04/2022
Objetivo: 05/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection.

Adobe Flash Player Stack-Based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2014-9163
Proveedor: Adobe
Producto: Flash Player
Incorporada: 13/04/2022
Objetivo: 04/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Stack-based buffer overflow in Adobe Flash Player allows attackers to execute code remotely.

Adobe Flash Player Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2015-0311
Proveedor: Adobe
Producto: Flash Player
Incorporada: 13/04/2022
Objetivo: 04/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute code.

Adobe Flash Player Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2015-0313
Proveedor: Adobe
Producto: Flash Player
Incorporada: 13/04/2022
Objetivo: 04/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Use-after-free vulnerability in Adobe Flash Player allows remote attackers to execute code.

Microsoft Internet Explorer Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2015-2502
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 13/04/2022
Objetivo: 04/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Internet Explorer contains a memory corruption vulnerability that allows an attacker to execute code or cause a denial-of-service (DoS).

Adobe Flash Player Heap-Based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2015-3113
Proveedor: Adobe
Producto: Flash Player
Incorporada: 13/04/2022
Objetivo: 04/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Heap-based buffer overflow vulnerability in Adobe Flash Player allows remote attackers to execute code.

Adobe Flash Player Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2015-5122
Proveedor: Adobe
Producto: Flash Player
Incorporada: 13/04/2022
Objetivo: 04/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).

Adobe Flash Player Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2015-5123
Proveedor: Adobe
Producto: Flash Player
Incorporada: 13/04/2022
Objetivo: 04/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).

Kaseya VSA Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2018-20753
Proveedor: Kaseya
Producto: Virtual System/Server Administrator (VSA)
Incorporada: 13/04/2022
Objetivo: 04/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Kaseya VSA RMM allows unprivileged remote attackers to execute PowerShell payloads on all managed devices.

Drupal Core Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2018-7602
Proveedor: Drupal
Producto: Core
Incorporada: 13/04/2022
Objetivo: 04/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.

Microsoft Windows CLFS Driver Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2022-24521
Proveedor: Microsoft
Producto: Windows
Incorporada: 13/04/2022
Objetivo: 04/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Common Log File System (CLFS) Driver contains an unspecified vulnerability that allows for privilege escalation.

Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability

Sin confirmar

CVE: CVE-2017-11317
Proveedor: Telerik
Producto: User Interface (UI) for ASP.NET AJAX
Incorporada: 11/04/2022
Objetivo: 02/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

QNAP Network-Attached Storage (NAS) Command Injection Vulnerability

Sin confirmar

CVE: CVE-2020-2509
Proveedor: QNAP
Producto: QNAP Network-Attached Storage (NAS)
Incorporada: 11/04/2022
Objetivo: 02/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.

Linux Kernel Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2021-22600
Proveedor: Linux
Producto: Kernel
Incorporada: 11/04/2022
Objetivo: 02/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Linux Kernel contains a flaw in the packet socket (AF_PACKET) implementation which could lead to incorrectly freeing memory. A local user could exploit this for denial-of-service (DoS) or possibly for privilege escalation.

Checkbox Survey Deserialization of Untrusted Data Vulnerability

Sin confirmar

CVE: CVE-2021-27852
Proveedor: Checkbox
Producto: Checkbox Survey
Incorporada: 11/04/2022
Objetivo: 02/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.
Descripción CISA: Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code.

Google Pixel Out-of-Bounds Write Vulnerability

Sin confirmar

CVE: CVE-2021-39793
Proveedor: Google
Producto: Pixel
Incorporada: 11/04/2022
Objetivo: 02/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Pixel contains a possible out-of-bounds write due to a logic error in the code that could lead to local escalation of privilege.

Microsoft Active Directory Domain Services Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2021-42278
Proveedor: Microsoft
Producto: Active Directory
Incorporada: 11/04/2022
Objetivo: 02/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.

Microsoft Active Directory Domain Services Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2021-42287
Proveedor: Microsoft
Producto: Active Directory
Incorporada: 11/04/2022
Objetivo: 02/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.

WatchGuard Firebox and XTM Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2022-23176
Proveedor: WatchGuard
Producto: Firebox and XTM
Incorporada: 11/04/2022
Objetivo: 02/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access.

Microsoft SMBv1 Server Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2017-0148
Proveedor: Microsoft
Producto: SMBv1 server
Incorporada: 06/04/2022
Objetivo: 27/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets.

Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2021-31166
Proveedor: Microsoft
Producto: HTTP Protocol Stack
Incorporada: 06/04/2022
Objetivo: 27/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution.

Sudo Heap-Based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2021-3156
Proveedor: Sudo
Producto: Sudo
Incorporada: 06/04/2022
Objetivo: 27/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation.

D-Link Multiple Routers Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2021-45382
Proveedor: D-Link
Producto: Multiple Routers
Incorporada: 04/04/2022
Objetivo: 25/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file.

Apple macOS Out-of-Bounds Read Vulnerability

Sin confirmar

CVE: CVE-2022-22674
Proveedor: Apple
Producto: macOS
Incorporada: 04/04/2022
Objetivo: 25/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: macOS Monterey contains an out-of-bounds read vulnerability that could allow an application to read kernel memory.

Apple macOS Out-of-Bounds Write Vulnerability

Sin confirmar

CVE: CVE-2022-22675
Proveedor: Apple
Producto: macOS
Incorporada: 04/04/2022
Objetivo: 25/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: macOS Monterey contains an out-of-bounds write vulnerability that could allow an application to execute arbitrary code with kernel privileges.

Spring Framework JDK 9+ Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2022-22965
Proveedor: VMware
Producto: Spring Framework
Incorporada: 04/04/2022
Objetivo: 25/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.

Dasan GPON Routers Authentication Bypass Vulnerability

Sin confirmar

CVE: CVE-2018-10561
Proveedor: Dasan
Producto: Gigabit Passive Optical Network (GPON) Routers
Incorporada: 31/03/2022
Objetivo: 21/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10562, exploitation can allow an attacker to perform remote code execution.

Dasan GPON Routers Command Injection Vulnerability

Confirmado

CVE: CVE-2018-10562
Proveedor: Dasan
Producto: Gigabit Passive Optical Network (GPON) Routers
Incorporada: 31/03/2022
Objetivo: 21/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561, exploitation can allow an attacker to perform remote code execution.

Dell dbutil Driver Insufficient Access Control Vulnerability

Sin confirmar

CVE: CVE-2021-21551
Proveedor: Dell
Producto: dbutil Driver
Incorporada: 31/03/2022
Objetivo: 21/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Dell dbutil driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial-of-service (DoS), or information disclosure.

QNAP NAS Improper Authorization Vulnerability

Confirmado

CVE: CVE-2021-28799
Proveedor: QNAP
Producto: Network Attached Storage (NAS)
Incorporada: 31/03/2022
Objetivo: 21/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.

Microsoft Windows User Profile Service Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2021-34484
Proveedor: Microsoft
Producto: Windows
Incorporada: 31/03/2022
Objetivo: 21/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.

Sophos Firewall Authentication Bypass Vulnerability

Sin confirmar

CVE: CVE-2022-1040
Proveedor: Sophos
Producto: Firewall
Incorporada: 31/03/2022
Objetivo: 21/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution.

Trend Micro Apex Central Arbitrary File Upload Vulnerability

Sin confirmar

CVE: CVE-2022-26871
Proveedor: Trend Micro
Producto: Apex Central
Incorporada: 31/03/2022
Objetivo: 21/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.

Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2010-4398
Proveedor: Microsoft
Producto: Windows
Incorporada: 28/03/2022
Objetivo: 21/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows allows local users to gain privileges, and bypass the User Account Control (UAC) feature.

Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2011-2005
Proveedor: Microsoft
Producto: Ancillary Function Driver (afd.sys)
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: afd.sys in the Ancillary Function Driver in Microsoft Windows does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application.

Oracle Fusion Middleware Unspecified Vulnerability

Sin confirmar

CVE: CVE-2012-0518
Proveedor: Oracle
Producto: Fusion Middleware
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware allows remote attackers to affect integrity via Unknown vectors

Adobe Flash Player Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2012-2034
Proveedor: Adobe
Producto: Flash Player
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Adobe Flash Player contains a memory corruption vulnerability that allows for remote code execution or denial-of-service (DoS).

Microsoft Word Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2012-2539
Proveedor: Microsoft
Producto: Word
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Word allows attackers to execute remote code or cause a denial-of-service (DoS) via crafted RTF data.

Oracle Java SE Sandbox Bypass Vulnerability

Sin confirmar

CVE: CVE-2012-5076
Proveedor: Oracle
Producto: Java SE
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The default Java security properties configuration did not restrict access to the com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal packages. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.

Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability

Sin confirmar

CVE: CVE-2013-1690
Proveedor: Mozilla
Producto: Firefox and Thunderbird
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Mozilla Firefox and Thunderbird do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial-of-service (DoS) or possibly execute malicious code via a crafted web site.

Oracle Java SE Unspecified Vulnerability

Confirmado

CVE: CVE-2013-2465
Proveedor: Oracle
Producto: Java SE
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to 2D

Microsoft Internet Explorer Use-After-Free Vulnerability

Confirmado

CVE: CVE-2013-2551
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute remote code via a crafted web site that triggers access to a deleted object.

Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability

Sin confirmar

CVE: CVE-2013-2729
Proveedor: Adobe
Producto: Reader and Acrobat
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Integer overflow vulnerability in Adobe Reader and Acrobat allows attackers to execute remote code.

Microsoft Win32k Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2013-3660
Proveedor: Microsoft
Producto: Win32k
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft does not properly initialize a pointer for the next object in a certain list, which allows local users to gain privileges.

Microsoft Office Uninitialized Memory Use Vulnerability

Sin confirmar

CVE: CVE-2015-1770
Proveedor: Microsoft
Producto: Office
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Office allows remote attackers to execute arbitrary code via a crafted Office document.

Microsoft Internet Explorer Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2015-2419
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: JScript in Microsoft Internet Explorer allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.

Microsoft Windows Adobe Type Manager Library Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2015-2426
Proveedor: Microsoft
Producto: Windows
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted OpenType fonts.

Microsoft Windows Kernel Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2016-0040
Proveedor: Microsoft
Producto: Windows
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The kernel in Microsoft Windows allows local users to gain privileges via a crafted application.

Microsoft Windows CSRSS Security Feature Bypass Vulnerability

Confirmado

CVE: CVE-2016-0151
Proveedor: Microsoft
Producto: Client-Server Run-time Subsystem (CSRSS)
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Client-Server Run-time Subsystem (CSRSS) in Microsoft mismanages process tokens, which allows local users to gain privileges via a crafted application.

Microsoft Internet Explorer Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2016-0189
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Microsoft JScript nd VBScript engines, as used in Internet Explorer and other products, allow attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.

Microsoft Edge Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2016-7200
Proveedor: Microsoft
Producto: Edge
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.

Microsoft Edge Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2016-7201
Proveedor: Microsoft
Producto: Edge
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.

Microsoft Edge and Internet Explorer Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2017-0037
Proveedor: Microsoft
Producto: Edge and Internet Explorer
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Edge and Internet Explorer have a type confusion vulnerability in mshtml.dll, which allows remote code execution.

Microsoft Internet Explorer Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2017-0059
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Internet Explorer allow remote attackers to obtain sensitive information from process memory via a crafted web site.

Microsoft Windows Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2017-0213
Proveedor: Microsoft
Producto: Windows
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows COM Aggregate Marshaler allows for privilege escalation when an attacker runs a specially crafted application.

Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2018-8405
Proveedor: Microsoft
Producto: DirectX Graphics Kernel (DXGKRNL)
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.

Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2018-8406
Proveedor: Microsoft
Producto: DirectX Graphics Kernel (DXGKRNL)
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.

Microsoft Windows Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2018-8440
Proveedor: Microsoft
Producto: Windows
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).

SonicWall SMA100 Directory Traversal Vulnerability

Sin confirmar

CVE: CVE-2019-7483
Proveedor: SonicWall
Producto: SMA100
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server.

SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability

Confirmado

CVE: CVE-2021-20028
Proveedor: SonicWall
Producto: Secure Remote Access (SRA)
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: SonicWall Secure Remote Access (SRA) products contain an improper neutralization of a SQL Command leading to SQL injection.

Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability

Confirmado

CVE: CVE-2021-26085
Proveedor: Atlassian
Producto: Confluence Server
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint.

Microsoft Windows Event Tracing Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2021-34486
Proveedor: Microsoft
Producto: Windows
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Event Tracing contains an unspecified vulnerability which can allow for privilege escalation.

Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2021-38646
Proveedor: Microsoft
Producto: Office
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution.

Debian-specific Redis Server Lua Sandbox Escape Vulnerability

Sin confirmar

CVE: CVE-2022-0543
Proveedor: Redis
Producto: Debian-specific Redis Servers
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

Google Chromium V8 Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2022-1096
Proveedor: Google
Producto: Chromium V8
Incorporada: 28/03/2022
Objetivo: 18/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

HP OpenView Network Node Manager Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2005-2773
Proveedor: Hewlett Packard (HP)
Producto: OpenView Network Node Manager
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: HP OpenView Network Node Manager could allow a remote attacker to execute arbitrary commands on the system.

Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2009-0927
Proveedor: Adobe
Producto: Reader and Acrobat
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Stack-based buffer overflow in Adobe Reader and Adobe Acrobat allows remote attackers to execute arbitrary code.

phpMyAdmin Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2009-1151
Proveedor: phpMyAdmin
Producto: phpMyAdmin
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file.

Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability

Sin confirmar

CVE: CVE-2009-2055
Proveedor: Cisco
Producto: IOS XR
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Cisco IOS XR,when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).

Adobe ColdFusion Directory Traversal Vulnerability

Confirmado

CVE: CVE-2010-2861
Proveedor: Adobe
Producto: ColdFusion
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files.

Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability

Sin confirmar

CVE: CVE-2010-3035
Proveedor: Cisco
Producto: IOS XR
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Cisco IOS XR, when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).

Exim Heap-Based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2010-4344
Proveedor: Exim
Producto: Exim
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session.

Exim Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2010-4345
Proveedor: Exim
Producto: Exim
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Exim allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands.

PHP-CGI Query String Parameter Vulnerability

Sin confirmar

CVE: CVE-2012-1823
Proveedor: PHP
Producto: PHP
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code.

Apache Struts Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2013-2251
Proveedor: Apache
Producto: Struts
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigation Language (OGNL) expressions.

HP Multiple Products Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2013-4810
Proveedor: Hewlett Packard (HP)
Producto: ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: HP ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet.

D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability

Sin confirmar

CVE: CVE-2013-5223
Proveedor: D-Link
Producto: DSL-2760U
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A cross-site scripting (XSS) vulnerability exists in the D-Link DSL-2760U gateway, allowing remote authenticated users to inject arbitrary web script or HTML.

Ruby on Rails Directory Traversal Vulnerability

Sin confirmar

CVE: CVE-2014-0130
Proveedor: Rails
Producto: Ruby on Rails
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails allows remote attackers to read arbitrary files via a crafted request.

Elasticsearch Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2014-3120
Proveedor: Elastic
Producto: Elasticsearch
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Elasticsearch enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code.

Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2014-6287
Proveedor: Rejetto
Producto: HTTP File Server (HFS)
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (HFS or HttpFileServer) allows remote attackers to execute arbitrary programs.

Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2014-6324
Proveedor: Microsoft
Producto: Kerberos Key Distribution Center (KDC)
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Kerberos Key Distribution Center (KDC) in Microsoft allows remote authenticated domain users to obtain domain administrator privileges.

Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2014-6332
Proveedor: Microsoft
Producto: Windows
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: OleAut32.dll in OLE in Microsoft Windows allows remote attackers to remotely execute code via a crafted web site.

Cisco Prime Data Center Network Manager (DCNM) Directory Traversal Vulnerability

Sin confirmar

CVE: CVE-2015-0666
Proveedor: Cisco
Producto: Prime Data Center Network Manager (DCNM)
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) allows remote attackers to read arbitrary files.

D-Link and TRENDnet Multiple Devices Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2015-1187
Proveedor: D-Link and TRENDnet
Producto: Multiple Devices
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to perform remote code execution.

Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2015-1427
Proveedor: Elastic
Producto: Elasticsearch
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Groovy scripting engine in Elasticsearch allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands.

TP-Link Multiple Archer Devices Directory Traversal Vulnerability

Sin confirmar

CVE: CVE-2015-3035
Proveedor: TP-Link
Producto: Multiple Archer Devices
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Directory traversal vulnerability in multiple TP-Link Archer devices allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.

Arcserve Unified Data Protection (UDP) Directory Traversal Vulnerability

Sin confirmar

CVE: CVE-2015-4068
Proveedor: Arcserve
Producto: Unified Data Protection (UDP)
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Directory traversal vulnerability in Arcserve UDP allows remote attackers to obtain sensitive information or cause a denial of service.

Ruby on Rails Directory Traversal Vulnerability

Sin confirmar

CVE: CVE-2016-0752
Proveedor: Rails
Producto: Ruby on Rails
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Directory traversal vulnerability in Action View in Ruby on Rails allows remote attackers to read arbitrary files.

NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2016-10174
Proveedor: NETGEAR
Producto: WNR2000v5 Router
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The NETGEAR WNR2000v5 router contains a buffer overflow which can be exploited to achieve remote code execution.

D-Link DCS-930L Devices OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2016-11021
Proveedor: D-Link
Producto: DCS-930L Devices
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: setSystemCommand on D-Link DCS-930L devices allows a remote attacker to execute code via an OS command.

NETGEAR Multiple WAP Devices Command Injection Vulnerability

Sin confirmar

CVE: CVE-2016-1555
Proveedor: NETGEAR
Producto: Wireless Access Point (WAP) Devices
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Multiple NETGEAR Wireless Access Point devices allows unauthenticated web pages to pass form input directly to the command-line interface. Exploitation allows for arbitrary code execution.

Adobe Flash Player Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2016-4171
Proveedor: Adobe
Producto: Flash Player
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Unspecified vulnerability in Adobe Flash Player allows for remote code execution.

Adobe Flash Player Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2016-7892
Proveedor: Adobe
Producto: Flash Player
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Adobe Flash Player has an exploitable use-after-free vulnerability in the TextField class.

Microsoft Windows SMB Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2017-0146
Proveedor: Microsoft
Producto: Windows
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The SMBv1 server in Microsoft Windows allows remote attackers to perform remote code execution.

Apache Tomcat on Windows Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2017-12615
Proveedor: Apache
Producto: Tomcat
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Apache Tomcat Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2017-12617
Proveedor: Apache
Producto: Tomcat
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Cisco IOS and IOS XE Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2017-3881
Proveedor: Cisco
Producto: IOS and IOS XE
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges.

Citrix Multiple Products Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2017-6316
Proveedor: Citrix
Producto: NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability has been identified in the management interface of Citrix NetScaler SD-WAN Enterprise and Standard Edition and Citrix CloudBridge Virtual WAN Edition that could result in an unauthenticated, remote attacker being able to execute arbitrary code as a root user. This vulnerability also affects XenMobile Server.

NETGEAR DGN2200 Devices OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2017-6334
Proveedor: NETGEAR
Producto: DGN2200 Devices
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands

Cisco VPN Routers Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2018-0125
Proveedor: Cisco
Producto: VPN Routers
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in the web interface of the Cisco VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as root and gain full control of an affected system.

Cisco Secure Access Control System Java Deserialization Vulnerability

Sin confirmar

CVE: CVE-2018-0147
Proveedor: Cisco
Producto: Secure Access Control System (ACS)
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software.

Quest KACE System Management Appliance Remote Command Execution Vulnerability

Confirmado

CVE: CVE-2018-11138
Proveedor: Quest
Producto: KACE System Management Appliance
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution.

VMware Tanzu Spring Data Commons Property Binder Vulnerability

Confirmado

CVE: CVE-2018-1273
Proveedor: VMware Tanzu
Producto: Spring Data Commons
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution.

LG N1A1 NAS Remote Command Execution Vulnerability

Sin confirmar

CVE: CVE-2018-14839
Proveedor: LG
Producto: N1A1 NAS
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: LG N1A1 NAS 3718.510 is affected by a remote code execution vulnerability.

VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability

Sin confirmar

CVE: CVE-2018-6961
Proveedor: VMware
Producto: SD-WAN Edge
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: VMware SD-WAN Edge by VeloCloud contains a command injection vulnerability in the local web UI component. Successful exploitation of this issue could result in remote code execution.

Microsoft Scripting Engine Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2018-8373
Proveedor: Microsoft
Producto: Internet Explorer Scripting Engine
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer.

Microsoft Windows Shell Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2018-8414
Proveedor: Microsoft
Producto: Windows
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths.

Microsoft GDI Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2019-0903
Proveedor: Microsoft
Producto: Graphics Device Interface (GDI)
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory. An attacker who successfully exploited this vulnerability could take control of the affected system.

Jenkins Matrix Project Plugin Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2019-1003030
Proveedor: Jenkins
Producto: Matrix Project Plugin
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity to perform remote code execution.

Kentico Xperience Deserialization of Untrusted Data Vulnerability

Sin confirmar

CVE: CVE-2019-10068
Proveedor: Kentico
Producto: Xperience
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Kentico contains a failure to validate security headers. This deserialization can led to unauthenticated remote code execution.

PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability

Confirmado

CVE: CVE-2019-11043
Proveedor: PHP
Producto: FastCGI Process Manager (FPM)
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution.

Citrix SD-WAN and NetScaler SQL Injection Vulnerability

Sin confirmar

CVE: CVE-2019-12989
Proveedor: Citrix
Producto: SD-WAN and NetScaler
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Citrix SD-WAN and NetScaler SD-WAN allow SQL Injection.

Citrix SD-WAN and NetScaler Command Injection Vulnerability

Sin confirmar

CVE: CVE-2019-12991
Proveedor: Citrix
Producto: SD-WAN and NetScaler
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Authenticated Command Injection in Citrix SD-WAN Appliance and NetScaler SD-WAN Appliance.

Webmin Command Injection Vulnerability

Confirmado

CVE: CVE-2019-15107
Proveedor: Webmin
Producto: Webmin
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: An issue was discovered in Webmin. The parameter old in password_change.cgi contains a command injection vulnerability.

D-Link Multiple Routers Command Injection Vulnerability

Sin confirmar

CVE: CVE-2019-16920
Proveedor: D-Link
Producto: Multiple Routers
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Multiple D-Link routers contain a command injection vulnerability which can allow attackers to achieve full system compromise.

Oracle BI Publisher Unauthorized Access Vulnerability

Sin confirmar

CVE: CVE-2019-2616
Proveedor: Oracle
Producto: BI Publisher (Formerly XML Publisher)
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Oracle BI Publisher, formerly XML Publisher, contains an unspecified vulnerability that allows for various unauthorized actions. Open-source reporting attributes this vulnerability to allowing for authentication bypass.

Drupal Core Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2019-6340
Proveedor: Drupal
Producto: Core
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.

Juniper Junos OS Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2020-1631
Proveedor: Juniper
Producto: Junos OS
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A path traversal vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform remote code execution.

Apache Kylin OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2020-1956
Proveedor: Apache
Producto: Kylin
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apache Kylin contains an OS command injection vulnerability which could permit an attacker to perform remote code execution.

Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

Confirmado

CVE: CVE-2020-2021
Proveedor: Palo Alto Networks
Producto: PAN-OS
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Palo Alto Networks PAN-OS contains a vulnerability in SAML which allows an attacker to bypass authentication.

QNAP Helpdesk Improper Access Control Vulnerability

Sin confirmar

CVE: CVE-2020-2506
Proveedor: QNAP Systems
Producto: Helpdesk
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: QNAP Helpdesk contains an improper access control vulnerability which could allow an attacker to gain privileges or to read sensitive information.

Sophos SG UTM Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2020-25223
Proveedor: Sophos
Producto: SG UTM
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM.

VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability

Sin confirmar

CVE: CVE-2020-5410
Proveedor: VMware Tanzu
Producto: Spring Cloud Configuration (Config) Server
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Spring, by VMware Tanzu, Cloud Config contains a path traversal vulnerability that allows applications to serve arbitrary configuration files.

OpenSMTPD Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2020-7247
Proveedor: OpenBSD
Producto: OpenSMTPD
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: smtp_mailaddr in smtp_session.c in OpenSMTPD, as used in OpenBSD and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session.

Zyxel Multiple NAS Devices OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2020-9054
Proveedor: Zyxel
Producto: Multiple Network-Attached Storage (NAS) Devices
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code.

D-Link DIR-610 Devices Remote Command Execution

Sin confirmar

CVE: CVE-2020-9377
Proveedor: D-Link
Producto: DIR-610 Devices
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: D-Link DIR-610 devices allow remote code execution via the cmd parameter to command.php.

Citrix ShareFile Improper Access Control Vulnerability

Confirmado

CVE: CVE-2021-22941
Proveedor: Citrix
Producto: ShareFile
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Improper Access Control in Citrix ShareFile storage zones controller may allow an unauthenticated attacker to remotely compromise the storage zones controller.

Sitecore XP Remote Command Execution Vulnerability

Confirmado

CVE: CVE-2021-42237
Proveedor: Sitecore
Producto: XP
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution.

Microsoft Windows Print Spooler Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2022-21999
Proveedor: Microsoft
Producto: Windows
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Print Spooler contains an unspecified vulnerability which can allow for privilege escalation.

MiCollab, MiVoice Business Express Access Control Vulnerability

Sin confirmar

CVE: CVE-2022-26143
Proveedor: Mitel
Producto: MiCollab, MiVoice Business Express
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability has been identified in MiCollab and MiVoice Business Express that may allow a malicious actor to gain unauthorized access to sensitive information and services, cause performance degradations or a denial of service condition on the affected system.

WatchGuard Firebox and XTM Appliances Arbitrary Code Execution

Sin confirmar

CVE: CVE-2022-26318
Proveedor: WatchGuard
Producto: Firebox and XTM Appliances
Incorporada: 25/03/2022
Objetivo: 15/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code.

Microsoft Win32k Memory Corruption Vulnerability

Confirmado

CVE: CVE-2015-2546
Proveedor: Microsoft
Producto: Win32k
Incorporada: 15/03/2022
Objetivo: 05/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The kernel-mode driver in Microsoft Windows OS and Server allows local users to gain privileges via a crafted application.

Microsoft Windows Kernel Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2016-3309
Proveedor: Microsoft
Producto: Windows
Incorporada: 15/03/2022
Objetivo: 05/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.

Microsoft Windows Transaction Manager Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2017-0101
Proveedor: Microsoft
Producto: Windows
Incorporada: 15/03/2022
Objetivo: 05/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A privilege escalation vulnerability exists when the Windows Transaction Manager improperly handles objects in memory.

Microsoft Win32k Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2018-8120
Proveedor: Microsoft
Producto: Win32k
Incorporada: 15/03/2022
Objetivo: 05/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory.

Microsoft Windows Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2019-0543
Proveedor: Microsoft
Producto: Windows
Incorporada: 15/03/2022
Objetivo: 05/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context.

Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2019-0841
Proveedor: Microsoft
Producto: Windows
Incorporada: 15/03/2022
Objetivo: 05/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.

Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2019-1064
Proveedor: Microsoft
Producto: Windows
Incorporada: 15/03/2022
Objetivo: 05/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.

Microsoft Task Scheduler Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2019-1069
Proveedor: Microsoft
Producto: Task Scheduler
Incorporada: 15/03/2022
Objetivo: 05/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A privilege escalation vulnerability exists in the way the Task Scheduler Service validates certain file operations.

Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2019-1129
Proveedor: Microsoft
Producto: Windows
Incorporada: 15/03/2022
Objetivo: 05/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.

Microsoft Win32k Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2019-1132
Proveedor: Microsoft
Producto: Win32k
Incorporada: 15/03/2022
Objetivo: 05/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory.

Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2019-1253
Proveedor: Microsoft
Producto: Windows
Incorporada: 15/03/2022
Objetivo: 05/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A privilege escalation vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.

Microsoft Windows Error Reporting Manager Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2019-1315
Proveedor: Microsoft
Producto: Windows
Incorporada: 15/03/2022
Objetivo: 05/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A privilege escalation vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status.

Microsoft Windows Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2019-1322
Proveedor: Microsoft
Producto: Windows
Incorporada: 15/03/2022
Objetivo: 05/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context.

Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2019-1405
Proveedor: Microsoft
Producto: Windows
Incorporada: 15/03/2022
Objetivo: 05/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A privilege escalation vulnerability exists when the Windows UPnP service improperly allows COM object creation.

SonicWall SonicOS Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2020-5135
Proveedor: SonicWall
Producto: SonicOS
Incorporada: 15/03/2022
Objetivo: 05/04/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall.

Adobe BlazeDS Information Disclosure Vulnerability

Confirmado

CVE: CVE-2009-3960
Proveedor: Adobe
Producto: BlazeDS
Incorporada: 07/03/2022
Objetivo: 07/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure.

Adobe ColdFusion Authentication Bypass Vulnerability

Sin confirmar

CVE: CVE-2013-0625
Proveedor: Adobe
Producto: ColdFusion
Incorporada: 07/03/2022
Objetivo: 07/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Adobe Coldfusion contains an authentication bypass vulnerability, which could result in an unauthorized user gaining administrative access.

Adobe ColdFusion Directory Traversal Vulnerability

Sin confirmar

CVE: CVE-2013-0629
Proveedor: Adobe
Producto: ColdFusion
Incorporada: 07/03/2022
Objetivo: 07/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Adobe Coldfusion contains a directory traversal vulnerability, which could permit an unauthorized user access to restricted directories.

Adobe ColdFusion Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2013-0631
Proveedor: Adobe
Producto: ColdFusion
Incorporada: 07/03/2022
Objetivo: 07/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Adobe Coldfusion contains an unspecified vulnerability, which could result in information disclosure from a compromised server.

NETGEAR Multiple Routers Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2016-6277
Proveedor: NETGEAR
Producto: Multiple Routers
Incorporada: 07/03/2022
Objetivo: 07/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: NETGEAR confirmed multiple routers allow unauthenticated web pages to pass form input directly to the command-line interface, permitting remote code execution.

NETGEAR DGN2200 Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2017-6077
Proveedor: NETGEAR
Producto: Wireless Router DGN2200
Incorporada: 07/03/2022
Objetivo: 07/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: NETGEAR DGN2200 wireless routers contain a vulnerability that allows for remote code execution.

Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability

Sin confirmar

CVE: CVE-2019-11581
Proveedor: Atlassian
Producto: Jira Server and Data Center
Incorporada: 07/03/2022
Objetivo: 07/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Atlassian Jira Server and Data Center contain a server-side template injection vulnerability which can allow for remote code execution.

Pulse Connect Secure Code Injection Vulnerability

Sin confirmar

CVE: CVE-2020-8218
Proveedor: Pulse Secure
Producto: Pulse Connect Secure
Incorporada: 07/03/2022
Objetivo: 07/09/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A code injection vulnerability exists in Pulse Connect Secure that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.

VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability

Sin confirmar

CVE: CVE-2021-21973
Proveedor: VMware
Producto: vCenter Server and Cloud Foundation
Incorporada: 07/03/2022
Objetivo: 21/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: VMware vCenter Server and Cloud Foundation Server contain a SSRF vulnerability due to improper validation of URLs in a vCenter Server plugin. This allows for information disclosure.

Mozilla Firefox Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2022-26485
Proveedor: Mozilla
Producto: Firefox
Incorporada: 07/03/2022
Objetivo: 21/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution.

Mozilla Firefox Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2022-26486
Proveedor: Mozilla
Producto: Firefox
Incorporada: 07/03/2022
Objetivo: 21/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Mozilla Firefox contains a use-after-free vulnerability in WebGPU IPC Framework which can be exploited to perform arbitrary code execution.

Microsoft Windows Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2002-0367
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: smss.exe debugging subsystem in Microsoft Windows does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges.

Microsoft Windows Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2004-0210
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A privilege elevation vulnerability exists in the POSIX subsystem. This vulnerability could allow a logged on user to take complete control of the system.

Adobe Reader and Acrobat Input Validation Vulnerability

Confirmado

CVE: CVE-2008-2992
Proveedor: Adobe
Producto: Acrobat and Reader
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Adobe Acrobat and Reader contain an input validation issue in a JavaScript method that could potentially lead to remote code execution.

Oracle VirtualBox Insufficient Input Validation Vulnerability

Sin confirmar

CVE: CVE-2008-3431
Proveedor: Oracle
Producto: VirtualBox
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: An input validation vulnerability exists in the VBoxDrv.sys driver of Sun xVM VirtualBox which allows attackers to locally execute arbitrary code.

Microsoft Windows Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2009-1123
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The kernel in Microsoft Windows does not properly validate changes to unspecified kernel objects, which allows local users to gain privileges via a crafted application.

Microsoft Excel Featheader Record Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2009-3129
Proveedor: Microsoft
Producto: Excel
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Office Excel allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset.

Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability

Confirmado

CVE: CVE-2010-0188
Proveedor: Adobe
Producto: Reader and Acrobat
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Unspecified vulnerability in Adobe Reader and Acrobat allows attackers to cause a denial of service or possibly execute arbitrary code.

Microsoft Windows Kernel Exception Handler Vulnerability

Sin confirmar

CVE: CVE-2010-0232
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The kernel in Microsoft Windows, when access to 16-bit applications is enabled on a 32-bit x86 platform, does not properly validate certain BIOS calls, which allows local users to gain privileges.

Microsoft Office Stack-based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2010-3333
Proveedor: Microsoft
Producto: Office
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A stack-based buffer overflow vulnerability exists in the parsing of RTF data in Microsoft Office and earlier allows an attacker to perform remote code execution.

Adobe Flash Player Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2011-0611
Proveedor: Adobe
Producto: Flash Player
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Adobe Flash Player contains a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content.

Microsoft Forefront TMG Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2011-1889
Proveedor: Microsoft
Producto: Forefront Threat Management Gateway (TMG)
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A remote code execution vulnerability exists in the Forefront Threat Management Gateway (TMG) Firewall Client Winsock provider that could allow code execution in the security context of the client application.

Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

Sin confirmar

CVE: CVE-2011-3544
Proveedor: Oracle
Producto: Java SE JDK and JRE
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: An access control vulnerability exists in the Applet Rhino Script Engine component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.

Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

Confirmado

CVE: CVE-2012-0507
Proveedor: Oracle
Producto: Java SE
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: An incorrect type vulnerability exists in the Concurrency component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.

Adobe Flash Player Arbitrary Code Execution Vulnerability

Sin confirmar

CVE: CVE-2012-1535
Proveedor: Adobe
Producto: Flash Player
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute arbitrary code or cause a denial of service via crafted SWF content.

Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

Confirmado

CVE: CVE-2012-1723
Proveedor: Oracle
Producto: Java SE
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Hotspot.

Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2012-1856
Proveedor: Microsoft
Producto: Office
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption.

Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

Confirmado

CVE: CVE-2012-4681
Proveedor: Oracle
Producto: Java SE
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution.

Adobe ColdFusion Authentication Bypass Vulnerability

Sin confirmar

CVE: CVE-2013-0632
Proveedor: Adobe
Producto: ColdFusion
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: An authentication bypass vulnerability exists in Adobe ColdFusion which could result in an unauthorized user gaining administrative access.

Adobe Reader and Acrobat Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2013-0640
Proveedor: Adobe
Producto: Reader and Acrobat
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: An memory corruption vulnerability exists in the acroform.dll in Adobe Reader that allows an attacker to perform remote code execution.

Adobe Reader Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2013-0641
Proveedor: Adobe
Producto: Reader
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A buffer overflow vulnerability exists in Adobe Reader which allows an attacker to perform remote code execution.

Microsoft Internet Explorer Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2013-1347
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: This vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer.

Mozilla Firefox Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2013-1675
Proveedor: Mozilla
Producto: Firefox
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.

Adobe Reader and Acrobat Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2013-3346
Proveedor: Adobe
Producto: Reader and Acrobat
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Adobe Reader and Acrobat contain a memory corruption vulnerability which can allow attackers to execute arbitrary code or cause a denial of service.

Microsoft Internet Explorer Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2013-3897
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A use-after-free vulnerability exists within CDisplayPointer in Microsoft Internet Explorer that allows an attacker to remotely execute arbitrary code.

Microsoft Windows Kernel Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2013-5065
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows NDProxy.sys in the kernel contains an improper input validation vulnerability which can allow a local attacker to escalate privileges.

Adobe Reader and Acrobat Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2014-0496
Proveedor: Adobe
Producto: Reader and Acrobat
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Adobe Reader and Acrobat contain a use-after-free vulnerability which can allow for code execution.

Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2014-4114
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability exists in Windows Object Linking & Embedding (OLE) that could allow remote code execution if a user opens a file that contains a specially crafted OLE object.

Microsoft Office Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2015-1642
Proveedor: Microsoft
Producto: Office
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Office contains a memory corruption vulnerability that allows remote attackers to execute arbitrary code via a crafted document.

Microsoft Win32k Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2015-1701
Proveedor: Microsoft
Producto: Win32k
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: An unspecified vulnerability exists in the Win32k.sys kernel-mode driver in Microsoft Windows Server that allows a local attacker to execute arbitrary code with elevated privileges.

Microsoft ATM Font Driver Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2015-2387
Proveedor: Microsoft
Producto: ATM Font Driver
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server allows local users to gain privileges via a crafted application.

Microsoft PowerPoint Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2015-2424
Proveedor: Microsoft
Producto: PowerPoint
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft PowerPoint allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document.

Microsoft Office Malformed EPS File Vulnerability

Sin confirmar

CVE: CVE-2015-2545
Proveedor: Microsoft
Producto: Office
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Office allows remote attackers to execute arbitrary code via a crafted EPS image.

Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2015-2590
Proveedor: Oracle
Producto: Java SE
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: An unspecified vulnerability exists within Oracle Java Runtime Environment that allows an attacker to perform remote code execution.

Adobe Flash Player Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2015-3043
Proveedor: Adobe
Producto: Flash Player
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: A memory corruption vulnerability exists in Adobe Flash Player that allows an attacker to perform remote code execution.

Oracle Java SE Integrity Check Vulnerability

Sin confirmar

CVE: CVE-2015-4902
Proveedor: Oracle
Producto: Java SE
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Unspecified vulnerability in Oracle Java SE allows remote attackers to affect integrity via Unknown vectors related to deployment.

Adobe Flash Player Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2015-5119
Proveedor: Adobe
Producto: Flash Player
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: A use-after-free vulnerability exists within the ActionScript 3 ByteArray class in Adobe Flash Player that allows an attacker to perform remote code execution.

Adobe Flash Player Arbitrary Code Execution Vulnerability

Confirmado

CVE: CVE-2015-7645
Proveedor: Adobe
Producto: Flash Player
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Adobe Flash Player allows remote attackers to execute arbitrary code via a crafted SWF file.

Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2016-0099
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A privilege escalation vulnerability exists in Microsoft Windows if the Windows Secondary Logon Service fails to properly manage request handles in memory. An attacker who successfully exploited this vulnerability could run arbitrary code as an administrator.

Adobe Flash Player Arbitrary Code Execution Vulnerability

Confirmado

CVE: CVE-2016-1019
Proveedor: Adobe
Producto: Flash Player
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Adobe Flash Player allows remote attackers to cause a denial of service or possibly execute arbitrary code.

Adobe Flash Player Arbitrary Code Execution Vulnerability

Sin confirmar

CVE: CVE-2016-4117
Proveedor: Adobe
Producto: Flash Player
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: An access of resource using incompatible type vulnerability exists within Adobe Flash Player that allows an attacker to perform remote code execution.

Linux Kernel Race Condition Vulnerability

Sin confirmar

CVE: CVE-2016-5195
Proveedor: Linux
Producto: Kernel
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Race condition in mm/gup.c in the Linux kernel allows local users to escalate privileges.

Microsoft Office Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2016-7193
Proveedor: Microsoft
Producto: Office
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Office contains a memory corruption vulnerability which can allow for remote code execution.

Microsoft Office Security Feature Bypass Vulnerability

Sin confirmar

CVE: CVE-2016-7262
Proveedor: Microsoft
Producto: Excel
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A security feature bypass vulnerability exists when Microsoft Office improperly handles input. An attacker who successfully exploited the vulnerability could execute arbitrary commands.

Adobe Flash Player Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2016-7855
Proveedor: Adobe
Producto: Flash Player
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Use-after-free vulnerability in Adobe Flash Player Windows and OS and Linux allows remote attackers to execute arbitrary code.

Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability

Sin confirmar

CVE: CVE-2016-8562
Proveedor: Siemens
Producto: SIMATIC CP
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: An improper privilege management vulnerability exists within the Siemens SIMATIC Communication Processor (CP) that allows a privileged attacker to remotely cause a denial of service.

Microsoft Graphics Device Interface (GDI) Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2017-0001
Proveedor: Microsoft
Producto: Graphics Device Interface (GDI)
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges

Microsoft Office Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2017-0261
Proveedor: Microsoft
Producto: Office
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Office contains a use-after-free vulnerability which can allow for remote code execution.

Adobe Flash Player Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2017-11292
Proveedor: Adobe
Producto: Flash Player
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Adobe Flash Player contains a type confusion vulnerability which can allow for remote code execution.

Microsoft Office Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2017-11826
Proveedor: Microsoft
Producto: Office
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.

Cisco IOS Software Network Address Translation Denial-of-Service Vulnerability

Sin confirmar

CVE: CVE-2017-12231
Proveedor: Cisco
Producto: IOS software
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in the implementation of Network Address Translation (NAT) functionality in Cisco IOS could allow an unauthenticated, remote attacker to cause a denial of service.

Cisco IOS Software for Cisco Integrated Services Routers Denial-of-Service Vulnerability

Sin confirmar

CVE: CVE-2017-12232
Proveedor: Cisco
Producto: IOS software
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers running Cisco IOS could allow an unauthenticated, adjacent attacker to cause an affected device to reload, resulting in a denial of service.

Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability

Sin confirmar

CVE: CVE-2017-12233
Proveedor: Cisco
Producto: IOS software
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: There is a vulnerability in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service.

Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability

Sin confirmar

CVE: CVE-2017-12234
Proveedor: Cisco
Producto: IOS software
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: There is a vulnerability in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service.

Cisco IOS Software for Cisco Industrial Ethernet Switches PROFINET Denial-of-Service Vulnerability

Sin confirmar

CVE: CVE-2017-12235
Proveedor: Cisco
Producto: IOS software
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in the implementation of the PROFINET Discovery and Configuration Protocol (PN-DCP) for Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service.

Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability

Sin confirmar

CVE: CVE-2017-12237
Proveedor: Cisco
Producto: IOS and IOS XE Software
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS and Cisco IOS XE could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of service.

Cisco Catalyst 6800 Series Switches VPLS Denial-of-Service Vulnerability

Sin confirmar

CVE: CVE-2017-12238
Proveedor: Cisco
Producto: Catalyst 6800 Series Switches
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, adjacent attacker to cause a denial of service.

Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2017-12240
Proveedor: Cisco
Producto: IOS and IOS XE Software
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Dynamic Host Configuration Protocol (DHCP) relay subsystem of Cisco IOS and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system.

Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service Vulnerability

Sin confirmar

CVE: CVE-2017-12319
Proveedor: Cisco
Producto: IOS XE Software
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service (DoS) condition, or potentially corrupt the BGP routing table, which could result in network instability.

Cisco IOS Software and Cisco IOS XE Software UDP Packet Processing Denial-of-Service Vulnerability

Sin confirmar

CVE: CVE-2017-6627
Proveedor: Cisco
Producto: IOS and IOS XE Software
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in the UDP processing code of Cisco IOS and IOS XE could allow an unauthenticated, remote attacker to cause the input queue of an affected system to hold UDP packets, causing an interface queue wedge and denial of service.

Cisco IOS Software and Cisco IOS XE Software Denial-of-Service Vulnerability

Sin confirmar

CVE: CVE-2017-6663
Proveedor: Cisco
Producto: IOS and IOS XE Software
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause autonomic nodes of an affected system to reload, resulting in denial-of-service (DoS).

Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2017-6736
Proveedor: Cisco
Producto: IOS and IOS XE Software
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.

Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2017-6737
Proveedor: Cisco
Producto: IOS and IOS XE Software
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.

Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2017-6738
Proveedor: Cisco
Producto: IOS and IOS XE Software
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.

Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2017-6739
Proveedor: Cisco
Producto: IOS and IOS XE Software
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.

Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2017-6740
Proveedor: Cisco
Producto: IOS and IOS XE Software
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.

Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2017-6743
Proveedor: Cisco
Producto: IOS and IOS XE Software
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.

Cisco IOS Software SNMP Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2017-6744
Proveedor: Cisco
Producto: IOS software
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS 1 contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6.

Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability

Sin confirmar

CVE: CVE-2017-8540
Proveedor: Microsoft
Producto: Malware Protection Engine
Incorporada: 03/03/2022
Objetivo: 24/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability".

Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2018-0151
Proveedor: Cisco
Producto: IOS and IOS XE Software
Incorporada: 03/03/2022
Objetivo: 17/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges.

Cisco IOS Software Integrated Services Module for VPN Denial-of-Service Vulnerability

Sin confirmar

CVE: CVE-2018-0154
Proveedor: Cisco
Producto: IOS Software
Incorporada: 03/03/2022
Objetivo: 17/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) condition.

Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability

Sin confirmar

CVE: CVE-2018-0155
Proveedor: Cisco
Producto: Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches
Incorporada: 03/03/2022
Objetivo: 17/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, causing a denial-of-service (DoS) condition.

Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability

Sin confirmar

CVE: CVE-2018-0156
Proveedor: Cisco
Producto: IOS Software and Cisco IOS XE Software
Incorporada: 03/03/2022
Objetivo: 17/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial-of-service (DoS) condition.

Cisco IOS and XE Software Internet Key Exchange Memory Leak Vulnerability

Sin confirmar

CVE: CVE-2018-0158
Proveedor: Cisco
Producto: IOS Software and Cisco IOS XE Software
Incorporada: 03/03/2022
Objetivo: 17/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial-of-service (DoS) condition.

Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability

Sin confirmar

CVE: CVE-2018-0159
Proveedor: Cisco
Producto: IOS Software and Cisco IOS XE Software
Incorporada: 03/03/2022
Objetivo: 17/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial-of-service (DoS) condition.

Cisco IOS Software Resource Management Errors Vulnerability

Sin confirmar

CVE: CVE-2018-0161
Proveedor: Cisco
Producto: IOS Software
Incorporada: 03/03/2022
Objetivo: 17/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst Switches could allow an authenticated, remote attacker to cause a denial-of-service (DoS) condition.

Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2018-0167
Proveedor: Cisco
Producto: IOS, XR, and XE Software
Incorporada: 03/03/2022
Objetivo: 17/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: There is a buffer overflow vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software which could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code.

Cisco IOS and IOS XE Software Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2018-0172
Proveedor: Cisco
Producto: IOS and IOS XE Software
Incorporada: 03/03/2022
Objetivo: 17/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS).

Cisco IOS and IOS XE Software Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2018-0173
Proveedor: Cisco
Producto: IOS and IOS XE Software
Incorporada: 03/03/2022
Objetivo: 17/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets can allow for denial-of-service (DoS).

Cisco IOS Software and Cisco IOS XE Software Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2018-0174
Proveedor: Cisco
Producto: IOS XE Software
Incorporada: 03/03/2022
Objetivo: 17/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS).

Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2018-0175
Proveedor: Cisco
Producto: IOS, XR, and XE Software
Incorporada: 03/03/2022
Objetivo: 17/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Format string vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device.

Cisco IOS Software Denial-of-Service Vulnerability

Sin confirmar

CVE: CVE-2018-0179
Proveedor: Cisco
Producto: IOS Software
Incorporada: 03/03/2022
Objetivo: 17/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service (DoS) condition.

Cisco IOS Software Denial-of-Service Vulnerability

Sin confirmar

CVE: CVE-2018-0180
Proveedor: Cisco
Producto: IOS Software
Incorporada: 03/03/2022
Objetivo: 17/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service (DoS) condition.

ChakraCore Scripting Engine Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2018-8298
Proveedor: ChakraCore
Producto: ChakraCore scripting engine
Incorporada: 03/03/2022
Objetivo: 17/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The ChakraCore scripting engine contains a type confusion vulnerability which can allow for remote code execution.

Microsoft Exchange Server Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2018-8581
Proveedor: Microsoft
Producto: Exchange Server
Incorporada: 03/03/2022
Objetivo: 17/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A privilege escalation vulnerability exists in Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could attempt to impersonate any other user of the Exchange server.

Microsoft Excel Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2019-1297
Proveedor: Microsoft
Producto: Excel
Incorporada: 03/03/2022
Objetivo: 17/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A remote code execution vulnerability exists in Microsoft Excel when the software fails to properly handle objects in memory.

Cisco Small Business Routers Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2019-1652
Proveedor: Cisco
Producto: Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers
Incorporada: 03/03/2022
Objetivo: 17/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands.

Exim Out-of-bounds Write Vulnerability

Sin confirmar

CVE: CVE-2019-16928
Proveedor: Exim
Producto: Exim Internet Mailer
Incorporada: 03/03/2022
Objetivo: 17/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Exim contains an out-of-bounds write vulnerability which can allow for remote code execution.

Treck TCP/IP stack Out-of-Bounds Read Vulnerability

Sin confirmar

CVE: CVE-2020-11899
Proveedor: Treck TCP/IP stack
Producto: IPv6
Incorporada: 03/03/2022
Objetivo: 17/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Treck TCP/IP stack contains an IPv6 out-of-bounds read vulnerability.

Apache Tomcat Improper Privilege Management Vulnerability

Sin confirmar

CVE: CVE-2020-1938
Proveedor: Apache
Producto: Tomcat
Incorporada: 03/03/2022
Objetivo: 17/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited.

Microsoft Windows Installer Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2021-41379
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/03/2022
Objetivo: 17/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Installer contains an unspecified vulnerability that allows for privilege escalation.

Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2022-20699
Proveedor: Cisco
Producto: Small Business RV160, RV260, RV340, and RV345 Series Routers
Incorporada: 03/03/2022
Objetivo: 17/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).

Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2022-20700
Proveedor: Cisco
Producto: Small Business RV160, RV260, RV340, and RV345 Series Routers
Incorporada: 03/03/2022
Objetivo: 17/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).

Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2022-20701
Proveedor: Cisco
Producto: Small Business RV160, RV260, RV340, and RV345 Series Routers
Incorporada: 03/03/2022
Objetivo: 17/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).

Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2022-20703
Proveedor: Cisco
Producto: Small Business RV160, RV260, RV340, and RV345 Series Routers
Incorporada: 03/03/2022
Objetivo: 17/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).

Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2022-20708
Proveedor: Cisco
Producto: Small Business RV160, RV260, RV340, and RV345 Series Routers
Incorporada: 03/03/2022
Objetivo: 17/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).

Microsoft Windows Code Injection Vulnerability

Sin confirmar

CVE: CVE-2014-6352
Proveedor: Microsoft
Producto: Windows
Incorporada: 25/02/2022
Objetivo: 25/08/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows allow remote attackers to execute arbitrary code via a crafted OLE object.

Microsoft Internet Explorer Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2017-0222
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 25/02/2022
Objetivo: 25/08/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory.

Microsoft Office Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2017-8570
Proveedor: Microsoft
Producto: Office
Incorporada: 25/02/2022
Objetivo: 25/08/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory.

Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability

Confirmado

CVE: CVE-2022-24682
Proveedor: Synacor
Producto: Zimbra Collaborate Suite (ZCS)
Incorporada: 25/02/2022
Objetivo: 11/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability in the Calendar feature that allows an attacker to execute arbitrary code.

Zabbix Frontend Authentication Bypass Vulnerability

Sin confirmar

CVE: CVE-2022-23131
Proveedor: Zabbix
Producto: Frontend
Incorporada: 22/02/2022
Objetivo: 08/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML.

Zabbix Frontend Improper Access Control Vulnerability

Sin confirmar

CVE: CVE-2022-23134
Proveedor: Zabbix
Producto: Frontend
Incorporada: 22/02/2022
Objetivo: 08/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Malicious actors can pass step checks and potentially change the configuration of Zabbix Frontend.

Microsoft Graphics Component Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2013-3906
Proveedor: Microsoft
Producto: Graphics Component
Incorporada: 15/02/2022
Objetivo: 15/08/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Graphics Component contains a memory corruption vulnerability which can allow for remote code execution.

Microsoft Word Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2014-1761
Proveedor: Microsoft
Producto: Word
Incorporada: 15/02/2022
Objetivo: 15/08/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Word contains a memory corruption vulnerability which when exploited could allow for remote code execution.

PHPUnit Command Injection Vulnerability

Sin confirmar

CVE: CVE-2017-9841
Proveedor: PHPUnit
Producto: PHPUnit
Incorporada: 15/02/2022
Objetivo: 15/08/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

Adobe Flash Player Use-After-Free Vulnerability

Confirmado

CVE: CVE-2018-15982
Proveedor: Adobe
Producto: Flash Player
Incorporada: 15/02/2022
Objetivo: 15/08/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerability

WinRAR Absolute Path Traversal Vulnerability

Confirmado

CVE: CVE-2018-20250
Proveedor: RARLAB
Producto: WinRAR
Incorporada: 15/02/2022
Objetivo: 15/08/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution

Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability

Confirmado

CVE: CVE-2018-8174
Proveedor: Microsoft
Producto: Windows
Incorporada: 15/02/2022
Objetivo: 15/08/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution"

Microsoft Internet Explorer Type Confusion Vulnerability

Confirmado

CVE: CVE-2019-0752
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 15/02/2022
Objetivo: 15/08/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer

Google Chromium Animation Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2022-0609
Proveedor: Google
Producto: Chromium Animation
Incorporada: 15/02/2022
Objetivo: 01/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium Animation contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2022-24086
Proveedor: Adobe
Producto: Commerce and Magento Open Source
Incorporada: 15/02/2022
Objetivo: 01/03/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.

Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2022-22620
Proveedor: Apple
Producto: iOS, iPadOS, and macOS
Incorporada: 11/02/2022
Objetivo: 25/02/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Apple OS X Heap-Based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2014-4404
Proveedor: Apple
Producto: OS X
Incorporada: 10/02/2022
Objetivo: 10/08/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Heap-based buffer overflow in IOHIDFamily in Apple OS X, which affects, iOS before 8 and Apple TV before 7, allows attackers to execute arbitrary code in a privileged context.

Apple OS X Authentication Bypass Vulnerability

Sin confirmar

CVE: CVE-2015-1130
Proveedor: Apple
Producto: OS X
Incorporada: 10/02/2022
Objetivo: 10/08/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges.

Microsoft HTTP.sys Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2015-1635
Proveedor: Microsoft
Producto: HTTP.sys
Incorporada: 10/02/2022
Objetivo: 10/08/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft HTTP protocol stack (HTTP.sys) contains a vulnerability that allows for remote code execution.

D-Link DIR-645 Router Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2015-2051
Proveedor: D-Link
Producto: DIR-645 Router
Incorporada: 10/02/2022
Objetivo: 10/08/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: D-Link DIR-645 Wired/Wireless Router allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.

Apache ActiveMQ Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2016-3088
Proveedor: Apache
Producto: ActiveMQ
Incorporada: 10/02/2022
Objetivo: 10/08/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request

Microsoft SMBv1 Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2017-0144
Proveedor: Microsoft
Producto: SMBv1
Incorporada: 10/02/2022
Objetivo: 10/08/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.

Microsoft SMBv1 Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2017-0145
Proveedor: Microsoft
Producto: SMBv1
Incorporada: 10/02/2022
Objetivo: 10/08/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.

Microsoft Office Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2017-0262
Proveedor: Microsoft
Producto: Office
Incorporada: 10/02/2022
Objetivo: 10/08/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A remote code execution vulnerability exists in Microsoft Office.

Microsoft Win32k Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2017-0263
Proveedor: Microsoft
Producto: Win32k
Incorporada: 10/02/2022
Objetivo: 10/08/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Win32k contains a privilege escalation vulnerability due to the Windows kernel-mode driver failing to properly handle objects in memory.

Oracle Corporation WebLogic Server Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2017-10271
Proveedor: Oracle
Producto: WebLogic Server
Incorporada: 10/02/2022
Objetivo: 10/08/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution.

Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2017-8464
Proveedor: Microsoft
Producto: Windows
Incorporada: 10/02/2022
Objetivo: 10/08/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Windows Shell in multiple versions of Microsoft Windows allows local users or remote attackers to execute arbitrary code via a crafted .LNK file

Apache Struts 1 Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2017-9791
Proveedor: Apache
Producto: Struts 1
Incorporada: 10/02/2022
Objetivo: 10/08/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.

Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability

Sin confirmar

CVE: CVE-2018-1000861
Proveedor: Jenkins
Producto: Jenkins Stapler Web Framework
Incorporada: 10/02/2022
Objetivo: 10/08/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A code execution vulnerability exists in the Stapler web framework used by Jenkins

Microsoft SMBv3 Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2020-0796
Proveedor: Microsoft
Producto: SMBv3
Incorporada: 10/02/2022
Objetivo: 10/08/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.

Microsoft Windows SAM Local Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2021-36934
Proveedor: Microsoft
Producto: Windows
Incorporada: 10/02/2022
Objetivo: 24/02/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: If a Volume Shadow Copy (VSS) shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level.

Microsoft Win32k Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2022-21882
Proveedor: Microsoft
Producto: Win32k
Incorporada: 04/02/2022
Objetivo: 18/02/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.

Microsoft Internet Explorer Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2014-1776
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 28/01/2022
Objetivo: 28/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code in the context of the current user.

GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

Sin confirmar

CVE: CVE-2014-6271
Proveedor: GNU
Producto: Bourne-Again Shell (Bash)
Incorporada: 28/01/2022
Objetivo: 28/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code.

GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

Sin confirmar

CVE: CVE-2014-7169
Proveedor: GNU
Producto: Bourne-Again Shell (Bash)
Incorporada: 28/01/2022
Objetivo: 28/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code. This CVE correctly remediates the vulnerability in CVE-2014-6271.

Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2017-5689
Proveedor: Intel
Producto: Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability
Incorporada: 28/01/2022
Objetivo: 28/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Intel products contain a vulnerability which can allow attackers to perform privilege escalation.

Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability

Confirmado

CVE: CVE-2020-0787
Proveedor: Microsoft
Producto: Windows
Incorporada: 28/01/2022
Objetivo: 28/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges.

Grandstream Networks UCM6200 Series SQL Injection Vulnerability

Sin confirmar

CVE: CVE-2020-5722
Proveedor: Grandstream
Producto: UCM6200
Incorporada: 28/01/2022
Objetivo: 28/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. Exploitation can allow for code execution as root.

SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability

Confirmado

CVE: CVE-2021-20038
Proveedor: SonicWall
Producto: SMA 100 Appliances
Incorporada: 28/01/2022
Objetivo: 11/02/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution.

Apple Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2022-22587
Proveedor: Apple
Producto: iOS and macOS
Incorporada: 28/01/2022
Objetivo: 11/02/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple IOMobileFrameBuffer contains a memory corruption vulnerability which can allow a malicious application to execute arbitrary code with kernel privileges.

Apache Struts 1 ActionForm Denial-of-Service Vulnerability

Sin confirmar

CVE: CVE-2006-1547
Proveedor: Apache
Producto: Struts 1
Incorporada: 21/01/2022
Objetivo: 21/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS).

Apache Struts 2 Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2012-0391
Proveedor: Apache
Producto: Struts 2
Incorporada: 21/01/2022
Objetivo: 21/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution.

Microsoft Win32k Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2018-8453
Proveedor: Microsoft
Producto: Win32k
Incorporada: 21/01/2022
Objetivo: 21/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Win32k contains a vulnerability that allows an attacker to escalate privileges.

SolarWinds Serv-U Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2021-35247
Proveedor: SolarWinds
Producto: Serv-U
Incorporada: 21/01/2022
Objetivo: 04/02/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: SolarWinds Serv-U versions 15.2.5 and earlier contain an improper input validation vulnerability that allows attackers to build and send queries without sanitization.

Apache Airflow Command Injection

Sin confirmar

CVE: CVE-2020-11978
Proveedor: Apache
Producto: Airflow
Incorporada: 18/01/2022
Objetivo: 18/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.

Drupal core Un-restricted Upload of File

Sin confirmar

CVE: CVE-2020-13671
Proveedor: Drupal
Producto: Drupal core
Incorporada: 18/01/2022
Objetivo: 18/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Improper sanitization in the extension file names is present in Drupal core.

Apache Airflow's Experimental API Authentication Bypass

Sin confirmar

CVE: CVE-2020-13927
Proveedor: Apache
Producto: Airflow's Experimental API
Incorporada: 18/01/2022
Objetivo: 18/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.

Oracle Business Intelligence Enterprise Edition Path Transversal

Sin confirmar

CVE: CVE-2020-14864
Proveedor: Oracle
Producto: Intelligence Enterprise Edition
Incorporada: 18/01/2022
Objetivo: 18/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file.

System Information Library for Node.JS Command Injection

Sin confirmar

CVE: CVE-2021-21315
Proveedor: Npm package
Producto: System Information Library for Node.JS
Incorporada: 18/01/2022
Objetivo: 01/02/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote.

VMware Server Side Request Forgery in vRealize Operations Manager API

Confirmado

CVE: CVE-2021-21975
Proveedor: VMware
Producto: vRealize Operations Manager API
Incorporada: 18/01/2022
Objetivo: 01/02/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.

F5 BIG-IP Traffic Management Microkernel Buffer Overflow

Sin confirmar

CVE: CVE-2021-22991
Proveedor: F5
Producto: BIG-IP Traffic Management Microkernel
Incorporada: 18/01/2022
Objetivo: 01/02/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls.

Nagios XI OS Command Injection

Sin confirmar

CVE: CVE-2021-25296
Proveedor: Nagios
Producto: Nagios XI
Incorporada: 18/01/2022
Objetivo: 01/02/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.

Nagios XI OS Command Injection

Sin confirmar

CVE: CVE-2021-25297
Proveedor: Nagios
Producto: Nagios XI
Incorporada: 18/01/2022
Objetivo: 01/02/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.

Nagios XI OS Command Injection

Sin confirmar

CVE: CVE-2021-25298
Proveedor: Nagios
Producto: Nagios XI
Incorporada: 18/01/2022
Objetivo: 01/02/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.

October CMS Improper Authentication

Sin confirmar

CVE: CVE-2021-32648
Proveedor: October CMS
Producto: October CMS
Incorporada: 18/01/2022
Objetivo: 01/02/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request.

Microsoft Exchange Server Information Disclosure

Sin confirmar

CVE: CVE-2021-33766
Proveedor: Microsoft
Producto: Exchange Server
Incorporada: 18/01/2022
Objetivo: 01/02/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target.

Aviatrix Controller Unrestricted Upload of File

Sin confirmar

CVE: CVE-2021-40870
Proveedor: Aviatrix
Producto: Aviatrix Controller
Incorporada: 18/01/2022
Objetivo: 01/02/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.

Microsoft WinVerifyTrust function Remote Code Execution

Sin confirmar

CVE: CVE-2013-3900
Proveedor: Microsoft
Producto: WinVerifyTrust function
Incorporada: 10/01/2022
Objetivo: 10/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files.

IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.

Sin confirmar

CVE: CVE-2015-7450
Proveedor: IBM
Producto: WebSphere Application Server and Server Hypervisor Edition
Incorporada: 10/01/2022
Objetivo: 10/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands

Primetek Primefaces Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2017-1000486
Proveedor: Primetek
Producto: Primefaces Application
Incorporada: 10/01/2022
Objetivo: 10/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Primetek Primefaces is vulnerable to a weak encryption flaw resulting in remote code execution

Fortinet FortiOS and FortiProxy Improper Authorization

Confirmado

CVE: CVE-2018-13382
Proveedor: Fortinet
Producto: FortiOS and FortiProxy
Incorporada: 10/01/2022
Objetivo: 10/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.

Fortinet FortiOS and FortiProxy Out-of-bounds Write

Confirmado

CVE: CVE-2018-13383
Proveedor: Fortinet
Producto: FortiOS and FortiProxy
Incorporada: 10/01/2022
Objetivo: 10/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.

Exim Mail Transfer Agent (MTA) Improper Input Validation

Sin confirmar

CVE: CVE-2019-10149
Proveedor: Exim
Producto: Mail Transfer Agent (MTA)
Incorporada: 10/01/2022
Objetivo: 10/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.

Microsoft Win32k Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2019-1458
Proveedor: Microsoft
Producto: Win32k
Incorporada: 10/01/2022
Objetivo: 10/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP.

Palo Alto Networks PAN-OS Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2019-1579
Proveedor: Palo Alto Networks
Producto: PAN-OS
Incorporada: 10/01/2022
Objetivo: 10/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.

Oracle WebLogic Server, Injection

Confirmado

CVE: CVE-2019-2725
Proveedor: Oracle
Producto: WebLogic Server
Incorporada: 10/01/2022
Objetivo: 10/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).

Kibana Arbitrary Code Execution

Sin confirmar

CVE: CVE-2019-7609
Proveedor: Elastic
Producto: Kibana
Incorporada: 10/01/2022
Objetivo: 10/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Kibana contain an arbitrary code execution flaw in the Timelion visualizer.

Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference

Sin confirmar

CVE: CVE-2019-9670
Proveedor: Synacor
Producto: Zimbra Collaboration Suite (ZCS)
Incorporada: 10/01/2022
Objetivo: 10/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component.

Google Chrome Media Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2020-6572
Proveedor: Google
Producto: Chrome Media
Incorporada: 10/01/2022
Objetivo: 10/07/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chrome Media contains a use-after-free vulnerability that allows a remote attacker to execute code via a crafted HTML page.

VMware vCenter Server Improper Access Control

Sin confirmar

CVE: CVE-2021-22017
Proveedor: VMware
Producto: vCenter Server
Incorporada: 10/01/2022
Objetivo: 24/01/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.

FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit

Sin confirmar

CVE: CVE-2021-27860
Proveedor: FatPipe
Producto: WARP, IPVPN, and MPVPN software
Incorporada: 10/01/2022
Objetivo: 24/01/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem.

Hikvision Improper Input Validation

Sin confirmar

CVE: CVE-2021-36260
Proveedor: Hikvision
Producto: Security cameras web server
Incorporada: 10/01/2022
Objetivo: 24/01/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation.

Google Chromium V8 Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2021-4102
Proveedor: Google
Producto: Chromium V8
Incorporada: 15/12/2021
Objetivo: 29/12/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Microsoft Windows AppX Installer Spoofing Vulnerability

Confirmado

CVE: CVE-2021-43890
Proveedor: Microsoft
Producto: Windows
Incorporada: 15/12/2021
Objetivo: 29/12/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability.

Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2010-1871
Proveedor: Red Hat
Producto: JBoss Seam 2
Incorporada: 10/12/2021
Objetivo: 10/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote code execution. This vulnerability can only be exploited when the Java Security Manager is not properly configured.

Red Hat JBoss Application Server Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2017-12149
Proveedor: Red Hat
Producto: JBoss Application Server
Incorporada: 10/12/2021
Objetivo: 10/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data.

Embedthis GoAhead Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2017-17562
Proveedor: Embedthis
Producto: GoAhead
Incorporada: 10/12/2021
Objetivo: 10/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.

Apache Solr DataImportHandler Code Injection Vulnerability

Sin confirmar

CVE: CVE-2019-0193
Proveedor: Apache
Producto: Solr
Incorporada: 10/12/2021
Objetivo: 10/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The optional Apache Solr module DataImportHandler contains a code injection vulnerability.

MongoDB mongo-express Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2019-10758
Proveedor: MongoDB
Producto: mongo-express
Incorporada: 10/12/2021
Objetivo: 10/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method.

Linux Kernel Improper Privilege Management Vulnerability

Sin confirmar

CVE: CVE-2019-13272
Proveedor: Linux
Producto: Kernel
Incorporada: 10/12/2021
Objetivo: 10/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Kernel/ptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access.

Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability

Sin confirmar

CVE: CVE-2019-7238
Proveedor: Sonatype
Producto: Nexus Repository Manager
Incorporada: 10/12/2021
Objetivo: 10/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Sonatype Nexus Repository Manager before 3.15.0 has an incorrect access control vulnerability. Exploitation allows for remote code execution.

Fuel CMS SQL Injection Vulnerability

Sin confirmar

CVE: CVE-2020-17463
Proveedor: Fuel CMS
Producto: Fuel CMS
Incorporada: 10/12/2021
Objetivo: 10/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.

Pi-Hole AdminLTE Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2020-8816
Proveedor: Pi-hole
Producto: AdminLTE
Incorporada: 10/12/2021
Objetivo: 10/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.

Realtek Jungle SDK Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2021-35394
Proveedor: Realtek
Producto: Jungle Software Development Kit (SDK)
Incorporada: 10/12/2021
Objetivo: 24/12/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution.

Fortinet FortiOS Arbitrary File Download

Sin confirmar

CVE: CVE-2021-44168
Proveedor: Fortinet
Producto: FortiOS
Incorporada: 10/12/2021
Objetivo: 24/12/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Fortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files.

Apache Log4j2 Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2021-44228
Proveedor: Apache
Producto: Log4j2
Incorporada: 10/12/2021
Objetivo: 24/12/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.
Descripción CISA: Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.

Zoho Desktop Central Authentication Bypass Vulnerability

Sin confirmar

CVE: CVE-2021-44515
Proveedor: Zoho
Producto: Desktop Central
Incorporada: 10/12/2021
Objetivo: 24/12/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.

MikroTik Router OS Directory Traversal Vulnerability

Sin confirmar

CVE: CVE-2018-14847
Proveedor: MikroTik
Producto: RouterOS
Incorporada: 01/12/2021
Objetivo: 01/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.

Qualcomm Multiple Chipsets Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2020-11261
Proveedor: Qualcomm
Producto: Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Incorporada: 01/12/2021
Objetivo: 01/06/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability

Sin confirmar

CVE: CVE-2021-37415
Proveedor: Zoho
Producto: ManageEngine ServiceDesk Plus (SDP)
Incorporada: 01/12/2021
Objetivo: 15/12/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication

Apache HTTP Server-Side Request Forgery (SSRF)

Confirmado

CVE: CVE-2021-40438
Proveedor: Apache
Producto: Apache
Incorporada: 01/12/2021
Objetivo: 15/12/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2021-44077
Proveedor: Zoho
Producto: ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus
Incorporada: 01/12/2021
Objetivo: 15/12/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution

ExifTool Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2021-22204
Proveedor: Perl
Producto: Exiftool
Incorporada: 17/11/2021
Objetivo: 01/12/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

Microsoft Windows Win32k Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2021-40449
Proveedor: Microsoft
Producto: Windows
Incorporada: 17/11/2021
Objetivo: 01/12/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Unspecified vulnerability allows for an authenticated user to escalate privileges.

Microsoft Excel Security Feature Bypass

Sin confirmar

CVE: CVE-2021-42292
Proveedor: Microsoft
Producto: Office
Incorporada: 17/11/2021
Objetivo: 01/12/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: A security feature bypass vulnerability in Microsoft Excel would allow a local user to perform arbitrary code execution.

Microsoft Exchange Server Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2021-42321
Proveedor: Microsoft
Producto: Exchange
Incorporada: 17/11/2021
Objetivo: 01/12/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: An authenticated attacker could leverage improper validation in cmdlet arguments within Microsoft Exchange and perform remote code execution.

SAP NetWeaver Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2010-5326
Proveedor: SAP
Producto: NetWeaver
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: SAP NetWeaver Application Server Java Platforms Invoker Servlet does not require authentication, allowing for remote code execution via a HTTP or HTTPS request.

Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2012-0158
Proveedor: Microsoft
Producto: MSCOMCTL.OCX
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft MSCOMCTL.OCX contains an unspecified vulnerability that allows for remote code execution, allowing an attacker to take complete control of an affected system under the context of the current user.

Oracle Fusion Middleware Unspecified Vulnerability

Sin confirmar

CVE: CVE-2012-3152
Proveedor: Oracle
Producto: Fusion Middleware
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Oracle Fusion Middleware Reports Developer contains an unspecified vulnerability that allows remote attackers to affect confidentiality and integrity of affected systems.

Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2014-1812
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Active Directory contains a privilege escalation vulnerability due to the way it distributes passwords that are configured using Group Policy preferences. An authenticated attacker who successfully exploits the vulnerability could decrypt the passwords and use them to elevate privileges on the domain.

Microsoft Office Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2015-1641
Proveedor: Microsoft
Producto: Office
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Office contains a memory corruption vulnerability due to failure to properly handle rich text format files in memory. Successful exploitation allows for remote code execution in the context of the current user.

Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability

Sin confirmar

CVE: CVE-2015-4852
Proveedor: Oracle
Producto: WebLogic Server
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Oracle WebLogic Server contains a deserialization of untrusted data vulnerability within Apache Commons, which can allow for for remote code execution.

Microsoft Win32k Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2016-0167
Proveedor: Microsoft
Producto: Win32k
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation via a crafted application

Microsoft Windows Media Center Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2016-0185
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Media Center contains a remote code execution vulnerability when Windows Media Center opens a specially crafted Media Center link (.mcl) file that references malicious code.

Microsoft Office OLE DLL Side Loading Vulnerability

Sin confirmar

CVE: CVE-2016-3235
Proveedor: Microsoft
Producto: Office
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Office Object Linking & Embedding (OLE) dynamic link library (DLL) contains a side loading vulnerability due to it improperly validating input before loading libraries. Successful exploitation allows for remote code execution.

SolarWinds Virtualization Manager Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2016-3643
Proveedor: SolarWinds
Producto: Virtualization Manager
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: SolarWinds Virtualization Manager allows for privilege escalation through leveraging a misconfiguration of sudo.

ImageMagick Arbitrary File Deletion Vulnerability

Sin confirmar

CVE: CVE-2016-3715
Proveedor: ImageMagick
Producto: ImageMagick
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: ImageMagick contains an unspecified vulnerability that could allow users to delete files by using ImageMagick's 'ephemeral' pseudo protocol, which deletes files after reading.

ImageMagick Server-Side Request Forgery (SSRF) Vulnerability

Sin confirmar

CVE: CVE-2016-3718
Proveedor: ImageMagick
Producto: ImageMagick
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: ImageMagick contains an unspecified vulnerability that allows attackers to perform server-side request forgery (SSRF) via a crafted image.

SAP NetWeaver Directory Traversal Vulnerability

Sin confirmar

CVE: CVE-2016-3976
Proveedor: SAP
Producto: NetWeaver
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: SAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet. This allows remote attackers to read files.

Apache Shiro Code Execution Vulnerability

Sin confirmar

CVE: CVE-2016-4437
Proveedor: Apache
Producto: Shiro
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apache Shiro contains a vulnerability which may allow remote attackers to execute code or bypass intended access restrictions via an unspecified request parameter when a cipher key has not been configured for the "remember me" feature.

Microsoft Win32k Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2016-7255
Proveedor: Microsoft
Producto: Win32k
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Win32k kernel-mode driver fails to properly handle objects in memory which allows for privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.

SAP NetWeaver XML External Entity (XXE) Vulnerability

Sin confirmar

CVE: CVE-2016-9563
Proveedor: SAP
Producto: NetWeaver
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity (XXE) attacks.

Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2017-0143
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Server Message Block 1.0 (SMBv1) contains an unspecified vulnerability that allows for remote code execution.

Microsoft Office and WordPad Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2017-0199
Proveedor: Microsoft
Producto: Office and WordPad
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Office and WordPad contain an unspecified vulnerability due to the way the applications parse specially crafted files. Successful exploitation allows for remote code execution.

Microsoft Office Outlook Security Feature Bypass Vulnerability

Sin confirmar

CVE: CVE-2017-11774
Proveedor: Microsoft
Producto: Office
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Office Outlook contains a security feature bypass vulnerability due to improperly handling objects in memory. Successful exploitation allows an attacker to execute commands.

Microsoft Office Memory Corruption Vulnerability

Confirmado

CVE: CVE-2017-11882
Proveedor: Microsoft
Producto: Office
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Office contains a memory corruption vulnerability that allows remote code execution in the context of the current user.

Roundcube Webmail File Disclosure Vulnerability

Sin confirmar

CVE: CVE-2017-16651
Proveedor: Roundcube
Producto: Roundcube Webmail
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default.

Apache Struts Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2017-5638
Proveedor: Apache
Producto: Struts
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.

Symantec Messaging Gateway Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2017-6327
Proveedor: Symantec
Producto: Symantec Messaging Gateway
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Symantec Messaging Gateway contains an unspecified vulnerability which can allow for remote code execution. With the ability to perform remote code execution, an attacker may also desire to perform privilege escalating actions.

Microsoft Windows Server Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2017-7269
Proveedor: Microsoft
Producto: Internet Information Services (IIS)
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Server 2003 R2 contains a buffer overflow vulnerability in Internet Information Services (IIS) 6.0 which allows remote attackers to execute code via a long header beginning with "If: <http://" in a PROPFIND request.

Microsoft .NET Framework Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2017-8759
Proveedor: Microsoft
Producto: .NET Framework
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft .NET Framework contains a remote code execution vulnerability when processing untrusted input that could allow an attacker to take control of an affected system.

Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability

Sin confirmar

CVE: CVE-2017-9248
Proveedor: Progress
Producto: ASP.NET AJAX and Sitefinity
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Progress Telerik UI for ASP.NET AJAX and Sitefinity have a cryptographic weakness in Telerik.Web.UI.dll that can be exploited to disclose encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or the MachineKey), perform cross-site-scripting (XSS) attacks, compromise the ASP.NET ViewState, and/or upload and download files.

Apache Struts Deserialization of Untrusted Data Vulnerability

Sin confirmar

CVE: CVE-2017-9805
Proveedor: Apache
Producto: Struts
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.

DotNetNuke (DNN) Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2017-9822
Proveedor: DotNetNuke (DNN)
Producto: DotNetNuke (DNN)
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: DotNetNuke (DNN) contains a vulnerability that may allow for remote code execution via cookie deserialization.

Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2018-0171
Proveedor: Cisco
Producto: IOS and IOS XE
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Cisco IOS and IOS XE Software improperly validates packet data, allowing an unauthenticated, remote attacker to trigger a reload of an affected device, cause a denial-of-service (DoS) condition, or perform code execution on the affected device.

Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability

Sin confirmar

CVE: CVE-2018-0296
Proveedor: Cisco
Producto: Adaptive Security Appliance (ASA)
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Cisco Adaptive Security Appliance (ASA) contains an improper input validation vulnerability with HTTP URLs. Exploitation could allow an attacker to cause a denial-of-service (DoS) condition or information disclosure.

Microsoft Office Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2018-0798
Proveedor: Microsoft
Producto: Office
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0802.

Microsoft Office Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2018-0802
Proveedor: Microsoft
Producto: Office
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0798.

Apache Struts Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2018-11776
Proveedor: Apache
Producto: Struts
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace. Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace.

Fortinet FortiOS SSL VPN Path Traversal Vulnerability

Confirmado

CVE: CVE-2018-13379
Proveedor: Fortinet
Producto: FortiOS
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.

Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability

Sin confirmar

CVE: CVE-2018-14558
Proveedor: Tenda
Producto: AC7, AC9, and AC10 Routers
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Tenda AC7, AC9, and AC10 devices contain a command injection vulnerability due to the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input. Successful exploitation allows an attacker to execute OS commands via a crafted goform/setUsbUnload request.

DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability

Sin confirmar

CVE: CVE-2018-15811
Proveedor: DotNetNuke (DNN)
Producto: DotNetNuke (DNN)
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters.

Adobe ColdFusion Unrestricted File Upload Vulnerability

Sin confirmar

CVE: CVE-2018-15961
Proveedor: Adobe
Producto: ColdFusion
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution.

DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability

Sin confirmar

CVE: CVE-2018-18325
Proveedor: DotNetNuke (DNN)
Producto: DotNetNuke (DNN)
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters. This CVE ID resolves an incomplete patch for CVE-2018-15811.

ThinkPHP "noneCms" Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2018-20062
Proveedor: ThinkPHP
Producto: noneCms
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: ThinkPHP "noneCms" contains an unspecified vulnerability that allows for remote code execution through crafted use of the filter parameter.

SAP Customer Relationship Management (CRM) Path Traversal Vulnerability

Confirmado

CVE: CVE-2018-2380
Proveedor: SAP
Producto: Customer Relationship Management (CRM)
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.

Adobe Flash Player Use-After-Free Vulnerability

Confirmado

CVE: CVE-2018-4878
Proveedor: Adobe
Producto: Flash Player
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use.
Descripción CISA: Adobe Flash Player contains a use-after-free vulnerability that could allow for code execution.

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Sin confirmar

CVE: CVE-2018-4939
Proveedor: Adobe
Producto: ColdFusion
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could allow for code execution.

Exim Buffer Overflow Vulnerability

Confirmado

CVE: CVE-2018-6789
Proveedor: Exim
Producto: Exim
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Exim contains a buffer overflow vulnerability in the base64d function part of the SMTP listener that may allow for remote code execution.

Drupal Core Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2018-7600
Proveedor: Drupal
Producto: Drupal Core
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise.

Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2018-8653
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution.

Apache HTTP Server Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2019-0211
Proveedor: Apache
Producto: HTTP Server
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute code with the privileges of the parent process (usually root) by manipulating the scoreboard.

Microsoft MSHTML Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2019-0541
Proveedor: Microsoft
Producto: MSHTML
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft MSHTML engine contains an improper input validation vulnerability that allows for remote code execution vulnerability.

Microsoft SharePoint Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2019-0604
Proveedor: Microsoft
Producto: SharePoint
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft SharePoint fails to check the source markup of an application package. An attacker who successfully exploits the vulnerability could run remote code in the context of the SharePoint application pool and the SharePoint server farm account.

Microsoft Remote Desktop Services Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2019-0708
Proveedor: Microsoft
Producto: Remote Desktop Services
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Remote Desktop Services, formerly known as Terminal Service, contains an unspecified vulnerability that allows an unauthenticated attacker to connect to the target system using RDP and send specially crafted requests. Successful exploitation allows for remote code execution. The vulnerability is also known under the moniker of BlueKeep.

Microsoft Win32k Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2019-0797
Proveedor: Microsoft
Producto: Win32k
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Win32k contains a privilege escalation vulnerability when the Win32k component fails to properly handle objects in memory. Successful exploitation allows an attacker to execute code in kernel mode.

Microsoft Win32k Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2019-0803
Proveedor: Microsoft
Producto: Win32k
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Win32k contains an unspecified vulnerability due to it failing to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.

Microsoft Win32k Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2019-0808
Proveedor: Microsoft
Producto: Win32k
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Win32k contains a privilege escalation vulnerability due to the component failing to properly handle objects in memory. Successful exploitation allows an attacker to run code in kernel mode.

Microsoft Win32k Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2019-0859
Proveedor: Microsoft
Producto: Win32k
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Win32k fails to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.

Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2019-0863
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Error Reporting (WER) contains a privilege escalation vulnerability due to the way it handles files, allowing for code execution in kernel mode.

Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability

Confirmado

CVE: CVE-2019-11510
Proveedor: Ivanti
Producto: Pulse Connect Secure
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Ivanti Pulse Connect Secure contains an arbitrary file read vulnerability that allows an unauthenticated remote attacker with network access via HTTPS to send a specially crafted URI.

Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability

Confirmado

CVE: CVE-2019-11539
Proveedor: Ivanti
Producto: Pulse Connect Secure and Pulse Policy Secure
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Ivanti Pulse Connect Secure and Policy Secure allows an authenticated attacker from the admin web interface to inject and execute commands.

Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2019-11580
Proveedor: Atlassian
Producto: Crowd and Crowd Data Center
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Atlassian Crowd and Crowd Data Center contain a remote code execution vulnerability resulting from a pdkinstall development plugin being incorrectly enabled in release builds.

Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2019-11634
Proveedor: Citrix
Producto: Workspace Application and Receiver for Windows
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Citrix Workspace Application and Receiver for Windows contains remote code execution vulnerability resulting from local drive access preferences not being enforced into the clients' local drives.

Microsoft Windows Privilege Common Log File System (CLFS) Escalation Vulnerability

Sin confirmar

CVE: CVE-2019-1214
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Common Log File System (CLFS) driver improperly handles objects in memory which can allow for privilege escalation.

Microsoft Windows Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2019-1215
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows contains an unspecified vulnerability due to the way ws2ifsl.sys (Winsock) handles objects in memory, allowing for privilege escalation. Successful exploitation allows an attacker to execute code with elevated privileges.

Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability

Confirmado

CVE: CVE-2019-13608
Proveedor: Citrix
Producto: StoreFront Server
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Citrix StoreFront Server contains an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.

Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability

Confirmado

CVE: CVE-2019-1367
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Internet Explorer contains a memory corruption vulnerability in how the scripting engine handles objects in memory. Successful exploitation allows for remote code execution in the context of the current user.

Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2019-1429
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user.

Docker Desktop Community Edition Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2019-15752
Proveedor: Docker
Producto: Desktop Community Edition
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Docker Desktop Community Edition contains a vulnerability that may allow local users to escalate privileges by placing a trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\.

Nagios XI Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2019-15949
Proveedor: Nagios
Producto: Nagios XI
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Nagios XI contains a remote code execution vulnerability in which a user can modify the check_plugin executable and insert malicious commands to execute as root.

SIMalliance Toolbox Browser Command Injection Vulnerability

Sin confirmar

CVE: CVE-2019-16256
Proveedor: SIMalliance
Producto: Toolbox Browser
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: SIMalliance Toolbox Browser contains an command injection vulnerability that could allow remote attackers to retrieve location and IMEI information or execute a range of other attacks by modifying the attack message.

Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2019-1653
Proveedor: Cisco
Producto: Small Business RV320 and RV325 Routers
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers contain improper access controls for URLs. Exploitation could allow an attacker to download the router configuration or detailed diagnostic information.

vBulletin PHP Module Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2019-16759
Proveedor: vBulletin
Producto: vBulletin
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.

Mozilla Firefox And Thunderbird Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2019-17026
Proveedor: Mozilla
Producto: Firefox and Thunderbird
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Mozilla Firefox and Thunderbird contain a type confusion vulnerability due to incorrect alias information in the IonMonkey JIT compiler when setting array elements.

Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2019-17558
Proveedor: Apache
Producto: Solr
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The Apache Solr VelocityResponseWriter plug-in contains an unspecified vulnerability which can allow for remote code execution.

Trend Micro OfficeScan Directory Traversal Vulnerability

Sin confirmar

CVE: CVE-2019-18187
Proveedor: Trend Micro
Producto: OfficeScan
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Trend Micro OfficeScan contains a directory traversal vulnerability by extracting files from a zip file to a specific folder on the OfficeScan server, leading to remote code execution.

Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability

Confirmado

CVE: CVE-2019-18935
Proveedor: Progress
Producto: Telerik UI for ASP.NET AJAX
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Progress Telerik UI for ASP.NET AJAX contains a deserialization of untrusted data vulnerability through RadAsyncUpload which leads to code execution on the server in the context of the w3wp.exe process.

TeamViewer Desktop Bypass Remote Login Vulnerability

Sin confirmar

CVE: CVE-2019-18988
Proveedor: TeamViewer
Producto: Desktop
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: TeamViewer Desktop allows for bypass of remote-login access control because the same AES key is used for different customers' installations. If an attacker were to know this key, they could decrypt protected information stored in registry or configuration files or decryption of the Unattended Access password to the system (which allows for remote login to the system).

Netis WF2419 Devices Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2019-19356
Proveedor: Netis
Producto: WF2419 Devices
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Netis WF2419 devices contains an unspecified vulnerability that allows an attacker to perform remote code execution as root through the router's web management page.

Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability

Confirmado

CVE: CVE-2019-19781
Proveedor: Citrix
Producto: Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an unspecified vulnerability that could allow an unauthenticated attacker to perform code execution.

TVT NVMS-1000 Directory Traversal Vulnerability

Sin confirmar

CVE: CVE-2019-20085
Proveedor: TVT
Producto: NVMS-1000
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: TVT devices utilizing NVMS-1000 software contain a directory traversal vulnerability via GET /.. requests.

Android Kernel Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2019-2215
Proveedor: Android
Producto: Android Kernel
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Android Kernel contains a use-after-free vulnerability in binder.c that allows for privilege escalation from an application to the Linux Kernel. This vulnerability was observed chained with CVE-2020-0041 and CVE-2020-0069 under exploit chain "AbstractEmu."

Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability

Confirmado

CVE: CVE-2019-3396
Proveedor: Atlassian
Producto: Confluence Server and Data Server
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Atlassian Confluence Server and Data Center contain a server-side template injection vulnerability that may allow an attacker to achieve path traversal and remote code execution.

Atlassian Confluence Server and Data Center Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2019-3398
Proveedor: Atlassian
Producto: Confluence Server and Data Center
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Atlassian Confluence Server and Data Center contain a path traversal vulnerability in the downloadallattachments resource that may allow a privileged, remote attacker to write files. Exploitation can lead to remote code execution.

IBM Planning Analytics Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2019-4716
Proveedor: IBM
Producto: Planning Analytics
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: IBM Planning Analytics is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting.

VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability

Confirmado

CVE: CVE-2019-5544
Proveedor: VMware
Producto: VMware ESXi and Horizon DaaS
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: VMware ESXi and Horizon Desktop as a Service (DaaS) OpenSLP contains a heap-based buffer overflow vulnerability that allows an attacker with network access to port 427 to overwrite the heap of the OpenSLP service to perform remote code execution.

Fortinet FortiOS Default Configuration Vulnerability

Sin confirmar

CVE: CVE-2019-5591
Proveedor: Fortinet
Producto: FortiOS
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Fortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol (LDAP) server.

Apple iOS and macOS Group Facetime Vulnerability

Sin confirmar

CVE: CVE-2019-6223
Proveedor: Apple
Producto: iOS and macOS
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS and macOS Group FaceTime contains an unspecified vulnerability where the call initiator can cause the recipient's Apple device to answer unknowingly or without user interaction.

SonicWall SMA100 SQL Injection Vulnerability

Confirmado

CVE: CVE-2019-7481
Proveedor: SonicWall
Producto: SMA100
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: SonicWall SMA100 contains a SQL injection vulnerability allowing an unauthenticated user to gain read-only access to unauthorized resources.

Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability

Sin confirmar

CVE: CVE-2019-8394
Proveedor: Zoho
Producto: ManageEngine
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Zoho ManageEngine ServiceDesk Plus (SDP) contains an unspecified vulnerability that allows remote users to upload files via login page customization.

ThinkPHP Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2019-9082
Proveedor: ThinkPHP
Producto: ThinkPHP
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: ThinkPHP contains an unspecified vulnerability that allows for remote code execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.

WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability

Sin confirmar

CVE: CVE-2019-9978
Proveedor: WordPress
Producto: Social Warfare Plugin
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: WordPress Social Warfare plugin contains a cross-site scripting (XSS) vulnerability that allows for remote code execution. This vulnerability affects Social Warfare and Social Warfare Pro.

Android Kernel Out-of-Bounds Write Vulnerability

Sin confirmar

CVE: CVE-2020-0041
Proveedor: Android
Producto: Android Kernel
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Android Kernel binder_transaction of binder.c contains an out-of-bounds write vulnerability due to an incorrect bounds check that could allow for local privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0069 under exploit chain "AbstractEmu."

Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability

Sin confirmar

CVE: CVE-2020-0069
Proveedor: MediaTek
Producto: Multiple Chipsets
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Multiple MediaTek chipsets contain an insufficient input validation vulnerability and have missing SELinux restrictions in the Command Queue drivers ioctl handlers. This causes an out-of-bounds write leading to privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0041 under exploit chain "AbstractEmu."

Microsoft Windows CryptoAPI Spoofing Vulnerability

Sin confirmar

CVE: CVE-2020-0601
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall.

Microsoft .NET Framework Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2020-0646
Proveedor: Microsoft
Producto: .NET Framework
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft .NET Framework contains an improper input validation vulnerability that allows for remote code execution.

Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2020-0674
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Internet Explorer contains a memory corruption vulnerability due to the way the Scripting Engine handles objects in memory. Successful exploitation could allow remote code execution in the context of the current user.

Microsoft Windows Installer Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2020-0683
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Installer contains a privilege escalation vulnerability when MSI packages process symbolic links, which allows attackers to bypass access restrictions to add or remove files.

Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2020-0688
Proveedor: Microsoft
Producto: Exchange Server
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Exchange Server Validation Key fails to properly create unique keys at install time, allowing for remote code execution.

Microsoft Edge and Internet Explorer Memory Corruption Vulnerability

Confirmado

CVE: CVE-2020-0878
Proveedor: Microsoft
Producto: Edge and Internet Explorer
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Edge and Internet Explorer contain a memory corruption vulnerability that allows attackers to execute code in the context of the current user.

Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2020-0938
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.

Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2020-0968
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution.

Microsoft Windows Kernel Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2020-0986
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows kernel contains an unspecified vulnerability when handling objects in memory that allows attackers to escalate privileges and execute code in kernel mode.

SolarWinds Orion Authentication Bypass Vulnerability

Sin confirmar

CVE: CVE-2020-10148
Proveedor: SolarWinds
Producto: Orion
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: SolarWinds Orion API contains an authentication bypass vulnerability that could allow a remote attacker to execute API commands.

Sumavision EMR Cross-Site Request Forgery (CSRF) Vulnerability

Sin confirmar

CVE: CVE-2020-10181
Proveedor: Sumavision
Producto: Enhanced Multimedia Router (EMR)
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Sumavision Enhanced Multimedia Router (EMR) contains a cross-site request forgery (CSRF) vulnerability allowing the creation of users with elevated privileges as administrator on a device.

Zoho ManageEngine Desktop Central File Upload Vulnerability

Sin confirmar

CVE: CVE-2020-10189
Proveedor: Zoho
Producto: ManageEngine
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Zoho ManageEngine Desktop Central contains a file upload vulnerability that allows for unauthenticated remote code execution.

Sonatype Nexus Repository Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2020-10199
Proveedor: Sonatype
Producto: Nexus Repository
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Sonatype Nexus Repository contains an unspecified vulnerability that allows for remote code execution.

Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2020-1020
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.

rConfig OS Command Injection Vulnerability

Sin confirmar

CVE: CVE-2020-10221
Proveedor: rConfig
Producto: rConfig
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: rConfig lib/ajaxHandlers/ajaxAddTemplate.php contains an OS command injection vulnerability that allows remote attackers to execute OS commands via shell metacharacters in the fileName POST parameter.

Microsoft Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2020-1040
Proveedor: Microsoft
Producto: Hyper-V RemoteFX
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Hyper-V RemoteFX vGPU contains an improper input validation vulnerability due to the host server failing to properly validate input from an authenticated user on a guest operating system. Successful exploitation allows for remote code execution on the host operating system.

Microsoft Win32k Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2020-1054
Proveedor: Microsoft
Producto: Win32k
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Win32k contains a privilege escalation vulnerability when the Windows kernel-mode driver fails to properly handle objects in memory. Successful exploitation allows an attacker to execute code in kernel mode.

Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2020-10987
Proveedor: Tenda
Producto: AC1900 Router AC15 Model
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Tenda AC1900 Router AC15 Model contains an unspecified vulnerability that allows remote attackers to execute system commands via the deviceName POST parameter.

Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2020-1147
Proveedor: Microsoft
Producto: .NET Framework, SharePoint, Visual Studio
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft .NET Framework, Microsoft SharePoint, and Visual Studio contain a remote code execution vulnerability when the software fails to check the source markup of XML file input. Successful exploitation allows an attacker to execute code in the context of the process responsible for deserialization of the XML content.

SaltStack Salt Authentication Bypass Vulnerability

Sin confirmar

CVE: CVE-2020-11651
Proveedor: SaltStack
Producto: Salt
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: SaltStack Salt contains an authentication bypass vulnerability in the salt-master process ClearFuncs due to improperly validating method calls. The vulnerability allows a remote user to access some methods without authentication, which can be used to retrieve user tokens from the salt master and/or run commands on salt minions. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability.

SaltStack Salt Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2020-11652
Proveedor: SaltStack
Producto: Salt
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: SaltStack Salt contains a path traversal vulnerability in the salt-master process ClearFuncs which allows directory access to authenticated users. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability.

WordPress Snap Creek Duplicator Plugin File Download Vulnerability

Sin confirmar

CVE: CVE-2020-11738
Proveedor: WordPress
Producto: Snap Creek Duplicator Plugin
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro.

Sophos SFOS SQL Injection Vulnerability

Confirmado

CVE: CVE-2020-12271
Proveedor: Sophos
Producto: SFOS
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).

Fortinet FortiOS SSL VPN Improper Authentication Vulnerability

Confirmado

CVE: CVE-2020-12812
Proveedor: Fortinet
Producto: FortiOS
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username.

Microsoft Windows DNS Server Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2020-1350
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows DNS Servers fail to properly handle requests, allowing an attacker to perform remote code execution in the context of the Local System Account. The vulnerability is also known under the moniker of SIGRed.

Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2020-1380
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user.

Microsoft Windows Spoofing Vulnerability

Sin confirmar

CVE: CVE-2020-1464
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows contains a spoofing vulnerability when Windows incorrectly validates file signatures, allowing an attacker to bypass security features and load improperly signed files.

Microsoft Netlogon Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2020-1472
Proveedor: Microsoft
Producto: Netlogon
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller. An attacker who successfully exploits the vulnerability could run a specially crafted application on a device on the network. The vulnerability is also known under the moniker of Zerologon.

Oracle WebLogic Server Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2020-14750
Proveedor: Oracle
Producto: WebLogic Server
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Oracle WebLogic Server contains an unspecified vulnerability allowing an unauthenticated attacker to perform remote code execution. This vulnerability is related to CVE-2020-14882.

Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability

Sin confirmar

CVE: CVE-2020-14871
Proveedor: Oracle
Producto: Solaris and Zettabyte File System (ZFS)
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Oracle Solaris and Oracle ZFS Storage Appliance Kit contain an unspecified vulnerability causing high impacts to confidentiality, integrity, and availability of affected systems.

Oracle WebLogic Server Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2020-14882
Proveedor: Oracle
Producto: WebLogic Server
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Oracle WebLogic Server contains an unspecified vulnerability, which is assessed to allow for remote code execution, based on this vulnerability being related to CVE-2020-14750.

Oracle WebLogic Server Unspecified Vulnerability

Sin confirmar

CVE: CVE-2020-14883
Proveedor: Oracle
Producto: WebLogic Server
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Oracle WebLogic Server contains an unspecified vulnerability in the Console component with high impacts to confidentilaity, integrity, and availability.

Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2020-15505
Proveedor: Ivanti
Producto: MobileIron Multiple Products
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Ivanti MobileIron's Core & Connector, Sentry, and Monitor and Reporting Database (RDB) products contain an unspecified vulnerability that allows for remote code execution.

Google Chrome FreeType Heap Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2020-15999
Proveedor: Google
Producto: Chrome FreeType
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function Load_SBit_Png when processing PNG images embedded into fonts. This vulnerability is part of an exploit chain with CVE-2020-17087 on Windows and CVE-2020-16010 on Android.

Google Chromium V8 Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2020-16009
Proveedor: Google
Producto: Chromium V8
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Google Chrome for Android UI Heap Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2020-16010
Proveedor: Google
Producto: Chrome for Android UI
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chrome for Android UI contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page.

Google Chromium V8 Incorrect Implementation Vulnerabililty

Sin confirmar

CVE: CVE-2020-16013
Proveedor: Google
Producto: Chromium V8
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium V8 Engine contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Google Chrome Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2020-16017
Proveedor: Google
Producto: Chrome
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chrome contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page.

SaltStack Salt Shell Injection Vulnerability

Sin confirmar

CVE: CVE-2020-16846
Proveedor: SaltStack
Producto: Salt
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: SaltStack Salt allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt API using the SSH client. This vulnerability affects any users running the Salt API.

Microsoft Windows Kernel Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2020-17087
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.

Microsoft Exchange Server Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2020-17144
Proveedor: Microsoft
Producto: Exchange Server
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Exchange Server improperly validates cmdlet arguments which allow an attacker to perform remote code execution.

vBulletin PHP Module Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2020-17496
Proveedor: vBulletin
Producto: vBulletin
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. This CVE ID resolves an incomplete patch for CVE-2019-16759.

Apache Struts Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2020-17530
Proveedor: Apache
Producto: Struts
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead to remote code execution.

Trend Micro Multiple Products Improper Access Control Vulnerability

Sin confirmar

CVE: CVE-2020-24557
Proveedor: Trend Micro
Producto: Apex One, OfficeScan, and Worry-Free Business Security
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Trend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows contain an improper access control vulnerability that may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function, and attain privilege escalation.

WordPress File Manager Plugin Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2020-25213
Proveedor: WordPress
Producto: File Manager Plugin
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site.

D-Link DNS-320 Device Command Injection Vulnerability

Sin confirmar

CVE: CVE-2020-25506
Proveedor: D-Link
Producto: DNS-320 Device
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: D-Link DNS-320 device contains a command injection vulnerability in the sytem_mgr.cgi component that may allow for remote code execution.

Oracle Multiple Products Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2020-2555
Proveedor: Oracle
Producto: Multiple Products
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Multiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with network access via T3 or HTTP to takeover the affected system. Impacted Oracle products: Oracle Coherence in Fusion Middleware, Oracle Utilities Framework, Oracle Retail Assortment Planning, Oracle Commerce, Oracle Communications Diameter Signaling Router (DSR).

Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability

Sin confirmar

CVE: CVE-2020-26919
Proveedor: NETGEAR
Producto: JGS516PE Devices
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Netgear JGS516PE devices contain a missing function level access control vulnerability.

Apple Multiple Products Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2020-27930
Proveedor: Apple
Producto: Multiple Products
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, iPadOS, macOS, and watchOS FontParser contain a memory corruption vulnerability which may allow for code execution when processing maliciously crafted front.

Apple Multiple Products Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2020-27932
Proveedor: Apple
Producto: Multiple Products
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, iPadOS, macOS, and watchOS contain a type confusion vulnerability that may allow a malicious application to execute code with kernel privileges.

Apple Multiple Products Memory Initialization Vulnerability

Sin confirmar

CVE: CVE-2020-27950
Proveedor: Apple
Producto: Multiple Products
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, iPadOS, macOS, and watchOS contain a memory initialization vulnerability that may allow a malicious application to disclose kernel memory.

D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2020-29557
Proveedor: D-Link
Producto: DIR-825 R1 Devices
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: D-Link DIR-825 R1 devices contain a buffer overflow vulnerability in the web interface that may allow for remote code execution.

Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability

Sin confirmar

CVE: CVE-2020-29583
Proveedor: Zyxel
Producto: Multiple Products
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account ("zyfwp") with an unchangeable password.

Cisco IOS XR Software Discovery Protocol Format String Vulnerability

Sin confirmar

CVE: CVE-2020-3118
Proveedor: Cisco
Producto: IOS XR
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Cisco IOS XR improperly validates string input from certain fields in Cisco Discovery Protocol messages. Exploitation could allow an unauthenticated, adjacent attacker to execute code with administrative privileges or cause a reload on an affected device.

Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability

Sin confirmar

CVE: CVE-2020-3161
Proveedor: Cisco
Producto: Cisco IP Phones
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Cisco IP Phones contain an improper input validation vulnerability for HTTP requests. Exploitation could allow an attacker to execute code remotely with root privileges or cause a denial-of-service (DoS) condition.

Cisco ASA and FTD Read-Only Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2020-3452
Proveedor: Cisco
Producto: Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an improper input validation vulnerability when HTTP requests process URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device.

Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability

Sin confirmar

CVE: CVE-2020-3566
Proveedor: Cisco
Producto: IOS XR
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Cisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly handles Internet Group Management Protocol (IGMP) packets. Exploitation could allow an unauthenticated, remote attacker to immediately crash the IGMP process or make it consume available memory and eventually crash.

Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability

Sin confirmar

CVE: CVE-2020-3569
Proveedor: Cisco
Producto: IOS XR
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Cisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly handles Internet Group Management Protocol (IGMP) packets. Exploitation could allow an unauthenticated, remote attacker to immediately crash the IGMP process or make it consume available memory and eventually crash.

Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability

Confirmado

CVE: CVE-2020-3580
Proveedor: Cisco
Producto: Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an insufficient input validation vulnerability for user-supplied input by the web services interface. Successful exploitation could allow an attacker to perform cross-site scripting (XSS) in the context of the interface or access sensitive browser-based information.

VMware Multiple Products Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2020-3950
Proveedor: VMware
Producto: Multiple Products
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: VMware Fusion, Remote Console (VMRC) for Mac, and Horizon Client for Mac contain a privilege escalation vulnerability due to improper use of setuid binaries that allows attackers to escalate privileges to root.

VMware vCenter Server Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2020-3952
Proveedor: VMware
Producto: vCenter Server
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: VMware vCenter Server contains an information disclosure vulnerability in the VMware Directory Service (vmdir) when the Platform Services Controller (PSC) does not correctly implement access controls. Successful exploitation allows an attacker with network access to port 389 to extract sensitive information.

VMware ESXi OpenSLP Use-After-Free Vulnerability

Confirmado

CVE: CVE-2020-3992
Proveedor: VMware
Producto: ESXi
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: VMware ESXi OpenSLP contains a use-after-free vulnerability that allows an attacker residing in the management network with access to port 427 to perform remote code execution.

Multiple VMware Products Command Injection Vulnerability

Sin confirmar

CVE: CVE-2020-4006
Proveedor: VMware
Producto: Multiple Products
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command injection vulnerability. An attacker with network access to the administrative configurator on port 8443 and a valid password for the configurator administrator account can execute commands with unrestricted privileges on the underlying operating system.

IBM Data Risk Manager Security Bypass Vulnerability

Sin confirmar

CVE: CVE-2020-4427
Proveedor: IBM
Producto: Data Risk Manager
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: IBM Data Risk Manager contains a security bypass vulnerability that could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to bypass the authentication process and gain full administrative access to the system.

IBM Data Risk Manager Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2020-4428
Proveedor: IBM
Producto: Data Risk Manager
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: IBM Data Risk Manager contains an unspecified vulnerability which could allow a remote, authenticated attacker to execute commands on the system.�

IBM Data Risk Manager Directory Traversal Vulnerability

Sin confirmar

CVE: CVE-2020-4430
Proveedor: IBM
Producto: Data Risk Manager
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: IBM Data Risk Manager contains a directory traversal vulnerability that could allow a remote authenticated attacker to traverse directories and send a specially crafted URL request to download arbitrary files from the system.

Amcrest Cameras and NVR Stack-based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2020-5735
Proveedor: Amcrest
Producto: Cameras and Network Video Recorder (NVR)
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Amcrest cameras and NVR contain a stack-based buffer overflow vulnerability through port 37777 that allows an unauthenticated, remote attacker to crash the device and possibly execute code.

Unraid Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2020-5847
Proveedor: Unraid
Producto: Unraid
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Unraid contains a vulnerability due to the insecure use of the extract PHP function that can be abused to execute remote code as root. This CVE is chainable with CVE-2020-5849 for initial access.

Unraid Authentication Bypass Vulnerability

Sin confirmar

CVE: CVE-2020-5849
Proveedor: Unraid
Producto: Unraid
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Unraid contains an authentication bypass vulnerability that allows attackers to gain access to the administrative interface. This CVE is chainable with CVE-2020-5847 for remote code execution.

F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2020-5902
Proveedor: F5
Producto: BIG-IP
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: F5 BIG-IP Traffic Management User Interface (TMUI) contains a remote code execution vulnerability in undisclosed pages.

SAP Solution Manager Missing Authentication for Critical Function Vulnerability

Sin confirmar

CVE: CVE-2020-6207
Proveedor: SAP
Producto: Solution Manager
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: SAP Solution Manager User Experience Monitoring contains a missing authentication for critical function vulnerability which results in complete compromise of all SMDAgents connected to the Solution Manager.

SAP NetWeaver Missing Authentication for Critical Function Vulnerability

Sin confirmar

CVE: CVE-2020-6287
Proveedor: SAP
Producto: NetWeaver
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users.

Google Chromium V8 Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2020-6418
Proveedor: Google
Producto: Chromium V8
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium V8 Engine contains a type confusion vulnerability allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Mozilla Firefox And Thunderbird Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2020-6819
Proveedor: Mozilla
Producto: Firefox and Thunderbird
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Mozilla Firefox and Thunderbird contain a race condition vulnerability when running the nsDocShell destructor under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts.

Mozilla Firefox And Thunderbird Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2020-6820
Proveedor: Mozilla
Producto: Firefox and Thunderbird
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Mozilla Firefox and Thunderbird contain a race condition vulnerability when handling a ReadableStream under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts.

Liferay Portal Deserialization of Untrusted Data Vulnerability

Sin confirmar

CVE: CVE-2020-7961
Proveedor: Liferay
Producto: Liferay Portal
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Liferay Portal contains a deserialization of untrusted data vulnerability that allows remote attackers to execute code via JSON web services.

Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability

Sin confirmar

CVE: CVE-2020-8193
Proveedor: Citrix
Producto: Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an authorization bypass vulnerability that may allow unauthenticated access to certain URL endpoints. The attacker must have access to the NetScaler IP (NSIP) in order to perform exploitation.

Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2020-8195
Proveedor: Citrix
Producto: Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.

Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2020-8196
Proveedor: Citrix
Producto: Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.

Ivanti Pulse Connect Secure Code Execution Vulnerability

Sin confirmar

CVE: CVE-2020-8243
Proveedor: Ivanti
Producto: Pulse Connect Secure
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Ivanti Pulse Connect Secure contains an unspecified vulnerability in the admin web interface that could allow an authenticated attacker to upload a custom template to perform code execution.

Ivanti Pulse Connect Secure Code Execution Vulnerability

Sin confirmar

CVE: CVE-2020-8260
Proveedor: Ivanti
Producto: Pulse Connect Secure
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Pulse Connect Secure contains an unspecified vulnerability that allows an authenticated attacker to perform code execution using uncontrolled gzip extraction.

Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2020-8467
Proveedor: Trend Micro
Producto: Apex One and OfficeScan
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Trend Micro Apex One and OfficeScan contain an unspecified vulnerability within a migration tool component that allows for remote code execution.

Trend Micro Multiple Products Content Validation Escape Vulnerability

Sin confirmar

CVE: CVE-2020-8468
Proveedor: Trend Micro
Producto: Apex One, OfficeScan and Worry-Free Business Security Agents
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Trend Micro Apex One, OfficeScan, and Worry-Free Business Security agents contain a content validation escape vulnerability that could allow an attacker to manipulate certain agent client components.

Multiple DrayTek Vigor Routers Web Management Page Vulnerability

Sin confirmar

CVE: CVE-2020-8515
Proveedor: DrayTek
Producto: Multiple Vigor Routers
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: DrayTek Vigor3900, Vigor2960, and Vigor300B routers contain an unspecified vulnerability that allows for remote code execution.

Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability

Sin confirmar

CVE: CVE-2020-8599
Proveedor: Trend Micro
Producto: Apex One and OfficeScan
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Trend Micro Apex One and OfficeScan server contain a vulnerable EXE file that could allow a remote attacker to write data to a path on affected installations and bypass root login.

PlaySMS Server-Side Template Injection Vulnerability

Sin confirmar

CVE: CVE-2020-8644
Proveedor: PlaySMS
Producto: PlaySMS
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: PlaySMS contains a server-side template injection vulnerability that allows for remote code execution.

EyesOfNetwork Improper Privilege Management Vulnerability

Sin confirmar

CVE: CVE-2020-8655
Proveedor: EyesOfNetwork
Producto: EyesOfNetwork
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: EyesOfNetwork contains an improper privilege management vulnerability that may allow a user to run commands as root via a crafted Nmap Scripting Engine (NSE) script to nmap7.

EyesOfNetwork Use of Hard-Coded Credentials Vulnerability

Sin confirmar

CVE: CVE-2020-8657
Proveedor: EyesOfNetwork
Producto: EyesOfNetwork
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: EyesOfNetwork contains a use of hard-coded credentials vulnerability, as it uses the same API key by default. Exploitation allows an attacker to calculate or guess the admin access token.

Apple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability

Sin confirmar

CVE: CVE-2020-9818
Proveedor: Apple
Producto: iOS, iPadOS, and watchOS
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, iPadOS, and watchOS Mail contains an out-of-bounds write vulnerability which may allow memory modification or application termination when processing a maliciously crafted mail message.

Apple iOS, iPadOS, and watchOS Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2020-9819
Proveedor: Apple
Producto: iOS, iPadOS, and watchOS
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, iPadOS, and watchOS Mail contains a memory corruption vulnerability that may allow heap corruption when processing a maliciously crafted mail message.

Apple Multiple Products Code Execution Vulnerability

Sin confirmar

CVE: CVE-2020-9859
Proveedor: Apple
Producto: Multiple Products
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, iPadOS, macOS, watchOS, and tvOS contain an unspecified vulnerability that may allow an application to execute code with kernel privileges.

Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability

Sin confirmar

CVE: CVE-2021-1497
Proveedor: Cisco
Producto: HyperFlex HX
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the root user.

Cisco HyperFlex HX Data Platform Command Injection Vulnerability

Sin confirmar

CVE: CVE-2021-1498
Proveedor: Cisco
Producto: HyperFlex HX
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the tomcat8 user.

Microsoft Defender Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2021-1647
Proveedor: Microsoft
Producto: Defender
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Defender contains an unspecified vulnerability that allows for remote code execution.

Microsoft Windows Print Spooler Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2021-1675
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution.

Microsoft Win32k Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2021-1732
Proveedor: Microsoft
Producto: Win32k
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.

Apple Multiple Products Race Condition Vulnerability

Sin confirmar

CVE: CVE-2021-1782
Proveedor: Apple
Producto: Multiple Products
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, iPadOs, macOS, watchOS, and tvOS contain a race condition vulnerability that may allow a malicious application to elevate privileges.

Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2021-1870
Proveedor: Apple
Producto: iOS, iPadOS, and macOS
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, iPadOS, and macOS WebKit contain an unspecified logic vulnerability that allows a remote attacker to execute code. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2021-1871
Proveedor: Apple
Producto: iOS, iPadOS, and macOS
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, iPadOS, and macOS WebKit contain an unspecified logic vulnerability that allows a remote attacker to execute code. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Apple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS) Vulnerability

Sin confirmar

CVE: CVE-2021-1879
Proveedor: Apple
Producto: iOS, iPadOS, and watchOS
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, iPadOS, and watchOS WebKit contain an unspecified vulnerability that allows for universal cross-site scripting (XSS) when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Qualcomm Multiple Chipsets Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2021-1905
Proveedor: Qualcomm
Producto: Multiple Chipsets
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Multiple Qualcomm Chipsets contain a use after free vulnerability due to improper handling of memory mapping of multiple processes simultaneously.

Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability

Sin confirmar

CVE: CVE-2021-1906
Proveedor: Qualcomm
Producto: Multiple Chipsets
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Multiple Qualcomm chipsets contain a detection of error condition without action vulnerability when improper handling of address deregistration on failure can lead to new GPU address allocation failure.

SonicWall SSLVPN SMA100 SQL Injection Vulnerability

Confirmado

CVE: CVE-2021-20016
Proveedor: SonicWall
Producto: SSLVPN SMA100
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker.

SonicWall Email Security Improper Privilege Management Vulnerability

Confirmado

CVE: CVE-2021-20021
Proveedor: SonicWall
Producto: SonicWall Email Security
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: SonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20022 and CVE-2021-20023 to achieve privilege escalation.

SonicWall Email Security Unrestricted Upload of File Vulnerability

Confirmado

CVE: CVE-2021-20022
Proveedor: SonicWall
Producto: SonicWall Email Security
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: SonicWall Email Security contains an unrestricted upload of file with dangerous type vulnerability that allows a post-authenticated attacker to upload a file to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20023 to achieve privilege escalation.

SonicWall Email Security Path Traversal Vulnerability

Confirmado

CVE: CVE-2021-20023
Proveedor: SonicWall
Producto: SonicWall Email Security
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20022 to achieve privilege escalation.

Arcadyan Buffalo Firmware Path Traversal Vulnerability

Sin confirmar

CVE: CVE-2021-20090
Proveedor: Arcadyan
Producto: Buffalo Firmware
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Arcadyan Buffalo firmware contains a path traversal vulnerability that could allow unauthenticated, remote attackers to bypass authentication and access sensitive information. This vulnerability affects multiple routers across several different vendors.

Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2021-21017
Proveedor: Adobe
Producto: Acrobat and Reader
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Acrobat Acrobat and Reader contain a heap-based buffer overflow vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.

Google Chromium V8 Heap Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2021-21148
Proveedor: Google
Producto: Chromium V8
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium V8 Engine contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Google Chromium Race Condition Vulnerability

Sin confirmar

CVE: CVE-2021-21166
Proveedor: Google
Producto: Chromium
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium contains a race condition vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Google Chromium Blink Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2021-21193
Proveedor: Google
Producto: Chromium Blink
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium Blink contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Google Chromium Blink Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2021-21206
Proveedor: Google
Producto: Chromium Blink
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium Blink contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Google Chromium V8 Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2021-21220
Proveedor: Google
Producto: Chromium V8
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium V8 Engine contains an improper input validation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Google Chromium V8 Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2021-21224
Proveedor: Google
Producto: Chromium V8
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

VMware vCenter Server Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2021-21972
Proveedor: VMware
Producto: vCenter Server
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: VMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system.

VMware vCenter Server Improper Input Validation Vulnerability

Confirmado

CVE: CVE-2021-21985
Proveedor: VMware
Producto: vCenter Server
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution.

VMware vCenter Server File Upload Vulnerability

Confirmado

CVE: CVE-2021-22005
Proveedor: VMware
Producto: vCenter Server
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code.

GitLab Community and Enterprise Editions Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2021-22205
Proveedor: GitLab
Producto: Community and Enterprise Editions
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.

Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2021-22502
Proveedor: Micro Focus
Producto: Operation Bridge Reporter (OBR)
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Micro Focus Operation Bridge Report (OBR) contains an unspecified vulnerability that allows for remote code execution.

Micro Focus Access Manager Information Leakage Vulnerability

Sin confirmar

CVE: CVE-2021-22506
Proveedor: Micro Focus
Producto: Micro Focus Access Manager
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Micro Focus Access Manager contains an information leakage vulnerability resulting from a SAML service provider redirection issue when the Assertion Consumer Service URL is used.

Ivanti Pulse Connect Secure Use-After-Free Vulnerability

Confirmado

CVE: CVE-2021-22893
Proveedor: Ivanti
Producto: Pulse Connect Secure
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Ivanti Pulse Connect Secure contains a use-after-free vulnerability that allow a remote, unauthenticated attacker to execute code via license services.

Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2021-22894
Proveedor: Ivanti
Producto: Pulse Connect Secure
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Ivanti Pulse Connect Secure Collaboration Suite contains a buffer overflow vulnerabilities that allows a remote authenticated users to execute code as the root user via maliciously crafted meeting room.

Ivanti Pulse Connect Secure Command Injection Vulnerability

Sin confirmar

CVE: CVE-2021-22899
Proveedor: Ivanti
Producto: Pulse Connect Secure
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Ivanti Pulse Connect Secure contains a command injection vulnerability that allows remote authenticated users to perform remote code execution via Windows File Resource Profiles.

Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability

Sin confirmar

CVE: CVE-2021-22900
Proveedor: Ivanti
Producto: Pulse Connect Secure
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Ivanti Pulse Connect Secure contains an unrestricted file upload vulnerability that allows an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.

F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2021-22986
Proveedor: F5
Producto: BIG-IP and BIG-IQ Centralized Management
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability in the iControl REST interface that allows unauthenticated attackers with network access to execute system commands, create or delete files, and disable services.

McAfee Total Protection (MTP) Improper Privilege Management Vulnerability

Sin confirmar

CVE: CVE-2021-23874
Proveedor: McAfee
Producto: McAfee Total Protection (MTP)
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: McAfee Total Protection (MTP) contains an improper privilege management vulnerability that allows a local user to gain elevated privileges and execute code, bypassing MTP self-defense.

Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability

Confirmado

CVE: CVE-2021-26084
Proveedor: Atlassian
Producto: Confluence Server and Data Center
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code.

Microsoft Internet Explorer Memory Corruption Vulnerability

Confirmado

CVE: CVE-2021-26411
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Internet Explorer contains an unspecified vulnerability that allows for memory corruption.

Microsoft Exchange Server Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2021-26855
Proveedor: Microsoft
Producto: Exchange Server
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.

Microsoft Exchange Server Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2021-26857
Proveedor: Microsoft
Producto: Exchange Server
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.

Microsoft Exchange Server Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2021-26858
Proveedor: Microsoft
Producto: Exchange Server
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.

Microsoft Office Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2021-27059
Proveedor: Microsoft
Producto: Office
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Office contains an unspecified vulnerability that allows for remote code execution.

Microsoft Exchange Server Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2021-27065
Proveedor: Microsoft
Producto: Exchange Server
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.

Microsoft Internet Explorer Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2021-27085
Proveedor: Microsoft
Producto: Internet Explorer
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Internet Explorer contains an unspecified vulnerability that allows for remote code execution.

Accellion FTA SQL Injection Vulnerability

Confirmado

CVE: CVE-2021-27101
Proveedor: Accellion
Producto: FTA
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Accellion FTA contains a SQL injection vulnerability exploited via a crafted host header in a request to document_root.html.

Accellion FTA OS Command Injection Vulnerability

Confirmado

CVE: CVE-2021-27102
Proveedor: Accellion
Producto: FTA
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Accellion FTA contains an OS command injection vulnerability exploited via a local web service call.

Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability

Confirmado

CVE: CVE-2021-27103
Proveedor: Accellion
Producto: FTA
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Accellion FTA contains a server-side request forgery (SSRF) vulnerability exploited via a crafted POST request to wmProgressstat.html.

Accellion FTA OS Command Injection Vulnerability

Confirmado

CVE: CVE-2021-27104
Proveedor: Accellion
Producto: FTA
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Accellion FTA contains an OS command injection vulnerability exploited via a crafted POST request to various admin endpoints.

Yealink Device Management Server-Side Request Forgery (SSRF) Vulnerability

Sin confirmar

CVE: CVE-2021-27561
Proveedor: Yealink
Producto: Device Management
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Yealink Device Management contains a server-side request forgery (SSRF) vulnerability that allows for unauthenticated remote code execution.

Arm Trusted Firmware Out-of-Bounds Write Vulnerability

Sin confirmar

CVE: CVE-2021-27562
Proveedor: Arm
Producto: Trusted Firmware
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Arm Trusted Firmware contains an out-of-bounds write vulnerability allowing the non-secure (NS) world to trigger a system halt, overwrite secure data, or print out secure data when calling secure functions under the non-secure processing environment (NSPE) handler mode. This vulnerability affects Yealink Device Management servers.

Microsoft Win32k Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2021-28310
Proveedor: Microsoft
Producto: Win32k
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Win32k contains an unspecified vulnerability that allows for privilege escalation.

Adobe Acrobat and Reader Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2021-28550
Proveedor: Adobe
Producto: Acrobat and Reader
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Adobe Acrobat and Reader contains a use-after-free vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.

Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2021-28663
Proveedor: Arm
Producto: Mali Graphics Processing Unit (GPU)
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Arm Mali Graphics Processing Unit (GPU) kernel driver contains a use-after-free vulnerability that may allow a non-privileged user to make improper operations on GPU memory to gain root privilege, and/or disclose information.

Arm Mali Graphics Processing Unit (GPU) Unspecified Vulnerability

Sin confirmar

CVE: CVE-2021-28664
Proveedor: Arm
Producto: Mali Graphics Processing Unit (GPU)
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Arm Mali Graphics Processing Unit (GPU) kernel driver contains an unspecified vulnerability that may allow a non-privileged user to gain write access to read-only memory, gain root privilege, corrupt memory, and modify the memory of other processes.

Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability

Confirmado

CVE: CVE-2021-30116
Proveedor: Kaseya
Producto: Virtual System/Server Administrator (VSA)
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Kaseya Virtual System/Server Administrator (VSA) contains an information disclosure vulnerability allowing an attacker to obtain the sessionId that can be used to execute further attacks against the system.

Google Chromium V8 Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2021-30551
Proveedor: Google
Producto: Chromium V8
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Google Chromium WebGL Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2021-30554
Proveedor: Google
Producto: Chromium WebGL
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium WebGL contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Google Chromium V8 Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2021-30563
Proveedor: Google
Producto: Chromium V8
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Google Chromium V8 Out-of-Bounds Write Vulnerability

Sin confirmar

CVE: CVE-2021-30632
Proveedor: Google
Producto: Chromium V8
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium V8 Engine contains an out-of-bounds write vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Google Chromium Indexed DB API Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2021-30633
Proveedor: Google
Producto: Chromium Indexed DB API
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium Indexed DB API contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Apple macOS Unspecified Vulnerability

Sin confirmar

CVE: CVE-2021-30657
Proveedor: Apple
Producto: macOS
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple macOS contains an unspecified logic issue in System Preferences that may allow a malicious application to bypass Gatekeeper checks.

Apple Multiple Products WebKit Storage Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2021-30661
Proveedor: Apple
Producto: Multiple Products
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit Storage contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Apple Multiple Products WebKit Integer Overflow Vulnerability

Sin confirmar

CVE: CVE-2021-30663
Proveedor: Apple
Producto: Multiple Products
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain an integer overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Apple Multiple Products WebKit Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2021-30665
Proveedor: Apple
Producto: Multiple Products
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, iPadOS, macOS, watchOS, and tvOS WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Apple iOS WebKit Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2021-30666
Proveedor: Apple
Producto: iOS
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS WebKit contains a buffer-overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Apple macOS Unspecified Vulnerability

Sin confirmar

CVE: CVE-2021-30713
Proveedor: Apple
Producto: macOS
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple macOS Transparency, Consent, and Control (TCC) contains an unspecified permissions issue which may allow a malicious application to bypass privacy preferences.

Apple iOS WebKit Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2021-30761
Proveedor: Apple
Producto: iOS
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS WebKit contains a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Apple iOS WebKit Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2021-30762
Proveedor: Apple
Producto: iOS
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS WebKit contains a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Apple Multiple Products Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2021-30807
Proveedor: Apple
Producto: Multiple Products
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, iPadOS, macOS, and watchOS IOMobileFrameBuffer contain a memory corruption vulnerability which may allow an application to execute code with kernel privileges.

Apple iOS, iPadOS, macOS Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2021-30858
Proveedor: Apple
Producto: iOS, iPadOS, and macOS
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Apple Multiple Products Integer Overflow Vulnerability

Sin confirmar

CVE: CVE-2021-30860
Proveedor: Apple
Producto: Multiple Products
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, iPadOS, macOS, and watchOS CoreGraphics contain an integer overflow vulnerability which may allow code execution when processing a maliciously crafted PDF. The vulnerability is also known under the moniker of FORCEDENTRY.

Apple iOS, iPadOS, and macOS Type Confusion Vulnerability

Sin confirmar

CVE: CVE-2021-30869
Proveedor: Apple
Producto: iOS, iPadOS, and macOS
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apple iOS, iPadOS, and macOS contain a type confusion vulnerability in the XNU which may allow a malicious application to execute code with kernel privileges.

Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2021-31199
Proveedor: Microsoft
Producto: Enhanced Cryptographic Provider
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation.

Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2021-31201
Proveedor: Microsoft
Producto: Enhanced Cryptographic Provider
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation.

Microsoft Exchange Server Security Feature Bypass Vulnerability

Confirmado

CVE: CVE-2021-31207
Proveedor: Microsoft
Producto: Exchange Server
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Exchange Server contains an unspecified vulnerability that allows for security feature bypass.

Tenda AC11 Router Stack Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2021-31755
Proveedor: Tenda
Producto: AC11 Router
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Tenda AC11 devices contain a stack buffer overflow vulnerability in /goform/setmac which allows attackers to execute code via a crafted post request.

Microsoft Windows Kernel Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2021-31955
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Kernel contains an unspecified vulnerability that allows for information disclosure. Successful exploitation allows attackers to read the contents of kernel memory from a user-mode process.

Microsoft Windows NTFS Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2021-31956
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows New Technology File System (NTFS) contains an unspecified vulnerability that allows attackers to escalate privileges via a specially crafted application.

Microsoft Windows Kernel Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2021-31979
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.

Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2021-33739
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.

Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability

Sin confirmar

CVE: CVE-2021-33742
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for remote code execution.

Microsoft Windows Kernel Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2021-33771
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.

Microsoft Windows Scripting Engine Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2021-34448
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Scripting Engine contains an unspecified vulnerability that allows for memory corruption.

Microsoft Exchange Server Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2021-34473
Proveedor: Microsoft
Producto: Exchange Server
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution.

Microsoft Exchange Server Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2021-34523
Proveedor: Microsoft
Producto: Exchange Server
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.

Microsoft Windows Print Spooler Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2021-34527
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/11/2021
Objetivo: 03/05/2022
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Print Spooler contains an unspecified vulnerability due to the Windows Print Spooler service improperly performing privileged file operations. Successful exploitation allows an attacker to perform remote code execution with SYSTEM privileges. The vulnerability is also known under the moniker of PrintNightmare.

SolarWinds Serv-U Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2021-35211
Proveedor: SolarWinds
Producto: Serv-U
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: SolarWinds Serv-U contains an unspecified memory escape vulnerability which can allow for remote code execution.

Realtek AP-Router SDK Buffer Overflow Vulnerability

Sin confirmar

CVE: CVE-2021-35395
Proveedor: Realtek
Producto: AP-Router SDK
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Realtek AP-Router SDK HTTP web server boa contains a buffer overflow vulnerability due to unsafe copies of some overly long parameters submitted in the form that lead to denial-of-service (DoS).

ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2021-35464
Proveedor: ForgeRock
Producto: Access Management (AM)
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: ForgeRock Access Management (AM) Core Server allows an attacker who sends a specially crafted HTTP request to one of three endpoints (/ccversion/Version, /ccversion/Masthead, or /ccversion/ButtonFrame) to execute code in the context of the current user (unless ForgeRock AM is running as root user, which the vendor does not recommend).

Trend Micro Multiple Products Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2021-36741
Proveedor: Trend Micro
Producto: Apex One, Apex One as a Service, and Worry-Free Business Security
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows a remote attacker to upload files.

Trend Micro Multiple Products Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2021-36742
Proveedor: Trend Micro
Producto: Apex One, Apex One as a Service, and Worry-Free Business Security
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows for privilege escalation.

Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability

Confirmado

CVE: CVE-2021-36942
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM.

Microsoft Windows Update Medic Service Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2021-36948
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Update Medic Service contains an unspecified vulnerability that allows for privilege escalation.

Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability

Confirmado

CVE: CVE-2021-36955
Proveedor: Microsoft
Producto: Windows
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.

Google Chromium Portals Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2021-37973
Proveedor: Google
Producto: Chromium Portals
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium Portals contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects web browsers that utilize Chromium, including Google Chrome and Microsoft Edge.

Google Chromium V8 Use-After-Free Vulnerability

Sin confirmar

CVE: CVE-2021-37975
Proveedor: Google
Producto: Chromium V8
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Google Chromium Information Disclosure Vulnerability

Sin confirmar

CVE: CVE-2021-37976
Proveedor: Google
Producto: Chromium
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium contains an information disclosure vulnerability within the core memory component that allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Google Chromium Intents Improper Input Validation Vulnerability

Sin confirmar

CVE: CVE-2021-38000
Proveedor: Google
Producto: Chromium Intents
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium Intents contains an improper input validation vulnerability that allows a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Google Chromium V8 Memory Corruption Vulnerability

Sin confirmar

CVE: CVE-2021-38003
Proveedor: Google
Producto: Chromium V8
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Google Chromium V8 Engine has a bug in JSON.stringify, where the internal TheHole value can leak to script code, causing memory corruption. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2021-38645
Proveedor: Microsoft
Producto: Open Management Infrastructure (OMI)
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability that allows for privilege escalation.

Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2021-38647
Proveedor: Microsoft
Producto: Open Management Infrastructure (OMI)
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing remote code execution.

Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2021-38648
Proveedor: Microsoft
Producto: Open Management Infrastructure (OMI)
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.

Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability

Sin confirmar

CVE: CVE-2021-38649
Proveedor: Microsoft
Producto: Open Management Infrastructure (OMI)
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.

Microsoft MSHTML Remote Code Execution Vulnerability

Confirmado

CVE: CVE-2021-40444
Proveedor: Microsoft
Producto: MSHTML
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Microsoft MSHTML contains a unspecified vulnerability that allows for remote code execution.

Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability

Confirmado

CVE: CVE-2021-40539
Proveedor: Zoho
Producto: ManageEngine
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution.

Apache HTTP Server Path Traversal Vulnerability

Confirmado

CVE: CVE-2021-41773
Proveedor: Apache
Producto: HTTP Server
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default �require all denied� or if CGI scripts are enabled. The original patch issued under this CVE ID is insufficient, please review remediation information under CVE-2021-42013.

Apache HTTP Server Path Traversal Vulnerability

Confirmado

CVE: CVE-2021-42013
Proveedor: Apache
Producto: HTTP Server
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts are enabled. This CVE ID resolves an incomplete patch for CVE-2021-41773.

BQE BillQuick Web Suite SQL Injection Vulnerability

Confirmado

CVE: CVE-2021-42258
Proveedor: BQE
Producto: BillQuick Web Suite
Incorporada: 03/11/2021
Objetivo: 17/11/2021
CVSS: SIN DATO Sin dato
PoC GitHub: Sin dato
Acción requerida: Apply updates per vendor instructions.
Descripción CISA: BQE BillQuick Web Suite contains an SQL injection vulnerability when accessing the username parameter that may allow for unauthenticated, remote code execution.

Catálogo operativo de hallazgos KEV con CVE, proveedor/producto, acción requerida, fecha objetivo, estado de ransomware e inteligencia CVSS/PoC.
Hallazgo	CVE		Acción requerida		Estatus
Progress LoadMaster Command Injection Vulnerability	CVE-2026-8037	Progress LoadMaster	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	10/08/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
JetBrains TeamCity Deserialization of Untrusted Data Vulnerability	CVE-2026-63077	JetBrains TeamCity	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	08/08/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability	CVE-2026-18556	N-able N-central	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	07/08/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache Tomcat Missing Encryption of Sensitive Data Vulnerability	CVE-2026-34486	Apache Tomcat	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	07/08/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
IBM Langflow Code Injection Vulnerability	CVE-2026-9198	IBM Langflow	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	07/08/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability	CVE-2026-18577	N-able N-central	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	06/08/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability	CVE-2026-20316	Cisco Secure Firewall Management Center (FMC)	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	01/08/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability	CVE-2025-68686	Fortinet FortiOS	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	10/08/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability	CVE-2026-16812	Arista VeloCloud Orchestrator	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	30/07/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Check Point SmartConsole Improper Authentication Vulnerability	CVE-2026-16232	Check Point SmartConsole	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	25/07/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability	CVE-2026-50522	Microsoft SharePoint	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	25/07/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
DD-WRT Stack-Based Buffer Overflow Vulnerability	CVE-2021-27137	DD-WRT DD-WRT	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	24/07/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability	CVE-2026-0770	Langflow Langflow	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	24/07/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
WordPress Core SQL Injection Vulnerability	CVE-2026-60137	WordPress Core	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	04/08/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
WordPress Core Interpretation Conflict Vulnerability	CVE-2026-63030	WordPress Core	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	24/07/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortinet FortiSandbox OS Command Injection Vulnerability	CVE-2026-25089	Fortinet FortiSandbox	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	19/07/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortinet FortiSandbox OS Command Injection Vulnerability	CVE-2026-39808	Fortinet FortiSandbox	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	19/07/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability	CVE-2026-58644	Microsoft SharePoint	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	19/07/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability	CVE-2023-4346	KNX Association KNX Protocol Connection Authorization Option 1	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	29/07/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle E-Business Suite Improper Privilege Management Vulnerability	CVE-2026-46817	Oracle E-Business Suite	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	18/07/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability	CVE-2026-15409	SonicWall SMA1000 Appliances	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	17/07/2026	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SonicWall SMA1000 Appliances Code Injection Vulnerability	CVE-2026-15410	SonicWall SMA1000 Appliances	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	17/07/2026	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability	CVE-2026-56155	Microsoft Active Directory Federation Services	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	28/07/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability	CVE-2026-56164	Microsoft SharePoint Server	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	17/07/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS Cross-Site Request Forgery Vulnerability	CVE-2008-4128	Cisco IOS	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	16/07/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability	CVE-2026-48939	iCagenda iCagenda	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	13/07/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability	CVE-2026-56291	Balbooa Forms	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	13/07/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe ColdFusion Path Traversal Vulnerability	CVE-2026-48282	Adobe ColdFusion	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	10/07/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability	CVE-2026-48908	JoomShaper SP Page Builder	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	10/07/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Langflow Authorization Bypass Through User-Controlled Key Vulnerability	CVE-2026-55255	Langflow Langflow	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	10/07/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Joomlack Page Builder Improper Access Control Vulnerability	CVE-2026-56290	Joomlack Page Builder	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	10/07/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability	CVE-2026-45659	Microsoft SharePoint Server	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	04/07/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SimpleHelp Authentication Bypass Vulnerability	CVE-2026-48558	SimpleHelp SimpleHelp	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	02/07/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
PTC Windchill and FlexPLM Improper Input Validation Vulnerability	CVE-2026-12569	PTC Windchill and FlexPLM	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	28/06/2026	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability	CVE-2026-20230	Cisco Unified Communications Manager	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	28/06/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Lantronix EDS5000 Code Injection Vulnerability	CVE-2025-67038	Lantronix EDS5000	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	26/06/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ubiquiti UniFi OS Improper Access Control Vulnerability	CVE-2026-34908	Ubiquiti UniFi OS	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	26/06/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ubiquiti UniFi OS Path Traversal Vulnerability	CVE-2026-34909	Ubiquiti UniFi OS	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	26/06/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ubiquiti UniFi OS Improper Input Validation Vulnerability	CVE-2026-34910	Ubiquiti UniFi OS	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	26/06/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Splunk Enterprise Missing Authentication for Critical Function Vulnerability	CVE-2026-20253	Splunk Enterprise	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	21/06/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Widget Factory Joomla Content Editor Improper Access Control Vulnerability	CVE-2026-48907	Widget Factory Joomla Content Editor	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	19/06/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability	CVE-2026-20262	Cisco Catalyst SD-WAN Manager	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	29/06/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability	CVE-2026-54420	LiteSpeed cPanel Plugin	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	18/06/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability	CVE-2026-35273	Oracle PeopleSoft Enterprise PeopleTools	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	15/06/2026	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Sentry OS Command Injection Vulnerability	CVE-2026-10520	Ivanti Sentry	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.	14/06/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability	CVE-2026-11645	Google Chromium V8	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	23/06/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability	CVE-2026-20245	Cisco Catalyst SD-WAN Manager	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	23/06/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability	CVE-2026-7473	Arista Extensible Operating System	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	23/06/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
BerriAI LiteLLM Command Injection Vulnerability	CVE-2026-42271	BerriAI LiteLLM	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	22/06/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Check Point Security Gateway Improper Authentication Vulnerability	CVE-2026-50751	Check Point Security Gateway	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	11/06/2026	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability	CVE-2026-28318	SolarWinds Serv-U	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	19/06/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability	CVE-2026-45247	Mirasvit Mirasvit Full Page Cache Warmer	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	06/06/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Linux Kernel Improper Authentication Vulnerability	CVE-2022-0492	Linux Kernel	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	05/06/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Android Framework Integer Overflow Vulnerability	CVE-2025-48595	Android Framework	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	05/06/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle WebLogic Server Unspecified Vulnerability	CVE-2024-21182	Oracle WebLogic Server	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	04/06/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability	CVE-2026-0257	Palo Alto Networks PAN-OS	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	01/06/2026	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
TanStack Unspecified Vulnerability	CVE-2026-45321	TanStack TanStack	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	10/06/2026	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Nx Console Embedded Malicious Code Vulnerability	CVE-2026-48027	Nx Nx Console	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	10/06/2026	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Daemon Tools Lite Embedded Malicious Code Vulnerability	CVE-2026-8398	Daemon Daemon Tools Lite	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	30/05/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
LiteSpeed cPanel Plugin Privilege Escalation Vulnerability	CVE-2026-48172	LiteSpeed cPanel Plugin	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	29/05/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Drupal Core SQL Injection Vulnerability	CVE-2026-9082	Drupal Core	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	27/05/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Langflow Origin Validation Error Vulnerability	CVE-2025-34291	Langflow Langflow	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	04/06/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability	CVE-2026-34926	Trend Micro Apex One	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	04/06/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Buffer Overflow Vulnerability	CVE-2008-4250	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/06/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft DirectX NULL Byte Overwrite Vulnerability	CVE-2009-1537	Microsoft DirectX	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/06/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability	CVE-2009-3459	Adobe Acrobat and Reader	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/06/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Use-After-Free Vulnerability	CVE-2010-0249	Microsoft Internet Explorer	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/06/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Use-After-Free Vulnerability	CVE-2010-0806	Microsoft Internet Explorer	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/06/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Defender Link Following Vulnerability	CVE-2026-41091	Microsoft Defender	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/06/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Defender Denial of Service Vulnerability	CVE-2026-45498	Microsoft Defender	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/06/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Exchange Server Cross-Site Scripting Vulnerability	CVE-2026-42897	Microsoft Microsoft	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	29/05/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability	CVE-2026-20182	Cisco Catalyst SD-WAN	Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlined in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.	17/05/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
BerriAI LiteLLM SQL Injection Vulnerability	CVE-2026-42208	BerriAI LiteLLM	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	11/05/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability	CVE-2026-6973	Ivanti Endpoint Manager Mobile (EPMM)	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	10/05/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability	CVE-2026-0300	Palo Alto Networks PAN-OS	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented: - Restrict User-ID Authentication Portal access to only trusted zones. - Disable User-ID Authentication Portal if not required. 5/13/2026: Palo Alto has released a variety of patches. If these are relevant to your environment, please apply the designated patch.	09/05/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability	CVE-2026-31431	Linux Kernel	"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	15/05/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability	CVE-2026-41940	WebPros cPanel & WHM and WP2 (WordPress Squared)	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/05/2026	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
ConnectWise ScreenConnect Path Traversal Vulnerability	CVE-2024-1708	ConnectWise ScreenConnect	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	12/05/2026	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Protection Mechanism Failure Vulnerability	CVE-2026-32202	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	12/05/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SimpleHelp Missing Authorization Vulnerability	CVE-2024-57726	SimpleHelp SimpleHelp	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	08/05/2026	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SimpleHelp Path Traversal Vulnerability	CVE-2024-57728	SimpleHelp SimpleHelp	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	08/05/2026	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Samsung MagicINFO 9 Server Path Traversal Vulnerability	CVE-2024-7399	Samsung MagicINFO 9 Server	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	08/05/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
D-Link DIR-823X Command Injection Vulnerability	CVE-2025-29635	D-Link DIR-823X	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	08/05/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Marimo Remote Code Execution Vulnerability	CVE-2026-39987	Marimo Marimo	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	07/05/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Defender Insufficient Granularity of Access Control Vulnerability	CVE-2026-33825	Microsoft Defender	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	06/05/2026	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
PaperCut NG/MF Improper Authentication Vulnerability	CVE-2023-27351	PaperCut NG/MF	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	04/05/2026	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
JetBrains TeamCity Relative Path Traversal Vulnerability	CVE-2024-27199	JetBrains TeamCity	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	04/05/2026	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Kentico Xperience Path Traversal Vulnerability	CVE-2025-2749	Kentico Kentico Xperience	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	04/05/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability	CVE-2025-32975	Quest KACE Systems Management Appliance (SMA)	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	04/05/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability	CVE-2025-48700	Synacor Zimbra Collaboration Suite (ZCS)	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	23/04/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability	CVE-2026-20122	Cisco Catalyst SD-WAN Manger	Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.	23/04/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability	CVE-2026-20128	Cisco Catalyst SD-WAN Manager	Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.	23/04/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability	CVE-2026-20133	Cisco Catalyst SD-WAN Manager	Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.	23/04/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache ActiveMQ Improper Input Validation Vulnerability	CVE-2026-34197	Apache ActiveMQ	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	30/04/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office Remote Code Execution	CVE-2009-0238	Microsoft Office	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	28/04/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft SharePoint Server Improper Input Validation Vulnerability	CVE-2026-32201	Microsoft SharePoint Server	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	28/04/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability	CVE-2012-1854	Microsoft Visual Basic for Applications (VBA)	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	27/04/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Acrobat Use-After-Free Vulnerability	CVE-2020-9715	Adobe Acrobat	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	27/04/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability	CVE-2023-21529	Microsoft Exchange Server	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	27/04/2026	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Out-of-Bounds Read Vulnerability	CVE-2023-36424	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	27/04/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Link Following Vulnerability	CVE-2025-60710	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	27/04/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortinet FortiClient EMS SQL Injection Vulnerability	CVE-2026-21643	Fortinet FortiClient EMS	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	16/04/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Acrobat and Reader Prototype Pollution Vulnerability	CVE-2026-34621	Adobe Acrobat and Reader	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	27/04/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability	CVE-2026-1340	Ivanti Endpoint Manager Mobile (EPMM)	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	11/04/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortinet FortiClient EMS Improper Access Control Vulnerability	CVE-2026-35616	Fortinet FortiClient EMS	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	09/04/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
TrueConf Client Download of Code Without Integrity Check Vulnerability	CVE-2026-3502	TrueConf Client	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	16/04/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Dawn Use-After-Free Vulnerability	CVE-2026-5281	Google Dawn	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	15/04/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Citrix NetScaler Out-of-Bounds Read Vulnerability	CVE-2026-3055	Citrix NetScaler	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	02/04/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
F5 BIG-IP Stack-Based Buffer Overflow Vulnerability	CVE-2025-53521	F5 BIG-IP	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	30/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Aquasecurity Trivy Embedded Malicious Code Vulnerability	CVE-2026-33634	Aquasecurity Trivy	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	09/04/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Langflow Code Injection Vulnerability	CVE-2026-33017	Langflow Langflow	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	08/04/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Buffer Overflow Vulnerability	CVE-2025-31277	Apple Multiple Products	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/04/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Craft CMS Code Injection Vulnerability	CVE-2025-32432	Craft CMS Craft CMS	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/04/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Improper Locking Vulnerability	CVE-2025-43510	Apple Multiple Products	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/04/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Classic Buffer Overflow Vulnerability	CVE-2025-43520	Apple Multiple Products	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/04/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Laravel Livewire Code Injection Vulnerability	CVE-2025-54068	Laravel Livewire	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/04/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability	CVE-2026-20131	Cisco Secure Firewall Management Center (FMC)	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	22/03/2026	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability	CVE-2025-66376	Synacor Zimbra Collaboration Suite (ZCS)	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	01/04/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability	CVE-2026-20963	Microsoft SharePoint	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	21/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Wing FTP Server Information Disclosure Vulnerability	CVE-2025-47813	Wing FTP Server Wing FTP Server	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	30/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Skia Out-of-Bounds Write Vulnerability	CVE-2026-3909	Google Skia	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	27/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability	CVE-2026-3910	Google Chromium V8	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	27/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
n8n Improper Control of Dynamically-Managed Code Resources Vulnerability	CVE-2025-68613	n8n n8n	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	25/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Omnissa Workspace ONE Server-Side Request Forgery	CVE-2021-22054	Omnissa Workspace One UEM	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	23/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability	CVE-2025-26399	SolarWinds Web Help Desk	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	12/03/2026	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability	CVE-2026-1603	Ivanti Endpoint Manager (EPM)	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	23/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Hikvision Multiple Products Improper Authentication Vulnerability	CVE-2017-7921	Hikvision Multiple Products	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	26/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Rockwell Multiple Products Insufficient Protected Credentials Vulnerability	CVE-2021-22681	Rockwell Multiple Products	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	26/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Integer Overflow or Wraparound Vulnerability	CVE-2021-30952	Apple Multiple Products	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	26/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS and iPadOS Use-After-Free Vulnerability	CVE-2023-41974	Apple iOS and iPadOS	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	26/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple products Use-After-Free Vulnerability	CVE-2023-43000	Apple Multiple Products	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	26/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Qualcomm Multiple Chipsets Memory Corruption Vulnerability	CVE-2026-21385	Qualcomm Multiple Chipsets	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	24/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Broadcom VMware Aria Operations Command Injection Vulnerability	CVE-2026-22719	Broadcom VMware Aria Operations	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	24/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco SD-WAN Path Traversal Vulnerability	CVE-2022-20775	Cisco SD-WAN	Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.	27/02/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability	CVE-2026-20127	Cisco Catalyst SD-WAN Controller and Manager	Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.	27/02/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Soliton Systems K.K FileZen OS Command Injection Vulnerability	CVE-2026-25108	Soliton Systems K.K FileZen	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	17/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
RoundCube Webmail Deserialization of Untrusted Data Vulnerability	CVE-2025-49113	Roundcube Webmail	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	13/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
RoundCube Webmail Cross-site Scripting Vulnerability	CVE-2025-68461	Roundcube Webmail	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	13/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
GitLab Server-Side Request Forgery (SSRF) Vulnerability	CVE-2021-22175	GitLab GitLab	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	11/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability	CVE-2026-22769	Dell RecoverPoint for Virtual Machines (RP4VMs)	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	21/02/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability	CVE-2008-0015	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	10/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability	CVE-2020-7796	Synacor Zimbra Collaboration Suite	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	10/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability	CVE-2024-7694	TeamT5 ThreatSonar Anti-Ransomware	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	10/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium CSS Use-After-Free Vulnerability	CVE-2026-2441	Google Chromium	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	10/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability	CVE-2026-1731	BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	16/02/2026	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Configuration Manager SQL Injection Vulnerability	CVE-2024-43468	Microsoft Configuration Manager	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	05/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Notepad++ Download of Code Without Integrity Check Vulnerability	CVE-2025-15556	Notepad++ Notepad++	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	05/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SolarWinds Web Help Desk Security Control Bypass Vulnerability	CVE-2025-40536	SolarWinds Web Help Desk	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	15/02/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Buffer Overflow Vulnerability	CVE-2026-20700	Apple Multiple Products	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	05/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Shell Protection Mechanism Failure Vulnerability	CVE-2026-21510	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability	CVE-2026-21513	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability	CVE-2026-21514	Microsoft Office	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Type Confusion Vulnerability	CVE-2026-21519	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows NULL Pointer Dereference Vulnerability	CVE-2026-21525	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Improper Privilege Management Vulnerability	CVE-2026-21533	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/03/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
React Native Community CLI OS Command Injection Vulnerability	CVE-2025-11953	React Native Community CLI	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	26/02/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability	CVE-2026-24423	SmarterTools SmarterMail	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	26/02/2026	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Sangoma FreePBX Improper Authentication Vulnerability	CVE-2019-19006	Sangoma FreePBX	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	24/02/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability	CVE-2021-39935	GitLab Community and Enterprise Editions	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	24/02/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability	CVE-2025-40551	SolarWinds Web Help Desk	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	06/02/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Sangoma FreePBX OS Command Injection Vulnerability	CVE-2025-64328	Sangoma FreePBX	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	24/02/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability	CVE-2026-1281	Ivanti Endpoint Manager Mobile (EPMM)	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	01/02/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability	CVE-2026-24858	Fortinet Multiple Products	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	30/01/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Linux Kernel Integer Overflow Vulnerability	CVE-2018-14634	Linux Kernel	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	16/02/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability	CVE-2025-52691	SmarterTools SmarterMail	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	16/02/2026	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office Security Feature Bypass Vulnerability	CVE-2026-21509	Microsoft Office	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	16/02/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability	CVE-2026-23760	SmarterTools SmarterMail	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	16/02/2026	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
GNU InetUtils Argument Injection Vulnerability	CVE-2026-24061	GNU InetUtils	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	16/02/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability	CVE-2024-37079	Broadcom VMware vCenter Server	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	13/02/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Vite Vitejs Improper Access Control Vulnerability	CVE-2025-31125	Vite Vitejs	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	12/02/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Versa Concerto Improper Authentication Vulnerability	CVE-2025-34026	Versa Concerto	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	12/02/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Prettier eslint-config-prettier Embedded Malicious Code Vulnerability	CVE-2025-54313	Prettier eslint-config-prettier	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	12/02/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability	CVE-2025-68645	Synacor Zimbra Collaboration Suite (ZCS)	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	12/02/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Unified Communications Products Code Injection Vulnerability	CVE-2026-20045	Cisco Unified Communications Manager	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	11/02/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Information Disclosure Vulnerability	CVE-2026-20805	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/02/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Gogs Path Traversal Vulnerability	CVE-2025-8110	Gogs Gogs	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	02/02/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office PowerPoint Code Injection Vulnerability	CVE-2009-0556	Microsoft Office	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	28/01/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability	CVE-2025-37164	Hewlett Packard Enterprise (HPE) OneView	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	28/01/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability	CVE-2025-14847	MongoDB MongoDB and MongoDB Server	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	19/01/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Digiever DS-2105 Pro Missing Authorization Vulnerability	CVE-2023-52163	Digiever DS-2105 Pro	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	12/01/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
WatchGuard Firebox Out of Bounds Write Vulnerability	CVE-2025-14733	WatchGuard Firebox	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	26/12/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Multiple Products Improper Input Validation Vulnerability	CVE-2025-20393	Cisco Multiple Products	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	24/12/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SonicWall SMA1000 Missing Authorization Vulnerability	CVE-2025-40602	SonicWall SMA1000 appliance	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable	24/12/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
ASUS Live Update Embedded Malicious Code Vulnerability	CVE-2025-59374	ASUS Live Update	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	07/01/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability	CVE-2025-59718	Fortinet Multiple Products	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	23/12/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability	CVE-2025-14611	Gladinet CentreStack and Triofox	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	05/01/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Use-After-Free WebKit Vulnerability	CVE-2025-43529	Apple Multiple Products	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	05/01/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability	CVE-2018-4063	Sierra Wireless AirLink ALEOS	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	02/01/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium Out of Bounds Memory Access Vulnerability	CVE-2025-14174	Google Chromium	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	02/01/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability	CVE-2025-58360	OSGeo GeoServer	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	01/01/2026	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
RARLAB WinRAR Path Traversal Vulnerability	CVE-2025-6218	RARLAB WinRAR	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	30/12/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Use After Free Vulnerability	CVE-2025-62221	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	30/12/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
D-Link Routers Buffer Overflow Vulnerability	CVE-2022-37055	D-Link Routers	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	29/12/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Array Networks ArrayOS AG OS Command Injection Vulnerability	CVE-2025-66644	Array Networks ArrayOS AG	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	29/12/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Meta React Server Components Remote Code Execution Vulnerability	CVE-2025-55182	Meta React Server Components	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	12/12/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability	CVE-2021-26828	OpenPLC ScadaBR	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	24/12/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Android Framework Privilege Escalation Vulnerability	CVE-2025-48572	Android Framework	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	23/12/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Android Framework Information Disclosure Vulnerability	CVE-2025-48633	Android Framework	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	23/12/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
OpenPLC ScadaBR Cross-site Scripting Vulnerability	CVE-2021-26829	OpenPLC ScadaBR	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	19/12/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability	CVE-2025-61757	Oracle Fusion Middleware	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	12/12/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Type Confusion Vulnerability	CVE-2025-13223	Google Chromium V8	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	10/12/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortinet FortiWeb OS Command Injection Vulnerability	CVE-2025-58034	Fortinet FortiWeb	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	25/11/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortinet FortiWeb Path Traversal Vulnerability	CVE-2025-64446	Fortinet FortiWeb	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	21/11/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Gladinet Triofox Improper Access Control Vulnerability	CVE-2025-12480	Gladinet Triofox	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/12/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Race Condition Vulnerability	CVE-2025-62215	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/12/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
WatchGuard Firebox Out-of-Bounds Write Vulnerability	CVE-2025-9242	WatchGuard Firebox	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/12/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Samsung Mobile Devices Out-of-Bounds Write Vulnerability	CVE-2025-21042	Samsung Mobile Devices	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	01/12/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability	CVE-2025-11371	Gladinet CentreStack and Triofox	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	25/11/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
CWP Control Web Panel OS Command Injection Vulnerability	CVE-2025-48703	CWP Control Web Panel	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	25/11/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
XWiki Platform Eval Injection Vulnerability	CVE-2025-24893	XWiki Platform	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	20/11/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability	CVE-2025-41244	Broadcom VMware Aria Operations and VMware Tools	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	20/11/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Dassault Systèmes DELMIA Apriso Code Injection Vulnerability	CVE-2025-6204	Dassault Systèmes DELMIA Apriso	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	18/11/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability	CVE-2025-6205	Dassault Systèmes DELMIA Apriso	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	18/11/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Commerce and Magento Improper Input Validation Vulnerability	CVE-2025-54236	Adobe Commerce and Magento	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	14/11/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability	CVE-2025-59287	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	14/11/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability	CVE-2025-61932	Motex LANSCOPE Endpoint Manager	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	12/11/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Unspecified Vulnerability	CVE-2022-48503	Apple Multiple Products	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	10/11/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability	CVE-2025-2746	Kentico Xperience CMS	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	10/11/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability	CVE-2025-2747	Kentico Xperience CMS	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	10/11/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows SMB Client Improper Access Control Vulnerability	CVE-2025-33073	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	10/11/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability	CVE-2025-61884	Oracle E-Business Suite	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	10/11/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Experience Manager Forms Code Execution Vulnerability	CVE-2025-54253	Adobe Experience Manager (AEM) Forms	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	05/11/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SKYSEA Client View Improper Authentication Vulnerability	CVE-2016-7836	SKYSEA Client View	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	04/11/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Untrusted Pointer Dereference Vulnerability	CVE-2025-24990	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	04/11/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
IGEL OS Use of a Key Past its Expiration Date Vulnerability	CVE-2025-47827	IGEL IGEL OS	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	04/11/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Improper Access Control Vulnerability	CVE-2025-59230	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	04/11/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Grafana Path Traversal Vulnerability	CVE-2021-43798	Grafana Labs Grafana	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	30/10/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability	CVE-2025-27915	Synacor Zimbra Collaboration Suite (ZCS)	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	28/10/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Mozilla Multiple Products Remote Code Execution Vulnerability	CVE-2010-3765	Mozilla Multiple Products	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	27/10/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability	CVE-2010-3962	Microsoft Internet Explorer	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	27/10/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Remote Code Execution Vulnerability	CVE-2011-3402	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	27/10/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Out-of-Bounds Write Vulnerability	CVE-2013-3918	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	27/10/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Linux Kernel Heap Out-of-Bounds Write Vulnerability	CVE-2021-22555	Linux Kernel	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	27/10/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Privilege Escalation Vulnerability	CVE-2021-43226	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	27/10/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle E-Business Suite Unspecified Vulnerability	CVE-2025-61882	Oracle E-Business Suite	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	27/10/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
GNU Bash OS Command Injection Vulnerability	CVE-2014-6278	GNU GNU Bash	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	23/10/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Juniper ScreenOS Improper Authentication Vulnerability	CVE-2015-7755	Juniper ScreenOS	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	23/10/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Jenkins Remote Code Execution Vulnerability	CVE-2017-1000353	Jenkins Jenkins	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	23/10/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Samsung Mobile Devices Out-of-Bounds Write Vulnerability	CVE-2025-21043	Samsung Mobile Devices	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	23/10/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Smartbedded Meteobridge Command Injection Vulnerability	CVE-2025-4008	Smartbedded Meteobridge	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	23/10/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adminer Server-Side Request Forgery Vulnerability	CVE-2021-21311	Adminer Adminer	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	20/10/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability	CVE-2025-10035	Fortra GoAnywhere MFT	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	20/10/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability	CVE-2025-20352	Cisco IOS and IOS XE	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	20/10/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability	CVE-2025-32463	Sudo Sudo	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	20/10/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Libraesva Email Security Gateway Command Injection Vulnerability	CVE-2025-59689	Libraesva Email Security Gateway	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	20/10/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability	CVE-2025-20333	Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense	The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.	26/09/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability	CVE-2025-20362	Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense	The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.	26/09/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Type Confusion Vulnerability	CVE-2025-10585	Google Chromium V8	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	14/10/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability	CVE-2025-5086	Dassault Systèmes DELMIA Apriso	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	02/10/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability	CVE-2025-38352	Linux Kernel	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	25/09/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Android Runtime Use-After-Free Vulnerability	CVE-2025-48543	Android Runtime	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	25/09/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability	CVE-2025-53690	Sitecore Multiple Products	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	25/09/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability	CVE-2023-50224	TP-Link TL-WR841N	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	24/09/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability	CVE-2025-9377	TP-Link Multiple Routers	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	24/09/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability	CVE-2020-24363	TP-Link TL-WA855RE	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	23/09/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Meta Platforms WhatsApp Incorrect Authorization Vulnerability	CVE-2025-55177	Meta Platforms WhatsApp	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	23/09/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Sangoma FreePBX Authentication Bypass Vulnerability	CVE-2025-57819	Sangoma FreePBX	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	19/09/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Citrix NetScaler Memory Overflow Vulnerability	CVE-2025-7775	Citrix NetScaler	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	28/08/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Citrix Session Recording Improper Privilege Management Vulnerability	CVE-2024-8068	Citrix Session Recording	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	15/09/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Citrix Session Recording Deserialization of Untrusted Data Vulnerability	CVE-2024-8069	Citrix Session Recording	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	15/09/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Git Link Following Vulnerability	CVE-2025-48384	Git Git	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	15/09/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability	CVE-2025-43300	Apple iOS, iPadOS, and macOS	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	11/09/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Trend Micro Apex One OS Command Injection Vulnerability	CVE-2025-54948	Trend Micro Apex One	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	08/09/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
N-able N-Central Insecure Deserialization Vulnerability	CVE-2025-8875	N-able N-Central	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	20/08/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
N-able N-Central Command Injection Vulnerability	CVE-2025-8876	N-able N-Central	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	20/08/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office Excel Remote Code Execution Vulnerability	CVE-2007-0671	Microsoft Office	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	02/09/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Resource Management Errors Vulnerability	CVE-2013-3893	Microsoft Internet Explorer	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	02/09/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
RARLAB WinRAR Path Traversal Vulnerability	CVE-2025-8088	RARLAB WinRAR	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	02/09/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability	CVE-2020-25078	D-Link DCS-2530L and DCS-2670L Devices	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	26/08/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability	CVE-2020-25079	D-Link DCS-2530L and DCS-2670L Devices	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	26/08/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
D-Link DNR-322L Download of Code Without Integrity Check Vulnerability	CVE-2022-40799	D-Link DNR-322L	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	26/08/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability	CVE-2023-2533	PaperCut NG/MF	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	18/08/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Identity Services Engine Injection Vulnerability	CVE-2025-20281	Cisco Identity Services Engine	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	18/08/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Identity Services Engine Injection Vulnerability	CVE-2025-20337	Cisco Identity Services Engine	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	18/08/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability	CVE-2025-2775	SysAid SysAid On-Prem	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	12/08/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability	CVE-2025-2776	SysAid SysAid On-Prem	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	12/08/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft SharePoint Code Injection Vulnerability	CVE-2025-49704	Microsoft SharePoint	Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.	23/07/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft SharePoint Improper Authentication Vulnerability	CVE-2025-49706	Microsoft SharePoint	Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.	23/07/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
CrushFTP Unprotected Alternate Channel Vulnerability	CVE-2025-54309	CrushFTP CrushFTP	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	12/08/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium ANGLE and GPU Improper Input Validation Vulnerability	CVE-2025-6558	Google Chromium	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	12/08/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability	CVE-2025-53770	Microsoft SharePoint	Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.	21/07/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortinet FortiWeb SQL Injection Vulnerability	CVE-2025-25257	Fortinet FortiWeb	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	08/08/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability	CVE-2025-47812	Wing FTP Server Wing FTP Server	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	04/08/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability	CVE-2025-5777	Citrix NetScaler ADC and Gateway	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	11/07/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability	CVE-2014-3931	Looking Glass Multi-Router Looking Glass (MRLG)	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	28/07/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
PHPMailer Command Injection Vulnerability	CVE-2016-10033	PHP PHPMailer	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	28/07/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Rails Ruby on Rails Path Traversal Vulnerability	CVE-2019-5418	Rails Ruby on Rails	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	28/07/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability	CVE-2019-9621	Synacor Zimbra Collaboration Suite (ZCS)	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	28/07/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Type Confusion Vulnerability	CVE-2025-6554	Google Chromium V8	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	23/07/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability	CVE-2025-48927	TeleMessage TM SGNL	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	22/07/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability	CVE-2025-48928	TeleMessage TM SGNL	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	22/07/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability	CVE-2025-6543	Citrix NetScaler ADC and Gateway	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	21/07/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability	CVE-2019-6693	Fortinet FortiOS	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	16/07/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
D-Link DIR-859 Router Path Traversal Vulnerability	CVE-2024-0769	D-Link DIR-859 Router	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	16/07/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability	CVE-2024-54085	AMI MegaRAC SPx	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	16/07/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Linux Kernel Improper Ownership Management Vulnerability	CVE-2023-0386	Linux Kernel	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	08/07/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
TP-Link Multiple Routers Command Injection Vulnerability	CVE-2023-33538	TP-Link Multiple Routers	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	07/07/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Unspecified Vulnerability	CVE-2025-43200	Apple Multiple Products	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	07/07/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Wazuh Server Deserialization of Untrusted Data Vulnerability	CVE-2025-24016	Wazuh Wazuh Server	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	01/07/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows External Control of File Name or Path Vulnerability	CVE-2025-33053	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	01/07/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
RoundCube Webmail Cross-Site Scripting Vulnerability	CVE-2024-42009	Roundcube Webmail	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	30/06/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability	CVE-2025-32433	Erlang Erlang/OTP	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	30/06/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability	CVE-2025-5419	Google Chromium V8	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	26/06/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability	CVE-2025-21479	Qualcomm Multiple Chipsets	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	24/06/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability	CVE-2025-21480	Qualcomm Multiple Chipsets	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	24/06/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Qualcomm Multiple Chipsets Use-After-Free Vulnerability	CVE-2025-27038	Qualcomm Multiple Chipsets	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	24/06/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
ASUS Routers Improper Authentication Vulnerability	CVE-2021-32030	ASUS Routers	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	23/06/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
ASUS RT-AX55 Routers OS Command Injection Vulnerability	CVE-2023-39780	ASUS RT-AX55 Routers	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	23/06/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Craft CMS Code Injection Vulnerability	CVE-2024-56145	Craft CMS Craft CMS	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	23/06/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability	CVE-2025-35939	Craft CMS Craft CMS	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	23/06/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
ConnectWise ScreenConnect Improper Authentication Vulnerability	CVE-2025-3935	ConnectWise ScreenConnect	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	23/06/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Samsung MagicINFO 9 Server Path Traversal Vulnerability	CVE-2025-4632	Samsung MagicINFO 9 Server	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	12/06/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
ZKTeco BioTime Path Traversal Vulnerability	CVE-2023-38950	ZKTeco BioTime	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	09/06/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability	CVE-2024-11182	MDaemon Email Server	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	09/06/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability	CVE-2024-27443	Synacor Zimbra Collaboration Suite (ZCS)	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	09/06/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Srimax Output Messenger Directory Traversal Vulnerability	CVE-2025-27920	Srimax Output Messenger	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	09/06/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability	CVE-2025-4427	Ivanti Endpoint Manager Mobile (EPMM)	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	09/06/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability	CVE-2025-4428	Ivanti Endpoint Manager Mobile (EPMM)	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	09/06/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
DrayTek Vigor Routers OS Command Injection Vulnerability	CVE-2024-12987	DrayTek Vigor Routers	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	05/06/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SAP NetWeaver Deserialization Vulnerability	CVE-2025-42999	SAP NetWeaver	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	05/06/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability	CVE-2025-32756	Fortinet Multiple Products	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	04/06/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Scripting Engine Type Confusion Vulnerability	CVE-2025-30397	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/06/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows DWM Core Library Use-After-Free Vulnerability	CVE-2025-30400	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/06/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability	CVE-2025-32701	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/06/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability	CVE-2025-32706	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/06/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability	CVE-2025-32709	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/06/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
TeleMessage TM SGNL Hidden Functionality Vulnerability	CVE-2025-47729	TeleMessage TM SGNL	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	02/06/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
GeoVision Devices OS Command Injection Vulnerability	CVE-2024-11120	GeoVision Multiple Devices	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	28/05/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
GeoVision Devices OS Command Injection Vulnerability	CVE-2024-6047	GeoVision Multiple Devices	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	28/05/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
FreeType Out-of-Bounds Write Vulnerability	CVE-2025-27363	FreeType FreeType	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	27/05/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Langflow Missing Authentication Vulnerability	CVE-2025-3248	Langflow Langflow	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	26/05/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Yiiframework Yii Improper Protection of Alternate Path Vulnerability	CVE-2024-58136	Yiiframework Yii	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	23/05/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Commvault Command Center Path Traversal Vulnerability	CVE-2025-34028	Commvault Command Center	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	23/05/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SonicWall SMA100 Appliances OS Command Injection Vulnerability	CVE-2023-44221	SonicWall SMA100 Appliances	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	22/05/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache HTTP Server Improper Escaping of Output Vulnerability	CVE-2024-38475	Apache HTTP Server	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	22/05/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SAP NetWeaver Unrestricted File Upload Vulnerability	CVE-2025-31324	SAP NetWeaver	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	20/05/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Broadcom Brocade Fabric OS Code Injection Vulnerability	CVE-2025-1976	Broadcom Brocade Fabric OS	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	19/05/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Commvault Web Server Unspecified Vulnerability	CVE-2025-3928	Commvault Web Server	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	19/05/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability	CVE-2025-42599	Qualitia Active! Mail	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	19/05/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability	CVE-2025-24054	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	08/05/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Memory Corruption Vulnerability	CVE-2025-31200	Apple Multiple Products	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	08/05/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Arbitrary Read and Write Vulnerability	CVE-2025-31201	Apple Multiple Products	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	08/05/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SonicWall SMA100 Appliances OS Command Injection Vulnerability	CVE-2021-20035	SonicWall SMA100 Appliances	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	07/05/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Linux Kernel Out-of-Bounds Read Vulnerability	CVE-2024-53150	Linux Kernel	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	30/04/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Linux Kernel Out-of-Bounds Access Vulnerability	CVE-2024-53197	Linux Kernel	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	30/04/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability	CVE-2025-29824	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	29/04/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability	CVE-2025-30406	Gladinet CentreStack	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	29/04/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
CrushFTP Authentication Bypass Vulnerability	CVE-2025-31161	CrushFTP CrushFTP	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	28/04/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability	CVE-2025-22457	Ivanti Connect Secure, Policy Secure, and ZTA Gateways	Apply mitigations as set forth in the CISA instructions linked below.	11/04/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache Tomcat Path Equivalence Vulnerability	CVE-2025-24813	Apache Tomcat	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	22/04/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Smart Licensing Utility Static Credential Vulnerability	CVE-2024-20439	Cisco Smart Licensing Utility	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	21/04/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium Mojo Sandbox Escape Vulnerability	CVE-2025-2783	Google Chromium Mojo	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	17/04/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability	CVE-2019-9874	Sitecore CMS and Experience Platform (XP)	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	16/04/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability	CVE-2019-9875	Sitecore CMS and Experience Platform (XP)	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	16/04/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability	CVE-2025-30154	reviewdog action-setup GitHub Action	Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	14/04/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SAP NetWeaver Directory Traversal Vulnerability	CVE-2017-12637	SAP NetWeaver	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	09/04/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
NAKIVO Backup and Replication Absolute Path Traversal Vulnerability	CVE-2024-48248	NAKIVO Backup and Replication	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	09/04/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Edimax IC-7100 IP Camera OS Command Injection Vulnerability	CVE-2025-1316	Edimax IC-7100 IP Camera	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	09/04/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability	CVE-2025-24472	Fortinet FortiOS and FortiProxy	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	08/04/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability	CVE-2025-30066	tj-actions changed-files GitHub Action	Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	08/04/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability	CVE-2025-21590	Juniper Junos OS	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/04/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability	CVE-2025-24201	Apple Multiple Products	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	03/04/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Win32k Use-After-Free Vulnerability	CVE-2025-24983	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	01/04/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows NTFS Information Disclosure Vulnerability	CVE-2025-24984	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	01/04/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability	CVE-2025-24985	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	01/04/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability	CVE-2025-24991	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	01/04/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability	CVE-2025-24993	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	01/04/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability	CVE-2025-26633	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	01/04/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability	CVE-2024-13159	Ivanti Endpoint Manager (EPM)	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	31/03/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability	CVE-2024-13160	Ivanti Endpoint Manager (EPM)	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	31/03/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability	CVE-2024-13161	Ivanti Endpoint Manager (EPM)	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	31/03/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Advantive VeraCore Unrestricted File Upload Vulnerability	CVE-2024-57968	Advantive VeraCore	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	31/03/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Advantive VeraCore SQL Injection Vulnerability	CVE-2025-25181	Advantive VeraCore	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	31/03/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Linux Kernel Use of Uninitialized Resource Vulnerability	CVE-2024-50302	Linux Kernel	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	25/03/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
VMware ESXi and Workstation TOCTOU Race Condition Vulnerability	CVE-2025-22224	VMware ESXi and Workstation	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	25/03/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
VMware ESXi Arbitrary Write Vulnerability	CVE-2025-22225	VMware ESXi	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	25/03/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability	CVE-2025-22226	VMware ESXi, Workstation, and Fusion	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	25/03/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability	CVE-2018-8639	Microsoft Windows	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	24/03/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability	CVE-2022-43769	Hitachi Vantara Pentaho Business Analytics (BA) Server	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	24/03/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability	CVE-2022-43939	Hitachi Vantara Pentaho Business Analytics (BA) Server	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	24/03/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Small Business RV Series Routers Command Injection Vulnerability	CVE-2023-20118	Cisco Small Business RV Series Routers	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	24/03/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Progress WhatsUp Gold Path Traversal Vulnerability	CVE-2024-4885	Progress WhatsUp Gold	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	24/03/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability	CVE-2023-34192	Synacor Zimbra Collaboration Suite (ZCS)	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	18/03/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Partner Center Improper Access Control Vulnerability	CVE-2024-49035	Microsoft Partner Center	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	18/03/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe ColdFusion Deserialization Vulnerability	CVE-2017-3066	Adobe ColdFusion	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	17/03/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability	CVE-2024-20953	Oracle Agile Product Lifecycle Management (PLM)	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	17/03/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Power Pages Improper Access Control Vulnerability	CVE-2025-24989	Microsoft Power Pages	Apply mitigations per vendor instructions, follow BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	14/03/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Palo Alto Networks PAN-OS File Read Vulnerability	CVE-2025-0111	Palo Alto Networks PAN-OS	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	13/03/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Craft CMS Code Injection Vulnerability	CVE-2025-23209	Craft CMS Craft CMS	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	13/03/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SonicWall SonicOS SSLVPN Improper Authentication Vulnerability	CVE-2024-53704	SonicWall SonicOS	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	11/03/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability	CVE-2025-0108	Palo Alto Networks PAN-OS	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	11/03/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SimpleHelp Path Traversal Vulnerability	CVE-2024-57727	SimpleHelp SimpleHelp	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	06/03/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Mitel SIP Phones Argument Injection Vulnerability	CVE-2024-41710	Mitel SIP Phones	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	05/03/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS and iPadOS Incorrect Authorization Vulnerability	CVE-2025-24200	Apple iOS and iPadOS	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	05/03/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Zyxel DSL CPE OS Command Injection Vulnerability	CVE-2024-40890	Zyxel DSL CPE Devices	The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.	04/03/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Zyxel DSL CPE OS Command Injection Vulnerability	CVE-2024-40891	Zyxel DSL CPE Devices	The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.	04/03/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Storage Link Following Vulnerability	CVE-2025-21391	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	04/03/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability	CVE-2025-21418	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	04/03/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Trimble Cityworks Deserialization Vulnerability	CVE-2025-0994	Trimble Cityworks	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	28/02/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Sophos XG Firewall Buffer Overflow Vulnerability	CVE-2020-15069	Sophos XG Firewall	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	27/02/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
CyberoamOS (CROS) SQL Injection Vulnerability	CVE-2020-29574	Sophos CyberoamOS	The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.	27/02/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Dante Discovery Process Control Vulnerability	CVE-2022-23748	Audinate Dante Discovery	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	27/02/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Outlook Improper Input Validation Vulnerability	CVE-2024-21413	Microsoft Office Outlook	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	27/02/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
7-Zip Mark of the Web Bypass Vulnerability	CVE-2025-0411	7-Zip 7-Zip	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	27/02/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Linux Kernel Out-of-Bounds Write Vulnerability	CVE-2024-53104	Linux Kernel	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	26/02/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Paessler PRTG Network Monitor Local File Inclusion Vulnerability	CVE-2018-19410	Paessler PRTG Network Monitor	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	25/02/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Paessler PRTG Network Monitor OS Command Injection Vulnerability	CVE-2018-9276	Paessler PRTG Network Monitor	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	25/02/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft .NET Framework Information Disclosure Vulnerability	CVE-2024-29059	Microsoft .NET Framework	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	25/02/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache OFBiz Forced Browsing Vulnerability	CVE-2024-45195	Apache OFBiz	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	25/02/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Use-After-Free Vulnerability	CVE-2025-24085	Apple Multiple Products	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	19/02/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SonicWall SMA1000 Appliances Deserialization Vulnerability	CVE-2025-23006	SonicWall SMA1000 Appliances	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	14/02/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
JQuery Cross-Site Scripting (XSS) Vulnerability	CVE-2020-11023	JQuery JQuery	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	13/02/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Aviatrix Controllers OS Command Injection Vulnerability	CVE-2024-50603	Aviatrix Controllers	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	06/02/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability	CVE-2024-55591	Fortinet FortiOS and FortiProxy	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	21/01/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability	CVE-2025-21333	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	04/02/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability	CVE-2025-21334	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	04/02/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability	CVE-2025-21335	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	04/02/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Qlik Sense HTTP Tunneling Vulnerability	CVE-2023-48365	Qlik Sense	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	03/02/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability	CVE-2024-12686	BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS)	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	03/02/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability	CVE-2025-0282	Ivanti Connect Secure, Policy Secure, and ZTA Gateways	Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.	15/01/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle WebLogic Server Unspecified Vulnerability	CVE-2020-2883	Oracle WebLogic Server	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	28/01/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Mitel MiCollab Path Traversal Vulnerability	CVE-2024-41713	Mitel MiCollab	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	28/01/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Mitel MiCollab Path Traversal Vulnerability	CVE-2024-55550	Mitel MiCollab	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	28/01/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability	CVE-2024-3393	Palo Alto Networks PAN-OS	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	20/01/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability	CVE-2021-44207	Acclaim Systems USAHERDS	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Please contact the product developer for support and vulnerability mitigation.	13/01/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability	CVE-2024-12356	BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS)	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	27/12/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
NUUO NVRmini Devices OS Command Injection Vulnerability	CVE-2018-14933	NUUO NVRmini Devices	The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.	08/01/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Reolink Multiple IP Cameras OS Command Injection Vulnerability	CVE-2019-11001	Reolink Multiple IP Cameras	The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.	08/01/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Reolink RLC-410W IP Camera OS Command Injection Vulnerability	CVE-2021-40407	Reolink RLC-410W IP Camera	The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.	08/01/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
NUUO NVRmini2 Devices Missing Authentication Vulnerability	CVE-2022-23227	NUUO NVRmini2 Devices	The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.	08/01/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cleo Multiple Products Unauthenticated File Upload Vulnerability	CVE-2024-55956	Cleo Multiple Products	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	07/01/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe ColdFusion Improper Access Control Vulnerability	CVE-2024-20767	Adobe ColdFusion	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	06/01/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability	CVE-2024-35250	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	06/01/2025	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cleo Multiple Products Unrestricted File Upload Vulnerability	CVE-2024-50623	Cleo Multiple Products	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	03/01/2025	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability	CVE-2024-49138	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	31/12/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
CyberPanel Incorrect Default Permissions Vulnerability	CVE-2024-51378	CyberPersons CyberPanel	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	25/12/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability	CVE-2023-45727	North Grid Proself	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	24/12/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Zyxel Multiple Firewalls Path Traversal Vulnerability	CVE-2024-11667	Zyxel Multiple Firewalls	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	24/12/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
ProjectSend Improper Authentication Vulnerability	CVE-2024-11680	ProjectSend ProjectSend	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	24/12/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability	CVE-2023-28461	Array Networks AG/vxAG ArrayOS	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	16/12/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability	CVE-2024-21287	Oracle Agile Product Lifecycle Management (PLM)	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	12/12/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Code Execution Vulnerability	CVE-2024-44308	Apple Multiple Products	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	12/12/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability	CVE-2024-44309	Apple Multiple Products	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	12/12/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
VMware vCenter Server Heap-Based Buffer Overflow Vulnerability	CVE-2024-38812	VMware vCenter Server	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	11/12/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
VMware vCenter Server Privilege Escalation Vulnerability	CVE-2024-38813	VMware vCenter Server	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	11/12/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability	CVE-2024-0012	Palo Alto Networks PAN-OS	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, management interface for affected devices should not be exposed to untrusted networks, including the internet.	09/12/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Progress Kemp LoadMaster OS Command Injection Vulnerability	CVE-2024-1212	Progress Kemp LoadMaster	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	09/12/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability	CVE-2024-9474	Palo Alto Networks PAN-OS	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet.	09/12/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Palo Alto Networks Expedition OS Command Injection Vulnerability	CVE-2024-9463	Palo Alto Networks Expedition	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	05/12/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Palo Alto Networks Expedition SQL Injection Vulnerability	CVE-2024-9465	Palo Alto Networks Expedition	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	05/12/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability	CVE-2014-2120	Cisco Adaptive Security Appliance (ASA)	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	03/12/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Atlassian Jira Server and Data Center Path Traversal Vulnerability	CVE-2021-26086	Atlassian Jira Server and Data Center	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	03/12/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Metabase GeoJSON API Local File Inclusion Vulnerability	CVE-2021-41277	Metabase Metabase	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	03/12/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability	CVE-2024-43451	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	03/12/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Task Scheduler Privilege Escalation Vulnerability	CVE-2024-49039	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	03/12/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Nostromo nhttpd Directory Traversal Vulnerability	CVE-2019-16278	Nostromo nhttpd	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	28/11/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Android Framework Privilege Escalation Vulnerability	CVE-2024-43093	Android Framework	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	28/11/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
CyberPanel Incorrect Default Permissions Vulnerability	CVE-2024-51567	CyberPersons CyberPanel	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	28/11/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Palo Alto Networks Expedition Missing Authentication Vulnerability	CVE-2024-5910	Palo Alto Networks Expedition	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	28/11/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability	CVE-2024-8956	PTZOptics PT30X-SDI/NDI Cameras	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	25/11/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
PTZOptics PT30X-SDI/NDI Cameras OS Command Injection Vulnerability	CVE-2024-8957	PTZOptics PT30X-SDI/NDI Cameras	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	25/11/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco ASA and FTD Denial-of-Service Vulnerability	CVE-2024-20481	Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	14/11/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability	CVE-2024-37383	Roundcube Webmail	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	14/11/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortinet FortiManager Missing Authentication Vulnerability	CVE-2024-47575	Fortinet FortiManager	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	13/11/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft SharePoint Deserialization Vulnerability	CVE-2024-38094	Microsoft SharePoint	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	12/11/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
ScienceLogic SL1 Unspecified Vulnerability	CVE-2024-9537	ScienceLogic SL1	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	11/11/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Veeam Backup and Replication Deserialization Vulnerability	CVE-2024-40711	Veeam Backup & Replication	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	07/11/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SolarWinds Web Help Desk Hardcoded Credential Vulnerability	CVE-2024-28987	SolarWinds Web Help Desk	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	05/11/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Kernel TOCTOU Race Condition Vulnerability	CVE-2024-30088	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	05/11/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Mozilla Firefox Use-After-Free Vulnerability	CVE-2024-9680	Mozilla Firefox	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	05/11/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortinet Multiple Products Format String Vulnerability	CVE-2024-23113	Fortinet Multiple Products	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	30/10/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability	CVE-2024-9379	Ivanti Cloud Services Appliance (CSA)	As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.	30/10/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability	CVE-2024-9380	Ivanti Cloud Services Appliance (CSA)	As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.	30/10/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Qualcomm Multiple Chipsets Use-After-Free Vulnerability	CVE-2024-43047	Qualcomm Multiple Chipsets	Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.	29/10/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Management Console Remote Code Execution Vulnerability	CVE-2024-43572	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	29/10/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows MSHTML Platform Spoofing Vulnerability	CVE-2024-43573	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	29/10/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability	CVE-2024-45519	Synacor Zimbra Collaboration Suite (ZCS)	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	24/10/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability	CVE-2024-29824	Ivanti Endpoint Manager (EPM)	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	23/10/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability	CVE-2019-0344	SAP Commerce Cloud	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	21/10/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
DrayTek Multiple Vigor Routers OS Command Injection Vulnerability	CVE-2020-15415	DrayTek Multiple Vigor Routers	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	21/10/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
D-Link DIR-820 Router OS Command Injection Vulnerability	CVE-2023-25280	D-Link DIR-820 Router	The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.	21/10/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability	CVE-2024-7593	Ivanti Virtual Traffic Manager	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	15/10/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability	CVE-2024-8963	Ivanti Cloud Services Appliance (CSA)	As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.	10/10/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability	CVE-2020-0618	Microsoft SQL Server	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	09/10/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle WebLogic Server Remote Code Execution Vulnerability	CVE-2020-14644	Oracle WebLogic Server	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	09/10/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle ADF Faces Deserialization of Untrusted Data Vulnerability	CVE-2022-21445	Oracle ADF Faces	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	09/10/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache HugeGraph-Server Improper Access Control Vulnerability	CVE-2024-27348	Apache HugeGraph-Server	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	09/10/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Incorrect Default Permissions Vulnerability	CVE-2013-0643	Adobe Flash Player	The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.	08/10/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Code Execution Vulnerability	CVE-2013-0648	Adobe Flash Player	The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.	08/10/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Integer Underflow Vulnerablity	CVE-2014-0497	Adobe Flash Player	The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.	08/10/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Double Free Vulnerablity	CVE-2014-0502	Adobe Flash Player	The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.	08/10/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows MSHTML Platform Spoofing Vulnerability	CVE-2024-43461	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	07/10/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Progress WhatsUp Gold SQL Injection Vulnerability	CVE-2024-6670	Progress WhatsUp Gold	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	07/10/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Cloud Services Appliance OS Command Injection Vulnerability	CVE-2024-8190	Ivanti Cloud Services Appliance	As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive future security updates.	04/10/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Installer Improper Privilege Management Vulnerability	CVE-2024-38014	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	01/10/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability	CVE-2024-38217	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	01/10/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Publisher Protection Mechanism Failure Vulnerability	CVE-2024-38226	Microsoft Publisher	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	01/10/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
ImageMagick Improper Input Validation Vulnerability	CVE-2016-3714	ImageMagick ImageMagick	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	30/09/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Linux Kernel PIE Stack Buffer Corruption Vulnerability	CVE-2017-1000253	Linux Kernel	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	30/09/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SonicWall SonicOS Improper Access Control Vulnerability	CVE-2024-40766	SonicWall SonicOS	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	30/09/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Draytek VigorConnect Path Traversal Vulnerability	CVE-2021-20123	DrayTek VigorConnect	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	24/09/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Draytek VigorConnect Path Traversal Vulnerability	CVE-2021-20124	DrayTek VigorConnect	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	24/09/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Kingsoft WPS Office Path Traversal Vulnerability	CVE-2024-7262	Kingsoft WPS Office	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	24/09/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Inappropriate Implementation Vulnerability	CVE-2024-7965	Google Chromium V8	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	18/09/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache OFBiz Incorrect Authorization Vulnerability	CVE-2024-38856	Apache OFBiz	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	17/09/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Type Confusion Vulnerability	CVE-2024-7971	Google Chromium V8	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	16/09/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Versa Director Dangerous File Type Upload Vulnerability	CVE-2024-39717	Versa Director	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	13/09/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Exchange Server Information Disclosure Vulnerability	CVE-2021-31196	Microsoft Exchange Server	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	11/09/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Dahua IP Camera Authentication Bypass Vulnerability	CVE-2021-33044	Dahua IP Camera Firmware	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	11/09/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Dahua IP Camera Authentication Bypass Vulnerability	CVE-2021-33045	Dahua IP Camera Firmware	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	11/09/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Linux Kernel Heap-Based Buffer Overflow Vulnerability	CVE-2022-0185	Linux Kernel	Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.	11/09/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Jenkins Command Line Interface (CLI) Path Traversal Vulnerability	CVE-2024-23897	Jenkins Jenkins Command Line Interface (CLI)	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	09/09/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability	CVE-2024-28986	SolarWinds Web Help Desk	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	05/09/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Kernel Privilege Escalation Vulnerability	CVE-2024-38106	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	03/09/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability	CVE-2024-38107	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	03/09/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Scripting Engine Memory Corruption Vulnerability	CVE-2024-38178	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	03/09/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Project Remote Code Execution Vulnerability	CVE-2024-38189	Microsoft Project	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	03/09/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability	CVE-2024-38193	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	03/09/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows SmartScreen Security Feature Bypass Vulnerability	CVE-2024-38213	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	03/09/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache OFBiz Path Traversal Vulnerability	CVE-2024-32113	Apache OFBiz	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	28/08/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Android Kernel Remote Code Execution Vulnerability	CVE-2024-36971	Android Kernel	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	28/08/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability	CVE-2018-0824	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	26/08/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
VMware ESXi Authentication Bypass Vulnerability	CVE-2024-37085	VMware ESXi	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	20/08/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability	CVE-2023-45249	Acronis Cyber Infrastructure (ACI)	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	19/08/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
ServiceNow Improper Input Validation Vulnerability	CVE-2024-4879	ServiceNow Utah, Vancouver, and Washington DC Now Platform	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	19/08/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
ServiceNow Incomplete List of Disallowed Inputs Vulnerability	CVE-2024-5217	ServiceNow Utah, Vancouver, and Washington DC Now Platform	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	19/08/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Use-After-Free Vulnerability	CVE-2012-4792	Microsoft Internet Explorer	The impacted product is end-of-life and should be disconnected if still in use.	13/08/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Twilio Authy Information Disclosure Vulnerability	CVE-2024-39891	Twilio Authy	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	13/08/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
VMware vCenter Server Incorrect Default File Permissions Vulnerability	CVE-2022-22948	VMware vCenter Server	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	07/08/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SolarWinds Serv-U Path Traversal Vulnerability	CVE-2024-28995	SolarWinds Serv-U	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	07/08/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability	CVE-2024-34102	Adobe Commerce and Magento Open Source	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	07/08/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
OSGeo GeoServer GeoTools Eval Injection Vulnerability	CVE-2024-36401	OSGeo GeoServer	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	05/08/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability	CVE-2024-23692	Rejetto HTTP File Server	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	30/07/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Hyper-V Privilege Escalation Vulnerability	CVE-2024-38080	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	30/07/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows MSHTML Platform Spoofing Vulnerability	CVE-2024-38112	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	30/07/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco NX-OS Command Injection Vulnerability	CVE-2024-20399	Cisco NX-OS	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	23/07/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability	CVE-2020-13965	Roundcube Webmail	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	17/07/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
OSGeo GeoServer JAI-EXT Code Injection Vulnerability	CVE-2022-24816	OSGeo JAI-EXT	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	17/07/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Linux Kernel Use-After-Free Vulnerability	CVE-2022-2586	Linux Kernel	Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.	17/07/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability	CVE-2024-26169	Microsoft Windows	Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.	04/07/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Android Pixel Privilege Escalation Vulnerability	CVE-2024-32896	Android Pixel	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	04/07/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability	CVE-2024-4358	Progress Telerik Report Server	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	04/07/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
PHP-CGI OS Command Injection Vulnerability	CVE-2024-4577	PHP Group PHP	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	03/07/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability	CVE-2024-4610	Arm Mali GPU Kernel Driver	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	03/07/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle WebLogic Server OS Command Injection Vulnerability	CVE-2017-3506	Oracle WebLogic Server	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	24/06/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Linux Kernel Use-After-Free Vulnerability	CVE-2024-1086	Linux Kernel	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	20/06/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Check Point Quantum Security Gateways Information Disclosure Vulnerability	CVE-2024-24919	Check Point Quantum Security Gateways	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	20/06/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability	CVE-2024-4978	Justice AV Solutions Viewer	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	19/06/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Type Confusion Vulnerability	CVE-2024-5274	Google Chromium V8	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	18/06/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache Flink Improper Access Control Vulnerability	CVE-2020-17519	Apache Flink	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	13/06/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
NextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability	CVE-2023-43208	NextGen Healthcare Mirth Connect	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	10/06/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Type Confusion Vulnerability	CVE-2024-4947	Google Chromium V8	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	10/06/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability	CVE-2014-100005	D-Link DIR-600 Router	This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.	06/06/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
D-Link DIR-605 Router Information Disclosure Vulnerability	CVE-2021-40655	D-Link DIR-605 Router	This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.	06/06/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Out-of-Bounds Memory Write Vulnerability	CVE-2024-4761	Google Chromium V8	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	06/06/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows MSHTML Platform Security Feature Bypass Vulnerability	CVE-2024-30040	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	04/06/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft DWM Core Library Privilege Escalation Vulnerability	CVE-2024-30051	Microsoft DWM Core Library	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	04/06/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium Visuals Use-After-Free Vulnerability	CVE-2024-4671	Google Chromium	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	03/06/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
GitLab Community and Enterprise Editions Improper Access Control Vulnerability	CVE-2023-7028	GitLab GitLab CE/EE	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	22/05/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft SmartScreen Prompt Security Feature Bypass Vulnerability	CVE-2024-29988	Microsoft SmartScreen Prompt	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	21/05/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco ASA and FTD Denial of Service Vulnerability	CVE-2024-20353	Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	01/05/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco ASA and FTD Privilege Escalation Vulnerability	CVE-2024-20359	Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	01/05/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
CrushFTP VFS Sandbox Escape Vulnerability	CVE-2024-4040	CrushFTP CrushFTP	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	01/05/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Print Spooler Privilege Escalation Vulnerability	CVE-2022-38028	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	14/05/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Palo Alto Networks PAN-OS Command Injection Vulnerability	CVE-2024-3400	Palo Alto Networks PAN-OS	Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.	19/04/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability	CVE-2024-3272	D-Link Multiple NAS Devices	This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.	02/05/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
D-Link Multiple NAS Devices Command Injection Vulnerability	CVE-2024-3273	D-Link Multiple NAS Devices	This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.	02/05/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Android Pixel Information Disclosure Vulnerability	CVE-2024-29745	Android Pixel	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	25/04/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Android Pixel Privilege Escalation Vulnerability	CVE-2024-29748	Android Pixel	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	25/04/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft SharePoint Server Code Injection Vulnerability	CVE-2023-24955	Microsoft SharePoint Server	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	16/04/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Nice Linear eMerge E3-Series OS Command Injection Vulnerability	CVE-2019-7256	Nice Linear eMerge E3-Series	Contact the vendor for guidance on remediating firmware, per their advisory.	15/04/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability	CVE-2021-44529	Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA)	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	15/04/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortinet FortiClient EMS SQL Injection Vulnerability	CVE-2023-48788	Fortinet FortiClient EMS	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	15/04/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
JetBrains TeamCity Authentication Bypass Vulnerability	CVE-2024-27198	JetBrains TeamCity	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	28/03/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Memory Corruption Vulnerability	CVE-2024-23225	Apple Multiple Products	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	27/03/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Memory Corruption Vulnerability	CVE-2024-23296	Apple Multiple Products	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	27/03/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Sunhillo SureLine OS Command Injection Vulnerablity	CVE-2021-36380	Sunhillo SureLine	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	26/03/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Android Pixel Information Disclosure Vulnerability	CVE-2023-21237	Android Pixel	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	26/03/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability	CVE-2024-21338	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	25/03/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Streaming Service Untrusted Pointer Dereference Vulnerability	CVE-2023-29360	Microsoft Streaming Service	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	21/03/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
ConnectWise ScreenConnect Authentication Bypass Vulnerability	CVE-2024-1709	ConnectWise ScreenConnect	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	29/02/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco ASA and FTD Information Disclosure Vulnerability	CVE-2020-3259	Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	07/03/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Exchange Server Privilege Escalation Vulnerability	CVE-2024-21410	Microsoft Exchange Server	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	07/03/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows SmartScreen Security Feature Bypass Vulnerability	CVE-2024-21351	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	05/03/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability	CVE-2024-21412	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	05/03/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability	CVE-2023-43770	Roundcube Webmail	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	04/03/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortinet FortiOS Out-of-Bound Write Vulnerability	CVE-2024-21762	Fortinet FortiOS	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	16/02/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Type Confusion Vulnerability	CVE-2023-4762	Google Chromium V8	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	27/02/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Memory Corruption Vulnerability	CVE-2022-48618	Apple Multiple Products	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	21/02/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability	CVE-2024-21893	Ivanti Connect Secure, Policy Secure, and Neurons	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	02/02/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Atlassian Confluence Data Center and Server Template Injection Vulnerability	CVE-2023-22527	Atlassian Confluence Data Center and Server	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	14/02/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products WebKit Type Confusion Vulnerability	CVE-2024-23222	Apple Multiple Products	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	13/02/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
VMware vCenter Server Out-of-Bounds Write Vulnerability	CVE-2023-34048	VMware vCenter Server	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	12/02/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability	CVE-2023-35082	Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	08/02/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability	CVE-2023-6548	Citrix NetScaler ADC and NetScaler Gateway	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	24/01/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability	CVE-2023-6549	Citrix NetScaler ADC and NetScaler Gateway	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	07/02/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Out-of-Bounds Memory Access Vulnerability	CVE-2024-0519	Google Chromium V8	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	07/02/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Laravel Deserialization of Untrusted Data Vulnerability	CVE-2018-15133	Laravel Laravel Framework	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	06/02/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft SharePoint Server Privilege Escalation Vulnerability	CVE-2023-29357	Microsoft SharePoint Server	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	31/01/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability	CVE-2023-46805	Ivanti Connect Secure and Policy Secure	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	22/01/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Connect Secure and Policy Secure Command Injection Vulnerability	CVE-2024-21887	Ivanti Connect Secure and Policy Secure	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	22/01/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
D-Link DSL-2750B Devices Command Injection Vulnerability	CVE-2016-20017	D-Link DSL-2750B Devices	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	29/01/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Joomla! Improper Access Control Vulnerability	CVE-2023-23752	Joomla! Joomla!	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	29/01/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache Superset Insecure Default Initialization of Resource Vulnerability	CVE-2023-27524	Apache Superset	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	29/01/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability	CVE-2023-29300	Adobe ColdFusion	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	29/01/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability	CVE-2023-38203	Adobe ColdFusion	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	29/01/2024	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Code Execution Vulnerability	CVE-2023-41990	Apple Multiple Products	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	29/01/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium WebRTC Heap Buffer Overflow Vulnerability	CVE-2023-7024	Google Chromium WebRTC	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	23/01/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Spreadsheet::ParseExcel Remote Code Execution Vulnerability	CVE-2023-7101	Spreadsheet::ParseExcel Spreadsheet::ParseExcel	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	23/01/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
QNAP VioStor NVR OS Command Injection Vulnerability	CVE-2023-47565	QNAP VioStor NVR	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	11/01/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
FXC AE1021, AE1021PE OS Command Injection Vulnerability	CVE-2023-49897	FXC AE1021, AE1021PE	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	11/01/2024	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Unitronics Vision PLC and HMI Insecure Default Password Vulnerability	CVE-2023-6448	Unitronics Vision PLC and HMI	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	18/12/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Qlik Sense HTTP Tunneling Vulnerability	CVE-2023-41265	Qlik Sense	Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.	28/12/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Qlik Sense Path Traversal Vulnerability	CVE-2023-41266	Qlik Sense	Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.	28/12/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Qualcomm Multiple Chipsets Use-After-Free Vulnerability	CVE-2022-22071	Qualcomm Multiple Chipsets	Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.	26/12/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Qualcomm Multiple Chipsets Use-After-Free Vulnerability	CVE-2023-33063	Qualcomm Multiple Chipsets	Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.	26/12/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability	CVE-2023-33106	Qualcomm Multiple Chipsets	Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.	26/12/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Qualcomm Multiple Chipsets Integer Overflow Vulnerability	CVE-2023-33107	Qualcomm Multiple Chipsets	Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.	26/12/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability	CVE-2023-42916	Apple Multiple Products	Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.	25/12/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products WebKit Memory Corruption Vulnerability	CVE-2023-42917	Apple Multiple Products	Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.	25/12/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
ownCloud graphapi Information Disclosure Vulnerability	CVE-2023-49103	ownCloud ownCloud graphapi	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	21/12/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Skia Integer Overflow Vulnerability	CVE-2023-6345	Google Chromium Skia	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	21/12/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
GNU C Library Buffer Overflow Vulnerability	CVE-2023-4911	GNU GNU C Library	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	12/12/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle Fusion Middleware Unspecified Vulnerability	CVE-2020-2551	Oracle Fusion Middleware	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	07/12/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Sophos Web Appliance Command Injection Vulnerability	CVE-2023-1671	Sophos Web Appliance	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	07/12/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability	CVE-2023-36584	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	07/12/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows SmartScreen Security Feature Bypass Vulnerability	CVE-2023-36025	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	05/12/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability	CVE-2023-36033	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	05/12/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation Vulnerability	CVE-2023-36036	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	05/12/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Juniper Junos OS EX Series PHP External Variable Modification Vulnerability	CVE-2023-36844	Juniper Junos OS	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	17/11/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability	CVE-2023-36845	Juniper Junos OS	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	17/11/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability	CVE-2023-36846	Juniper Junos OS	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	17/11/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability	CVE-2023-36847	Juniper Junos OS	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	17/11/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability	CVE-2023-36851	Juniper Junos OS	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	17/11/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SysAid Server Path Traversal Vulnerability	CVE-2023-47246	SysAid SysAid Server	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	04/12/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Service Location Protocol (SLP) Denial-of-Service Vulnerability	CVE-2023-29552	IETF Service Location Protocol (SLP)	Apply mitigations per vendor instructions or disable SLP service or port 427/UDP on all systems running on untrusted networks, including those directly connected to the Internet.	29/11/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Atlassian Confluence Data Center and Server Improper Authorization Vulnerability	CVE-2023-22518	Atlassian Confluence Data Center and Server	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	28/11/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache ActiveMQ Deserialization of Untrusted Data Vulnerability	CVE-2023-46604	Apache ActiveMQ	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	23/11/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability	CVE-2023-46747	F5 BIG-IP Configuration Utility	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	21/11/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
F5 BIG-IP Configuration Utility SQL Injection Vulnerability	CVE-2023-46748	F5 BIG-IP Configuration Utility	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	21/11/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability	CVE-2023-5631	Roundcube Webmail	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	16/11/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS XE Web UI Command Injection Vulnerability	CVE-2023-20273	Cisco Cisco IOS XE Web UI	Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.	27/10/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability	CVE-2023-4966	Citrix NetScaler ADC and NetScaler Gateway	Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.	08/11/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS XE Web UI Privilege Escalation Vulnerability	CVE-2023-20198	Cisco IOS XE Web UI	Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.	20/10/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability	CVE-2023-20109	Cisco IOS and IOS XE	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	31/10/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Acrobat and Reader Use-After-Free Vulnerability	CVE-2023-21608	Adobe Acrobat and Reader	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	31/10/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft WordPad Information Disclosure Vulnerability	CVE-2023-36563	Microsoft WordPad	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	31/10/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Skype for Business Privilege Escalation Vulnerability	CVE-2023-41763	Microsoft Skype for Business	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	31/10/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
HTTP/2 Rapid Reset Attack Vulnerability	CVE-2023-44487	IETF HTTP/2	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.	31/10/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Atlassian Confluence Data Center and Server Broken Access Control Vulnerability	CVE-2023-22515	Atlassian Confluence Data Center and Server	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA.	13/10/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability	CVE-2023-40044	Progress WS_FTP Server	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	26/10/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability	CVE-2023-42824	Apple iOS and iPadOS	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	26/10/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability	CVE-2023-28229	Microsoft Windows CNG Key Isolation Service	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	25/10/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
JetBrains TeamCity Authentication Bypass Vulnerability	CVE-2023-42793	JetBrains TeamCity	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	25/10/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability	CVE-2023-4211	Arm Mali GPU Kernel Driver	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	24/10/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium libvpx Heap Buffer Overflow Vulnerability	CVE-2023-5217	Google Chromium libvpx	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	23/10/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability	CVE-2018-14667	Red Hat JBoss RichFaces Framework	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	19/10/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Improper Certificate Validation Vulnerability	CVE-2023-41991	Apple Multiple Products	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	16/10/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Kernel Privilege Escalation Vulnerability	CVE-2023-41992	Apple Multiple Products	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	16/10/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products WebKit Code Execution Vulnerability	CVE-2023-41993	Apple Multiple Products	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	16/10/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability	CVE-2023-41179	Trend Micro Apex One and Worry-Free Business Security	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	12/10/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
MinIO Security Feature Bypass Vulnerability	CVE-2023-28434	MinIO MinIO	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	10/10/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Realtek SDK Improper Input Validation Vulnerability	CVE-2014-8361	Realtek SDK	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	09/10/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Zyxel EMG2926 Routers Command Injection Vulnerability	CVE-2017-6884	Zyxel EMG2926 Routers	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	09/10/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Laravel Ignition File Upload Vulnerability	CVE-2021-3129	Laravel Ignition	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	09/10/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Samsung Mobile Devices Use-After-Free Vulnerability	CVE-2022-22265	Samsung Mobile Devices	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	09/10/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability	CVE-2023-26369	Adobe Acrobat and Reader	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	05/10/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability	CVE-2023-20269	Cisco Adaptive Security Appliance and Firepower Threat Defense	Apply mitigations per vendor instructions for group-lock and vpn-simultaneous-logins or discontinue use of the product for unsupported devices.	04/10/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Android Framework Privilege Escalation Vulnerability	CVE-2023-35674	Android Framework	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	04/10/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium WebP Heap-Based Buffer Overflow Vulnerability	CVE-2023-4863	Google Chromium WebP	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	04/10/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Word Information Disclosure Vulnerability	CVE-2023-36761	Microsoft Word	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	03/10/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Streaming Service Proxy Privilege Escalation Vulnerability	CVE-2023-36802	Microsoft Streaming Service Proxy	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	03/10/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability	CVE-2023-41061	Apple iOS, iPadOS, and watchOS	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	02/10/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability	CVE-2023-41064	Apple iOS, iPadOS, and macOS	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	02/10/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache RocketMQ Command Execution Vulnerability	CVE-2023-33246	Apache RocketMQ	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	27/09/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ignite Realtime Openfire Path Traversal Vulnerability	CVE-2023-32315	Ignite Realtime Openfire	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	14/09/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
RARLAB WinRAR Code Execution Vulnerability	CVE-2023-38831	RARLAB WinRAR	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	14/09/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability	CVE-2023-27532	Veeam Backup & Replication	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	12/09/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Sentry Authentication Bypass Vulnerability	CVE-2023-38035	Ivanti Sentry	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	12/09/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability	CVE-2023-26359	Adobe ColdFusion	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	11/09/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Citrix Content Collaboration ShareFile Improper Access Control Vulnerability	CVE-2023-24489	Citrix Content Collaboration	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	06/09/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability	CVE-2023-38180	Microsoft .NET Core and Visual Studio	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	30/08/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Zyxel P660HN-T1A Routers Command Injection Vulnerability	CVE-2017-18368	Zyxel P660HN-T1A Routers	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	28/08/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability	CVE-2023-35081	Ivanti Endpoint Manager Mobile (EPMM)	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	21/08/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability	CVE-2023-37580	Synacor Zimbra Collaboration Suite (ZCS)	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	17/08/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Kernel Unspecified Vulnerability	CVE-2023-38606	Apple Multiple Products	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	16/08/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability	CVE-2023-35078	Ivanti Endpoint Manager Mobile (EPMM)	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	15/08/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe ColdFusion Improper Access Control Vulnerability	CVE-2023-29298	Adobe ColdFusion	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	10/08/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe ColdFusion Improper Access Control Vulnerability	CVE-2023-38205	Adobe ColdFusion	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	10/08/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability	CVE-2023-3519	Citrix NetScaler ADC and NetScaler Gateway	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	09/08/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Search Remote Code Execution Vulnerability	CVE-2023-36884	Microsoft Windows	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.	29/08/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SolarView Compact Command Injection Vulnerability	CVE-2022-29303	SolarView Compact	Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.	03/08/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products WebKit Code Execution Vulnerability	CVE-2023-37450	Apple Multiple Products	Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.	03/08/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Netwrix Auditor Insecure Object Deserialization Vulnerability	CVE-2022-31199	Netwrix Auditor	Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.	01/08/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability	CVE-2023-32046	Microsoft Windows	Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.	01/08/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability	CVE-2023-32049	Microsoft Windows	Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.	01/08/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Outlook Security Feature Bypass Vulnerability	CVE-2023-35311	Microsoft Outlook	Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.	01/08/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability	CVE-2023-36874	Microsoft Windows	Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.	01/08/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability	CVE-2021-29256	Arm Mali Graphics Processing Unit (GPU)	Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.	28/07/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
D-Link DIR-859 Router Command Execution Vulnerability	CVE-2019-17621	D-Link DIR-859 Router	Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.	20/07/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
D-Link DWL-2600AP Access Point Command Injection Vulnerability	CVE-2019-20500	D-Link DWL-2600AP Access Point	Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.	20/07/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Samsung Mobile Devices Unspecified Vulnerability	CVE-2021-25371	Samsung Mobile Devices	Apply updates per vendor instructions or discontinue use of the product if updates are unavailable	20/07/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Samsung Mobile Devices Improper Boundary Check Vulnerability	CVE-2021-25372	Samsung Mobile Devices	Apply updates per vendor instructions or discontinue use of the product if updates are unavailable	20/07/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Samsung Mobile Devices Race Condition Vulnerability	CVE-2021-25394	Samsung Mobile Devices	Apply updates per vendor instructions or discontinue use of the product if updates are unavailable	20/07/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Samsung Mobile Devices Race Condition Vulnerability	CVE-2021-25395	Samsung Mobile Devices	Apply updates per vendor instructions or discontinue use of the product if updates are unavailable	20/07/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Samsung Mobile Devices Out-of-Bounds Read Vulnerability	CVE-2021-25487	Samsung Mobile Devices	Apply updates per vendor instructions or discontinue use of the product if updates are unavailable	20/07/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Samsung Mobile Devices Improper Input Validation Vulnerability	CVE-2021-25489	Samsung Mobile Devices	Apply updates per vendor instructions or discontinue use of the product if updates are unavailable	20/07/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
VMware Tools Authentication Bypass Vulnerability	CVE-2023-20867	VMware Tools	Apply updates per vendor instructions.	14/07/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Zyxel Multiple NAS Devices Command Injection Vulnerability	CVE-2023-27992	Zyxel Multiple Network-Attached Storage (NAS) Devices	Apply updates per vendor instructions.	14/07/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Integer Overflow Vulnerability	CVE-2023-32434	Apple Multiple Products	Apply updates per vendor instructions.	14/07/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products WebKit Memory Corruption Vulnerability	CVE-2023-32435	Apple Multiple Products	Apply updates per vendor instructions.	14/07/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products WebKit Type Confusion Vulnerability	CVE-2023-32439	Apple Multiple Products	Apply updates per vendor instructions.	14/07/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Win32k Privilege Escalation Vulnerability	CVE-2016-0165	Microsoft Win32k	Apply updates per vendor instructions.	13/07/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability	CVE-2016-9079	Mozilla Firefox, Firefox ESR, and Thunderbird	Apply updates per vendor instructions.	13/07/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Roundcube Webmail Remote Code Execution Vulnerability	CVE-2020-12641	Roundcube Roundcube Webmail	Apply updates per vendor instructions.	13/07/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability	CVE-2020-35730	Roundcube Roundcube Webmail	Apply updates per vendor instructions.	13/07/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Roundcube Webmail SQL Injection Vulnerability	CVE-2021-44026	Roundcube Roundcube Webmail	Apply updates per vendor instructions.	13/07/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Vmware Aria Operations for Networks Command Injection Vulnerability	CVE-2023-20887	VMware Aria Operations for Networks	Apply updates per vendor instructions.	13/07/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability	CVE-2023-27997	Fortinet FortiOS and FortiProxy SSL-VPN	Apply updates per vendor instructions.	04/07/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Type Confusion Vulnerability	CVE-2023-3079	Google Chromium V8	Apply updates per vendor instructions.	28/06/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Zyxel Multiple Firewalls Buffer Overflow Vulnerability	CVE-2023-33009	Zyxel Multiple Firewalls	Apply updates per vendor instructions.	26/06/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Zyxel Multiple Firewalls Buffer Overflow Vulnerability	CVE-2023-33010	Zyxel Multiple Firewalls	Apply updates per vendor instructions.	26/06/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Progress MOVEit Transfer SQL Injection Vulnerability	CVE-2023-34362	Progress MOVEit Transfer	Apply updates per vendor instructions.	23/06/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Zyxel Multiple Firewalls OS Command Injection Vulnerability	CVE-2023-28771	Zyxel Multiple Firewalls	Apply updates per vendor instructions.	21/06/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Barracuda Networks ESG Appliance Improper Input Validation Vulnerability	CVE-2023-2868	Barracuda Networks Email Security Gateway (ESG) Appliance	Apply updates per vendor instructions.	16/06/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability	CVE-2023-28204	Apple Multiple Products	Apply updates per vendor instructions.	12/06/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products WebKit Use-After-Free Vulnerability	CVE-2023-32373	Apple Multiple Products	Apply updates per vendor instructions.	12/06/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products WebKit Sandbox Escape Vulnerability	CVE-2023-32409	Apple Multiple Products	Apply updates per vendor instructions.	12/06/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS Denial-of-Service Vulnerability	CVE-2004-1464	Cisco IOS	Apply updates per vendor instructions.	09/06/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability	CVE-2016-6415	Cisco IOS, IOS XR, and IOS XE	Apply updates per vendor instructions.	09/06/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Samsung Mobile Devices Insertion of Sensitive Information Into Log File Vulnerability	CVE-2023-21492	Samsung Mobile Devices	Apply updates per vendor instructions.	09/06/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Linux Kernel Improper Input Validation Vulnerability	CVE-2010-3904	Linux Kernel	The impacted product is end-of-life and should be disconnected if still in use.	02/06/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Linux Kernel Race Condition Vulnerability	CVE-2014-0196	Linux Kernel	The impacted product is end-of-life and should be disconnected if still in use.	02/06/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Jenkins User Interface (UI) Information Disclosure Vulnerability	CVE-2015-5317	Jenkins Jenkins User Interface (UI)	Apply updates per vendor instructions.	02/06/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle Java SE and JRockit Unspecified Vulnerability	CVE-2016-3427	Oracle Java SE and JRockit	Apply updates per vendor instructions.	02/06/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache Tomcat Remote Code Execution Vulnerability	CVE-2016-8735	Apache Tomcat	Apply updates per vendor instructions.	02/06/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Red Hat Polkit Incorrect Authorization Vulnerability	CVE-2021-3560	Red Hat Polkit	Apply updates per vendor instructions.	02/06/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Multiple Ruckus Wireless Products CSRF and RCE Vulnerability	CVE-2023-25717	Ruckus Wireless Multiple Products	Apply updates per vendor instructions or disconnect product if it is end-of-life.	02/06/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Win32K Privilege Escalation Vulnerability	CVE-2023-29336	Microsoft Win32k	Apply updates per vendor instructions.	30/05/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache Log4j2 Deserialization of Untrusted Data Vulnerability	CVE-2021-45046	Apache Log4j2	Apply updates per vendor instructions.	22/05/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
TP-Link Archer AX-21 Command Injection Vulnerability	CVE-2023-1389	TP-Link Archer AX21	Apply updates per vendor instructions.	22/05/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle WebLogic Server Unspecified Vulnerability	CVE-2023-21839	Oracle WebLogic Server	Apply updates per vendor instructions.	22/05/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chrome Skia Integer Overflow Vulnerability	CVE-2023-2136	Google Chromium Skia	Apply updates per vendor instructions.	12/05/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
PaperCut MF/NG Improper Access Control Vulnerability	CVE-2023-27350	PaperCut MF/NG	Apply updates per vendor instructions.	12/05/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
MinIO Information Disclosure Vulnerability	CVE-2023-28432	MinIO MinIO	Apply updates per vendor instructions.	12/05/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability	CVE-2017-6742	Cisco IOS and IOS XE Software	Apply updates per vendor instructions.	10/05/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple macOS Use-After-Free Vulnerability	CVE-2019-8526	Apple macOS	Apply updates per vendor instructions.	08/05/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Type Confusion Vulnerability	CVE-2023-2033	Google Chromium V8	Apply updates per vendor instructions.	08/05/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Android Framework Privilege Escalation Vulnerability	CVE-2023-20963	Android Framework	Apply updates per vendor instructions.	04/05/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Novi Survey Insecure Deserialization Vulnerability	CVE-2023-29492	Novi Survey Novi Survey	Apply updates per vendor instructions.	04/05/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability	CVE-2023-28252	Microsoft Windows	Apply updates per vendor instructions.	02/05/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products WebKit Use-After-Free Vulnerability	CVE-2023-28205	Apple Multiple Products	Apply updates per vendor instructions.	01/05/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability	CVE-2023-28206	Apple iOS, iPadOS, and macOS	Apply updates per vendor instructions.	01/05/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Certificate Dialog Privilege Escalation Vulnerability	CVE-2019-1388	Microsoft Windows	Apply updates per vendor instructions.	28/04/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Veritas Backup Exec Agent File Access Vulnerability	CVE-2021-27876	Veritas Backup Exec Agent	Apply updates per vendor instructions.	28/04/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Veritas Backup Exec Agent Improper Authentication Vulnerability	CVE-2021-27877	Veritas Backup Exec Agent	Apply updates per vendor instructions.	28/04/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Veritas Backup Exec Agent Command Execution Vulnerability	CVE-2021-27878	Veritas Backup Exec Agent	Apply updates per vendor instructions.	28/04/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Arm Mali GPU Kernel Driver Information Disclosure Vulnerability	CVE-2023-26083	Arm Mali Graphics Processing Unit (GPU)	Apply updates per vendor instructions.	28/04/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability	CVE-2022-27926	Synacor Zimbra Collaboration Suite (ZCS)	Apply updates per vendor instructions.	24/04/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Memory Corruption Vulnerability	CVE-2013-3163	Microsoft Internet Explorer	The impacted product is end-of-life and should be disconnected if still in use.	20/04/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Samba Remote Code Execution Vulnerability	CVE-2017-7494	Samba Samba	Apply updates per vendor instructions.	20/04/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability	CVE-2021-30900	Apple iOS, iPadOS, and macOS	Apply updates per vendor instructions.	20/04/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Arm Mali GPU Kernel Driver Unspecified Vulnerability	CVE-2022-22706	Arm Mali Graphics Processing Unit (GPU)	Apply updates per vendor instructions.	20/04/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium Network Service Use-After-Free Vulnerability	CVE-2022-3038	Google Chromium Network Service	Apply updates per vendor instructions.	20/04/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability	CVE-2022-38181	Arm Mali Graphics Processing Unit (GPU)	Apply updates per vendor instructions.	20/04/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability	CVE-2022-39197	Fortra Cobalt Strike	Apply updates per vendor instructions.	20/04/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability	CVE-2022-42948	Fortra Cobalt Strike	Apply updates per vendor instructions.	20/04/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Linux Kernel Use-After-Free Vulnerability	CVE-2023-0266	Linux Kernel	Apply updates per vendor instructions.	20/04/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability	CVE-2023-26360	Adobe ColdFusion	Apply updates per vendor instructions.	05/04/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortinet FortiOS Path Traversal Vulnerability	CVE-2022-41328	Fortinet FortiOS	Apply updates per vendor instructions.	04/04/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office Outlook Privilege Escalation Vulnerability	CVE-2023-23397	Microsoft Office	Apply updates per vendor instructions.	04/04/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows SmartScreen Security Feature Bypass Vulnerability	CVE-2023-24880	Microsoft Windows	Apply updates per vendor instructions.	04/04/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Plex Media Server Remote Code Execution Vulnerability	CVE-2020-5741	Plex Media Server	Apply updates per vendor instructions.	31/03/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
XStream Remote Code Execution Vulnerability	CVE-2021-39144	XStream XStream	Apply updates per vendor instructions.	31/03/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability	CVE-2022-28810	Zoho ManageEngine	Apply updates per vendor instructions.	28/03/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache Spark Command Injection Vulnerability	CVE-2022-33891	Apache Spark	Apply updates per vendor instructions.	28/03/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Teclib GLPI Remote Code Execution Vulnerability	CVE-2022-35914	Teclib GLPI	Apply updates per vendor instructions.	28/03/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
ZK Framework AuUploader Unspecified Vulnerability	CVE-2022-36537	ZK Framework AuUploader	Apply updates per vendor instructions.	20/03/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Mitel MiVoice Connect Command Injection Vulnerability	CVE-2022-40765	Mitel MiVoice Connect	Apply updates per vendor instructions.	14/03/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Mitel MiVoice Connect Code Injection Vulnerability	CVE-2022-41223	Mitel MiVoice Connect	Apply updates per vendor instructions.	14/03/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
IBM Aspera Faspex Code Execution Vulnerability	CVE-2022-47986	IBM Aspera Faspex	Apply updates per vendor instructions.	14/03/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cacti Command Injection Vulnerability	CVE-2022-46169	Cacti Cacti	Apply updates per vendor instructions.	09/03/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office Publisher Security Feature Bypass Vulnerability	CVE-2023-21715	Microsoft Office	Apply updates per vendor instructions.	07/03/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Graphic Component Privilege Escalation Vulnerability	CVE-2023-21823	Microsoft Windows	Apply updates per vendor instructions.	07/03/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability	CVE-2023-23376	Microsoft Windows	Apply updates per vendor instructions.	07/03/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products WebKit Type Confusion Vulnerability	CVE-2023-23529	Apple Multiple Products	Apply updates per vendor instructions.	07/03/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability	CVE-2015-2291	Intel Ethernet Diagnostics Driver for Windows	Apply updates per vendor instructions.	03/03/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
TerraMaster OS Remote Command Execution Vulnerability	CVE-2022-24990	TerraMaster TerraMaster OS	Apply updates per vendor instructions.	03/03/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortra GoAnywhere MFT Remote Code Execution Vulnerability	CVE-2023-0669	Fortra GoAnywhere MFT	Apply updates per vendor instructions.	03/03/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle E-Business Suite Unspecified Vulnerability	CVE-2022-21587	Oracle E-Business Suite	Apply updates per vendor instructions.	23/02/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Multiple SugarCRM Products Remote Code Execution Vulnerability	CVE-2023-22952	SugarCRM Multiple Products	Apply updates per vendor instructions.	23/02/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability	CVE-2017-11357	Telerik User Interface (UI) for ASP.NET AJAX	Apply updates per vendor instructions.	16/02/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability	CVE-2022-47966	Zoho ManageEngine	Apply updates per vendor instructions.	13/02/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
CWP Control Web Panel OS Command Injection Vulnerability	CVE-2022-44877	CWP Control Web Panel	Apply updates per vendor instructions.	07/02/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Exchange Server Privilege Escalation Vulnerability	CVE-2022-41080	Microsoft Exchange Server	Apply updates per vendor instructions.	31/01/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability	CVE-2023-21674	Microsoft Windows	Apply updates per vendor instructions.	31/01/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
TIBCO JasperReports Library Directory Traversal Vulnerability	CVE-2018-18809	TIBCO JasperReports	Apply updates per vendor instructions.	19/01/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
TIBCO JasperReports Server Information Disclosure Vulnerability	CVE-2018-5430	TIBCO JasperReports	Apply updates per vendor instructions.	19/01/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS Type Confusion Vulnerability	CVE-2022-42856	Apple iOS	Apply updates per vendor instructions.	04/01/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Veeam Backup & Replication Remote Code Execution Vulnerability	CVE-2022-26500	Veeam Backup & Replication	Apply updates per vendor instructions.	03/01/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Veeam Backup & Replication Remote Code Execution Vulnerability	CVE-2022-26501	Veeam Backup & Replication	Apply updates per vendor instructions.	03/01/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability	CVE-2022-27518	Citrix Application Delivery Controller (ADC) and Gateway	Apply updates per vendor instructions.	03/01/2023	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability	CVE-2022-42475	Fortinet FortiOS	Apply updates per vendor instructions.	03/01/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Defender SmartScreen Security Feature Bypass Vulnerability	CVE-2022-44698	Microsoft Defender	Apply updates per vendor instructions.	03/01/2023	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Type Confusion Vulnerability	CVE-2022-4262	Google Chromium V8	Apply updates per vendor instructions.	26/12/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle Fusion Middleware Unspecified Vulnerability	CVE-2021-35587	Oracle Fusion Middleware	Apply updates per vendor instructions.	19/12/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium GPU Heap Buffer Overflow Vulnerability	CVE-2022-4135	Google Chromium GPU	Apply updates per vendor instructions.	19/12/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability	CVE-2022-41049	Microsoft Windows	Apply updates per vendor instructions.	09/12/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Samsung Mobile Devices Improper Access Control Vulnerability	CVE-2021-25337	Samsung Mobile Devices	Apply updates per vendor instructions.	29/11/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Samsung Mobile Devices Improper Access Control Vulnerability	CVE-2021-25369	Samsung Mobile Devices	Apply updates per vendor instructions.	29/11/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Samsung Mobile Devices Memory Corruption Vulnerability	CVE-2021-25370	Samsung Mobile Devices	Apply updates per vendor instructions.	29/11/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Print Spooler Privilege Escalation Vulnerability	CVE-2022-41073	Microsoft Windows	Apply updates per vendor instructions.	09/12/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability	CVE-2022-41091	Microsoft Windows	Apply updates per vendor instructions.	09/12/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability	CVE-2022-41125	Microsoft Windows	Apply updates per vendor instructions.	09/12/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Scripting Languages Remote Code Execution Vulnerability	CVE-2022-41128	Microsoft Windows	Apply updates per vendor instructions.	09/12/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Type Confusion Vulnerability	CVE-2022-3723	Google Chromium V8	Apply updates per vendor instructions.	18/11/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS and iPadOS Out-of-Bounds Write Vulnerability	CVE-2022-42827	Apple iOS and iPadOS	Apply updates per vendor instructions.	15/11/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
GIGABYTE Multiple Products Unspecified Vulnerability	CVE-2018-19320	GIGABYTE Multiple Products	Apply updates per vendor instructions.	14/11/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
GIGABYTE Multiple Products Privilege Escalation Vulnerability	CVE-2018-19321	GIGABYTE Multiple Products	Apply updates per vendor instructions.	14/11/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
GIGABYTE Multiple Products Code Execution Vulnerability	CVE-2018-19322	GIGABYTE Multiple Products	Apply updates per vendor instructions.	14/11/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
GIGABYTE Multiple Products Privilege Escalation Vulnerability	CVE-2018-19323	GIGABYTE Multiple Products	Apply updates per vendor instructions.	14/11/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability	CVE-2020-3153	Cisco AnyConnect Secure	Apply updates per vendor instructions.	14/11/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability	CVE-2020-3433	Cisco AnyConnect Secure	Apply updates per vendor instructions.	14/11/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Linux Kernel Privilege Escalation Vulnerability	CVE-2021-3493	Linux Kernel	Apply updates per vendor instructions.	10/11/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability	CVE-2022-41352	Synacor Zimbra Collaboration Suite (ZCS)	Apply updates per vendor instructions.	10/11/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortinet Multiple Products Authentication Bypass Vulnerability	CVE-2022-40684	Fortinet Multiple Products	Apply updates per vendor instructions.	01/11/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows COM+ Event System Service Privilege Escalation Vulnerability	CVE-2022-41033	Microsoft Windows COM+ Event System Service	Apply updates per vendor instructions.	01/11/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Atlassian Bitbucket Server and Data Center Command Injection Vulnerability	CVE-2022-36804	Atlassian Bitbucket Server and Data Center	Apply updates per vendor instructions.	21/10/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Exchange Server Server-Side Request Forgery Vulnerability	CVE-2022-41040	Microsoft Exchange Server	Apply updates per vendor instructions.	21/10/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Exchange Server Remote Code Execution Vulnerability	CVE-2022-41082	Microsoft Exchange Server	Apply updates per vendor instructions.	21/10/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Sophos Firewall Code Injection Vulnerability	CVE-2022-3236	Sophos Firewall	Apply updates per vendor instructions.	14/10/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability	CVE-2022-35405	Zoho ManageEngine	Apply updates per vendor instructions.	13/10/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Remote Code Execution Vulnerability	CVE-2010-2568	Microsoft Windows	Apply updates per vendor instructions.	06/10/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Linux Kernel Privilege Escalation Vulnerability	CVE-2013-2094	Linux Kernel	Apply updates per vendor instructions.	06/10/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Linux Kernel Integer Overflow Vulnerability	CVE-2013-2596	Linux Kernel	Apply updates per vendor instructions.	06/10/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Code Aurora ACDB Audio Driver Stack-based Buffer Overflow Vulnerability	CVE-2013-2597	Code Aurora ACDB Audio Driver	Apply updates per vendor instructions.	06/10/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Linux Kernel Improper Input Validation Vulnerability	CVE-2013-6282	Linux Kernel	Apply updates per vendor instructions.	06/10/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability	CVE-2022-40139	Trend Micro Apex One and Apex One as a Service	Apply updates per vendor instructions.	06/10/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS, iPadOS, and macOS Remote Code Execution Vulnerability	CVE-2022-32917	Apple iOS, iPadOS, and macOS	Apply updates per vendor instructions.	05/10/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability	CVE-2022-37969	Microsoft Windows	Apply updates per vendor instructions.	05/10/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Android OS Privilege Escalation Vulnerability	CVE-2011-1823	Android Android OS	Apply updates per vendor instructions.	29/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
D-Link DIR-300 Router Cleartext Storage of a Password Vulnerability	CVE-2011-4723	D-Link DIR-300 Router	The impacted product is end-of-life and should be disconnected if still in use.	29/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability	CVE-2017-5521	NETGEAR Multiple Devices	Apply updates per vendor instructions. If the affected device has since entered end-of-life, it should be disconnected if still in use.	29/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortinet FortiOS and FortiADC Improper Access Control Vulnerability	CVE-2018-13374	Fortinet FortiOS and FortiADC	Apply updates per vendor instructions.	29/09/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle WebLogic Server Unspecified Vulnerability	CVE-2018-2628	Oracle WebLogic Server	Apply updates per vendor instructions.	29/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
D-Link Multiple Routers OS Command Injection Vulnerability	CVE-2018-6530	D-Link Multiple Routers	The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use.	29/09/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability	CVE-2018-7445	MikroTik RouterOS	Apply updates per vendor instructions.	29/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS, iPadOS, and macOS Input Validation Vulnerability	CVE-2020-9934	Apple iOS, iPadOS, and macOS	Apply updates per vendor instructions.	29/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
D-Link DIR-820L Remote Code Execution Vulnerability	CVE-2022-26258	D-Link DIR-820L	The impacted product is end-of-life and should be disconnected if still in use.	29/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
QNAP Photo Station Externally Controlled Reference Vulnerability	CVE-2022-27593	QNAP Photo Station	Apply updates per vendor instructions.	29/09/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium Mojo Insufficient Data Validation Vulnerability	CVE-2022-3075	Google Chromium Mojo	Apply updates per vendor instructions.	29/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability	CVE-2020-28949	PEAR Archive_Tar	Apply updates per vendor instructions.	15/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
PEAR Archive_Tar Improper Link Resolution Vulnerability	CVE-2020-36193	PEAR Archive_Tar	Apply updates per vendor instructions.	15/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS, macOS, watchOS Sandbox Bypass Vulnerability	CVE-2021-31010	Apple iOS, macOS, watchOS	Apply updates per vendor instructions.	15/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Delta Electronics DOPSoft 2 Improper Input Validation Vulnerability	CVE-2021-38406	Delta Electronics DOPSoft 2	The impacted product is end-of-life and should be disconnected if still in use.	15/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Grafana Authentication Bypass Vulnerability	CVE-2021-39226	Grafana Labs Grafana	Apply updates per vendor instructions.	15/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
WebRTC Heap Buffer Overflow Vulnerability	CVE-2022-2294	WebRTC WebRTC	Apply updates per vendor instructions.	15/09/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability	CVE-2022-22963	VMware Tanzu Spring Cloud	Apply updates per vendor instructions.	15/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache APISIX Authentication Bypass Vulnerability	CVE-2022-24112	Apache APISIX	Apply updates per vendor instructions.	15/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache CouchDB Insecure Default Initialization of Resource Vulnerability	CVE-2022-24706	Apache CouchDB	Apply updates per vendor instructions.	15/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
dotCMS Unrestricted Upload of File Vulnerability	CVE-2022-26352	dotCMS dotCMS	Apply updates per vendor instructions.	15/09/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability	CVE-2022-0028	Palo Alto Networks PAN-OS	Apply updates per vendor instructions.	12/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Palo Alto Networks PAN-OS Remote Code Execution Vulnerability	CVE-2017-15944	Palo Alto Networks PAN-OS	Apply updates per vendor instructions.	08/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Runtime Remote Code Execution Vulnerability	CVE-2022-21971	Microsoft Windows	Apply updates per vendor instructions.	08/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SAP Multiple Products HTTP Request Smuggling Vulnerability	CVE-2022-22536	SAP Multiple Products	Apply updates per vendor instructions.	08/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability	CVE-2022-26923	Microsoft Active Directory	Apply updates per vendor instructions.	08/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium Intents Insufficient Input Validation Vulnerability	CVE-2022-2856	Google Chromium Intents	Apply updates per vendor instructions.	08/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS and macOS Out-of-Bounds Write Vulnerability	CVE-2022-32893	Apple iOS and macOS	Apply updates per vendor instructions.	08/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS and macOS Out-of-Bounds Write Vulnerability	CVE-2022-32894	Apple iOS and macOS	Apply updates per vendor instructions.	08/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability	CVE-2022-27925	Synacor Zimbra Collaboration Suite (ZCS)	Apply updates per vendor instructions.	01/09/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability	CVE-2022-37042	Synacor Zimbra Collaboration Suite (ZCS)	Apply updates per vendor instructions.	01/09/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
RARLAB UnRAR Directory Traversal Vulnerability	CVE-2022-30333	RARLAB UnRAR	Apply updates per vendor instructions.	30/08/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability	CVE-2022-34713	Microsoft Windows	Apply updates per vendor instructions.	30/08/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability	CVE-2022-27924	Synacor Zimbra Collaboration Suite (ZCS)	Apply updates per vendor instructions.	25/08/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability	CVE-2022-26138	Atlassian Confluence	Apply updates per vendor instructions.	19/08/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability	CVE-2022-22047	Microsoft Windows	Apply updates per vendor instructions.	02/08/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows LSA Spoofing Vulnerability	CVE-2022-26925	Microsoft Windows	Apply remediation actions outlined in CISA guidance [https://www.cisa.gov/guidance-applying-june-microsoft-patch].	22/07/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Memory Corruption Vulnerability	CVE-2018-4344	Apple Multiple Products	Apply updates per vendor instructions.	18/07/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Use-After-Free Vulnerability	CVE-2019-8605	Apple Multiple Products	Apply updates per vendor instructions.	18/07/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Memory Corruption Vulnerability	CVE-2020-3837	Apple Multiple Products	Apply updates per vendor instructions.	18/07/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Memory Corruption Vulnerability	CVE-2020-9907	Apple Multiple Products	Apply updates per vendor instructions.	18/07/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium PopupBlocker Security Bypass Vulnerability	CVE-2021-30533	Google Chromium PopupBlocker	Apply updates per vendor instructions.	18/07/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS and iPadOS Buffer Overflow Vulnerability	CVE-2021-30983	Apple iOS and iPadOS	Apply updates per vendor instructions.	18/07/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Red Hat Polkit Out-of-Bounds Read and Write Vulnerability	CVE-2021-4034	Red Hat Polkit	Apply updates per vendor instructions.	18/07/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Mitel MiVoice Connect Data Validation Vulnerability	CVE-2022-29499	Mitel MiVoice Connect	Apply updates per vendor instructions.	18/07/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability	CVE-2022-30190	Microsoft Windows	Apply updates per vendor instructions.	05/07/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SAP NetWeaver SQL Injection Vulnerability	CVE-2016-2386	SAP NetWeaver	Apply updates per vendor instructions.	30/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SAP NetWeaver Information Disclosure Vulnerability	CVE-2016-2388	SAP NetWeaver	Apply updates per vendor instructions.	30/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SAP NetWeaver Unrestricted File Upload Vulnerability	CVE-2021-38163	SAP NetWeaver	Apply updates per vendor instructions.	30/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Word Malformed Object Pointer Vulnerability	CVE-2006-2492	Microsoft Word	Apply updates per vendor instructions.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Acrobat and Reader Buffer Overflow Vulnerability	CVE-2007-5659	Adobe Acrobat and Reader	Apply updates per vendor instructions.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Acrobat and Reader Unspecified Vulnerability	CVE-2008-0655	Adobe Acrobat and Reader	Apply updates per vendor instructions.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office Object Record Corruption Vulnerability	CVE-2009-0557	Microsoft Office	Apply updates per vendor instructions.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office Buffer Overflow Vulnerability	CVE-2009-0563	Microsoft Office	Apply updates per vendor instructions.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability	CVE-2009-1862	Adobe Acrobat and Reader, Flash Player	For Adobe Acrobat and Reader, apply updates per vendor instructions. For Adobe Flash Player, the impacted product is end-of-life and should be disconnected if still in use.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability	CVE-2009-3953	Adobe Acrobat and Reader	Apply updates per vendor instructions.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Acrobat and Reader Use-After-Free Vulnerability	CVE-2009-4324	Adobe Acrobat and Reader	Apply updates per vendor instructions.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Memory Corruption Vulnerability	CVE-2010-1297	Adobe Flash Player	The impacted product is end-of-life and should be disconnected if still in use.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft PowerPoint Buffer Overflow Vulnerability	CVE-2010-2572	Microsoft PowerPoint	Apply updates per vendor instructions.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability	CVE-2010-2883	Adobe Acrobat and Reader	Apply updates per vendor instructions.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Unspecified Vulnerability	CVE-2011-0609	Adobe Flash Player	The impacted product is end-of-life and should be disconnected if still in use.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability	CVE-2011-2462	Adobe Reader and Acrobat	Apply updates per vendor instructions.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Authenticode Signature Verification Remote Code Execution Vulnerability	CVE-2012-0151	Microsoft Windows	Apply updates per vendor instructions.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Memory Corruption Vulnerability	CVE-2012-0754	Adobe Flash Player	The impacted product is end-of-life and should be disconnected if still in use.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability	CVE-2012-0767	Adobe Flash Player	The impacted product is end-of-life and should be disconnected if still in use.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft XML Core Services Memory Corruption Vulnerability	CVE-2012-1889	Microsoft XML Core Services	Apply updates per vendor instructions.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Use-After-Free Vulnerability	CVE-2012-4969	Microsoft Internet Explorer	Apply updates per vendor instructions.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Integer Overflow Vulnerability	CVE-2012-5054	Adobe Flash Player	The impacted product is end-of-life and should be disconnected if still in use.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office Buffer Overflow Vulnerability	CVE-2013-1331	Microsoft Office	Apply updates per vendor instructions.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Out-of-Bounds Read Vulnerability	CVE-2016-1646	Google Chromium V8	Apply updates per vendor instructions.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Out-of-Bounds Memory Vulnerability	CVE-2016-5198	Google Chromium V8	Apply updates per vendor instructions.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Memory Corruption Vulnerability	CVE-2017-5030	Google Chromium V8	Apply updates per vendor instructions.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Type Confusion Vulnerability	CVE-2017-5070	Google Chromium V8	Apply updates per vendor instructions.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
NETGEAR Multiple Devices Buffer Overflow Vulnerability	CVE-2017-6862	NETGEAR Multiple Devices	Apply updates per vendor instructions.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Remote Code Execution Vulnerability	CVE-2018-17463	Google Chromium V8	Apply updates per vendor instructions.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Out-of-Bounds Write Vulnerability	CVE-2018-17480	Google Chromium V8	Apply updates per vendor instructions.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Acrobat and Reader Double Free Vulnerability	CVE-2018-4990	Adobe Acrobat and Reader	Apply updates per vendor instructions.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Integer Overflow Vulnerability	CVE-2018-6065	Google Chromium V8	Apply updates per vendor instructions.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability	CVE-2019-15271	Cisco RV Series Routers	Apply updates per vendor instructions.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Out-of-Bounds Write Vulnerability	CVE-2019-5825	Google Chromium V8	Apply updates per vendor instructions.	22/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
QNAP Photo Station Improper Access Control Vulnerability	CVE-2019-7192	QNAP Photo Station	Apply updates per vendor instructions.	22/06/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
QNAP QTS Improper Input Validation Vulnerability	CVE-2019-7193	QNAP QTS	Apply updates per vendor instructions.	22/06/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
QNAP Photo Station Path Traversal Vulnerability	CVE-2019-7194	QNAP Photo Station	Apply updates per vendor instructions.	22/06/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
QNAP Photo Station Path Traversal Vulnerability	CVE-2019-7195	QNAP Photo Station	Apply updates per vendor instructions.	22/06/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability	CVE-2022-26134	Atlassian Confluence Server/Data Center	Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.	06/06/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Red Hat JBoss Authentication Bypass Vulnerability	CVE-2010-0738	Red Hat JBoss	Apply updates per vendor instructions.	15/06/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle JRE Unspecified Vulnerability	CVE-2010-0840	Oracle Java Runtime Environment (JRE)	Apply updates per vendor instructions.	15/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Red Hat JBoss Information Disclosure Vulnerability	CVE-2010-1428	Red Hat JBoss	Apply updates per vendor instructions.	15/06/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle Fusion Middleware Unspecified Vulnerability	CVE-2012-1710	Oracle Fusion Middleware	Apply updates per vendor instructions.	15/06/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Silverlight Double Dereference Vulnerability	CVE-2013-0074	Microsoft Silverlight	The impacted product is end-of-life and should be disconnected if still in use.	15/06/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle JRE Remote Code Execution Vulnerability	CVE-2013-0422	Oracle Java Runtime Environment (JRE)	Apply updates per vendor instructions.	15/06/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle JRE Sandbox Bypass Vulnerability	CVE-2013-0431	Oracle Java Runtime Environment (JRE)	Apply updates per vendor instructions.	15/06/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle JRE Unspecified Vulnerability	CVE-2013-2423	Oracle Java Runtime Environment (JRE)	Apply updates per vendor instructions.	15/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Silverlight Information Disclosure Vulnerability	CVE-2013-3896	Microsoft Silverlight	The impacted product is end-of-life and should be disconnected if still in use.	15/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
IBM InfoSphere BigInsights Invalid Input Vulnerability	CVE-2013-3993	IBM InfoSphere BigInsights	The impacted product is end-of-life and should be disconnected if still in use.	15/06/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Information Disclosure Vulnerability	CVE-2013-7331	Microsoft Internet Explorer	Apply updates per vendor instructions.	15/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Reader and Acrobat Sandbox Bypass Vulnerability	CVE-2014-0546	Adobe Reader and Acrobat	Apply updates per vendor instructions.	15/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Privilege Escalation Vulnerability	CVE-2014-2817	Microsoft Internet Explorer	Apply updates per vendor instructions.	15/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Linux Kernel Privilege Escalation Vulnerability	CVE-2014-3153	Linux Kernel	Apply updates per vendor instructions.	15/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft IME Japanese Privilege Escalation Vulnerability	CVE-2014-4077	Microsoft Input Method Editor (IME) Japanese	Apply updates per vendor instructions.	15/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Privilege Escalation Vulnerability	CVE-2014-4123	Microsoft Internet Explorer	Apply updates per vendor instructions.	15/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Remote Code Execution Vulnerability	CVE-2014-4148	Microsoft Windows	Apply updates per vendor instructions.	15/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Dereferenced Pointer Vulnerability	CVE-2014-8439	Adobe Flash Player	The impacted product is end-of-life and should be disconnected if still in use.	15/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows TS WebProxy Directory Traversal Vulnerability	CVE-2015-0016	Microsoft Windows	Apply updates per vendor instructions.	15/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer ASLR Bypass Vulnerability	CVE-2015-0071	Microsoft Internet Explorer	Apply updates per vendor instructions.	15/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player ASLR Bypass Vulnerability	CVE-2015-0310	Adobe Flash Player	The impacted product is end-of-life and should be disconnected if still in use.	15/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Remote Code Execution Vulnerability	CVE-2015-1671	Microsoft Windows	Apply updates per vendor instructions.	15/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Mount Manager Privilege Escalation Vulnerability	CVE-2015-1769	Microsoft Windows	Apply updates per vendor instructions.	15/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Win32k Privilege Escalation Vulnerability	CVE-2015-2360	Microsoft Win32k	Apply updates per vendor instructions.	15/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Memory Corruption Vulnerability	CVE-2015-2425	Microsoft Internet Explorer	Apply updates per vendor instructions.	15/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Mozilla Firefox Security Feature Bypass Vulnerability	CVE-2015-4495	Mozilla Firefox	Apply updates per vendor instructions.	15/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Kernel Privilege Escalation Vulnerability	CVE-2015-6175	Microsoft Windows	Apply updates per vendor instructions.	15/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Integer Overflow Vulnerability	CVE-2015-8651	Adobe Flash Player	The impacted product is end-of-life and should be disconnected if still in use.	15/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Silverlight Runtime Remote Code Execution Vulnerability	CVE-2016-0034	Microsoft Silverlight	The impacted products are end-of-life and should be disconnected if still in use.	15/06/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player and AIR Use-After-Free Vulnerability	CVE-2016-0984	Adobe Flash Player and AIR	The impacted products are end-of-life and should be disconnected if still in use.	15/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player and AIR Integer Overflow Vulnerability	CVE-2016-1010	Adobe Flash Player and AIR	The impacted products are end-of-life and should be disconnected if still in use.	15/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution Vulnerability	CVE-2016-3393	Microsoft Windows	Apply updates per vendor instructions.	15/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Open Type Font Remote Code Execution Vulnerability	CVE-2016-7256	Microsoft Windows	Apply updates per vendor instructions.	15/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle Solaris Privilege Escalation Vulnerability	CVE-2019-3010	Oracle Solaris	Apply updates per vendor instructions.	15/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Information Disclosure Vulnerability	CVE-2016-0162	Microsoft Internet Explorer	Apply updates per vendor instructions.	14/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Messaging API Information Disclosure Vulnerability	CVE-2016-3298	Microsoft Internet Explorer	Apply updates per vendor instructions.	14/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer and Edge Information Disclosure Vulnerability	CVE-2016-3351	Microsoft Internet Explorer and Edge	Apply updates per vendor instructions.	14/06/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS Information Disclosure Vulnerability	CVE-2016-4655	Apple iOS	Apply updates per vendor instructions.	14/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS Memory Corruption Vulnerability	CVE-2016-4656	Apple iOS	Apply updates per vendor instructions.	14/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS Webkit Memory Corruption Vulnerability	CVE-2016-4657	Apple iOS	Apply updates per vendor instructions.	14/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability	CVE-2016-6366	Cisco Adaptive Security Appliance (ASA)	Apply updates per vendor instructions.	14/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability	CVE-2016-6367	Cisco Adaptive Security Appliance (ASA)	Apply updates per vendor instructions.	14/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation Vulnerability	CVE-2017-0005	Microsoft Windows	Apply updates per vendor instructions.	14/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft XML Core Services Information Disclosure Vulnerability	CVE-2017-0022	Microsoft XML Core Services	Apply updates per vendor instructions.	14/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows SMBv1 Information Disclosure Vulnerability	CVE-2017-0147	Microsoft SMBv1 server	Apply updates per vendor instructions.	14/06/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Memory Corruption Vulnerability	CVE-2017-0149	Microsoft Internet Explorer	Apply updates per vendor instructions.	14/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Privilege Escalation Vulnerability	CVE-2017-0210	Microsoft Internet Explorer	Apply updates per vendor instructions.	14/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Kaseya VSA SQL Injection Vulnerability	CVE-2017-18362	Kaseya Virtual System/Server Administrator (VSA)	The impacted product is end-of-life and should be disconnected if still in use.	14/06/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Artifex Ghostscript Type Confusion Vulnerability	CVE-2017-8291	Artifex Ghostscript	Apply updates per vendor instructions.	14/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Search Remote Code Execution Vulnerability	CVE-2017-8543	Microsoft Windows	Apply updates per vendor instructions.	14/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
QNAP NAS File Station Cross-Site Scripting Vulnerability	CVE-2018-19943	QNAP Network Attached Storage (NAS)	Apply updates per vendor instructions.	14/06/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
QNAP NAS File Station Command Injection Vulnerability	CVE-2018-19949	QNAP Network Attached Storage (NAS)	Apply updates per vendor instructions.	14/06/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
QNAP NAS File Station Cross-Site Scripting Vulnerability	CVE-2018-19953	QNAP Network Attached Storage (NAS)	Apply updates per vendor instructions.	14/06/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Kernel Privilege Escalation Vulnerability	CVE-2018-8611	Microsoft Windows	Apply updates per vendor instructions.	14/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Stack-based Buffer Overflow Vulnerability	CVE-2018-5002	Adobe Flash Player	The impacted product is end-of-life and should be disconnected if still in use.	13/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Win32k Privilege Escalation Vulnerability	CVE-2018-8589	Microsoft Win32k	Apply updates per vendor instructions.	13/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Information Disclosure Vulnerability	CVE-2019-0676	Microsoft Internet Explorer	Apply updates per vendor instructions.	13/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows SMB Information Disclosure Vulnerability	CVE-2019-0703	Microsoft Windows	Apply updates per vendor instructions.	13/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Privilege Escalation Vulnerability	CVE-2019-0880	Microsoft Windows	Apply updates per vendor instructions.	13/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability	CVE-2019-1130	Microsoft Windows	Apply updates per vendor instructions.	13/06/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Mozilla Firefox and Thunderbird Type Confusion Vulnerability	CVE-2019-11707	Mozilla Firefox and Thunderbird	Apply updates per vendor instructions.	13/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability	CVE-2019-11708	Mozilla Firefox and Thunderbird	Apply updates per vendor instructions.	13/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chrome WebAudio Use-After-Free Vulnerability	CVE-2019-13720	Google Chrome WebAudio	Apply updates per vendor instructions.	13/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability	CVE-2019-1385	Microsoft Windows	Apply updates per vendor instructions.	13/06/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
WhatsApp Cross-Site Scripting Vulnerability	CVE-2019-18426	Meta Platforms WhatsApp	Apply updates per vendor instructions.	13/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chrome Blink Use-After-Free Vulnerability	CVE-2019-5786	Google Chrome Blink	Apply updates per vendor instructions.	13/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Memory Corruption Vulnerability	CVE-2019-7286	Apple Multiple Products	Apply updates per vendor instructions.	13/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS Memory Corruption Vulnerability	CVE-2019-7287	Apple iOS	Apply updates per vendor instructions.	13/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
WebKitGTK Memory Corruption Vulnerability	CVE-2019-8720	WebKitGTK WebKitGTK	Apply updates per vendor instructions.	13/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Update Notification Manager Privilege Escalation Vulnerability	CVE-2020-0638	Microsoft Update Notification Manager	Apply updates per vendor instructions.	13/06/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Kernel Privilege Escalation Vulnerability	CVE-2020-1027	Microsoft Windows	Apply updates per vendor instructions.	13/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Android Kernel Race Condition Vulnerability	CVE-2021-0920	Android Kernel	Apply updates per vendor instructions.	13/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Android Kernel Use-After-Free Vulnerability	CVE-2021-1048	Android Kernel	Apply updates per vendor instructions.	13/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Memory Corruption Vulnerability	CVE-2021-30883	Apple Multiple Products	Apply updates per vendor instructions.	13/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS XR Open Port Vulnerability	CVE-2022-20821	Cisco IOS XR	Apply updates per vendor instructions.	13/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
VMware Spring Cloud Gateway Code Injection Vulnerability	CVE-2022-22947	VMware Spring Cloud Gateway	Apply updates per vendor instructions.	06/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Zyxel Multiple Firewalls OS Command Injection Vulnerability	CVE-2022-30525	Zyxel Multiple Firewalls	Apply updates per vendor instructions.	06/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
F5 BIG-IP Missing Authentication Vulnerability	CVE-2022-1388	F5 BIG-IP	Apply updates per vendor instructions.	31/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
OpenSSL Information Disclosure Vulnerability	CVE-2014-0160	OpenSSL OpenSSL	Apply updates per vendor instructions.	25/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Use-After-Free Vulnerability	CVE-2014-0322	Microsoft Internet Explorer	Apply updates per vendor instructions.	25/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Win32k Privilege Escalation Vulnerability	CVE-2014-4113	Microsoft Win32k	Apply updates per vendor instructions.	25/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Type Confusion Vulnerability	CVE-2019-8506	Apple Multiple Products	Apply updates per vendor instructions.	25/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Type Confusion Vulnerability	CVE-2021-1789	Apple Multiple Products	Apply updates per vendor instructions.	25/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Jenkins Script Security Plugin Sandbox Bypass Vulnerability	CVE-2019-1003029	Jenkins Script Security Plugin	Apply updates per vendor instructions.	16/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Win32k Privilege Escalation Vulnerability	CVE-2021-40450	Microsoft Win32k	Apply updates per vendor instructions.	16/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Win32k Privilege Escalation Vulnerability	CVE-2021-41357	Microsoft Win32k	Apply updates per vendor instructions.	16/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Linux Kernel Privilege Escalation Vulnerability	CVE-2022-0847	Linux Kernel	Apply updates per vendor instructions.	16/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows User Profile Service Privilege Escalation Vulnerability	CVE-2022-21919	Microsoft Windows	Apply updates per vendor instructions.	16/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows User Profile Service Privilege Escalation Vulnerability	CVE-2022-26904	Microsoft Windows	Apply updates per vendor instructions.	16/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
WSO2 Multiple Products Unrestrictive Upload of File Vulnerability	CVE-2022-29464	WSO2 Multiple Products	Apply updates per vendor instructions.	16/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability	CVE-2018-6882	Synacor Zimbra Collaboration Suite (ZCS)	Apply updates per vendor instructions.	10/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
WhatsApp VOIP Stack Buffer Overflow Vulnerability	CVE-2019-3568	Meta Platforms WhatsApp	Apply updates per vendor instructions.	10/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Print Spooler Privilege Escalation Vulnerability	CVE-2022-22718	Microsoft Windows	Apply updates per vendor instructions.	10/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability	CVE-2007-3010	Alcatel OmniPCX Enterprise	Apply updates per vendor instructions.	06/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ubiquiti AirOS Command Injection Vulnerability	CVE-2010-5330	Ubiquiti AirOS	Apply updates per vendor instructions.	06/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
InduSoft Web Studio NTWebServer Directory Traversal Vulnerability	CVE-2014-0780	InduSoft Web Studio	Apply updates per vendor instructions.	06/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Trihedral VTScada (formerly VTS) Denial-of-Service Vulnerability	CVE-2016-4523	Trihedral VTScada (formerly VTS)	Apply updates per vendor instructions.	06/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Schneider Electric U.motion Builder SQL Injection Vulnerability	CVE-2018-7841	Schneider Electric U.motion Builder	The impacted product is end-of-life and should be disconnected if still in use.	06/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
D-Link DNS-320 Remote Code Execution Vulnerability	CVE-2019-16057	D-Link DNS-320 Storage Device	The impacted product is end-of-life and should be disconnected if still in use.	06/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Crestron Multiple Products Command Injection Vulnerability	CVE-2019-3929	Crestron Multiple Products	Apply updates per vendor instructions.	06/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Type Confusion Vulnerability	CVE-2022-1364	Google Chromium V8	Apply updates per vendor instructions.	06/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
VMware Multiple Products Privilege Escalation Vulnerability	CVE-2022-22960	VMware Multiple Products	Apply updates per vendor instructions.	06/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability	CVE-2022-22954	VMware Workspace ONE Access and Identity Manager	Apply updates per vendor instructions.	05/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Stack-Based Buffer Overflow Vulnerability	CVE-2014-9163	Adobe Flash Player	The impacted product is end-of-life and should be disconnected if still in use.	04/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Remote Code Execution Vulnerability	CVE-2015-0311	Adobe Flash Player	The impacted product is end-of-life and should be disconnected if still in use.	04/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Use-After-Free Vulnerability	CVE-2015-0313	Adobe Flash Player	The impacted product is end-of-life and should be disconnected if still in use.	04/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Memory Corruption Vulnerability	CVE-2015-2502	Microsoft Internet Explorer	Apply updates per vendor instructions.	04/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Heap-Based Buffer Overflow Vulnerability	CVE-2015-3113	Adobe Flash Player	The impacted product is end-of-life and should be disconnected if still in use.	04/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Use-After-Free Vulnerability	CVE-2015-5122	Adobe Flash Player	The impacted product is end-of-life and should be disconnected if still in use.	04/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Use-After-Free Vulnerability	CVE-2015-5123	Adobe Flash Player	The impacted product is end-of-life and should be disconnected if still in use.	04/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Kaseya VSA Remote Code Execution Vulnerability	CVE-2018-20753	Kaseya Virtual System/Server Administrator (VSA)	Apply updates per vendor instructions.	04/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Drupal Core Remote Code Execution Vulnerability	CVE-2018-7602	Drupal Core	Apply updates per vendor instructions.	04/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows CLFS Driver Privilege Escalation Vulnerability	CVE-2022-24521	Microsoft Windows	Apply updates per vendor instructions.	04/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability	CVE-2017-11317	Telerik User Interface (UI) for ASP.NET AJAX	Apply updates per vendor instructions.	02/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
QNAP Network-Attached Storage (NAS) Command Injection Vulnerability	CVE-2020-2509	QNAP QNAP Network-Attached Storage (NAS)	Apply updates per vendor instructions.	02/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Linux Kernel Privilege Escalation Vulnerability	CVE-2021-22600	Linux Kernel	Apply updates per vendor instructions.	02/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Checkbox Survey Deserialization of Untrusted Data Vulnerability	CVE-2021-27852	Checkbox Checkbox Survey	Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.	02/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Pixel Out-of-Bounds Write Vulnerability	CVE-2021-39793	Google Pixel	Apply updates per vendor instructions.	02/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability	CVE-2021-42278	Microsoft Active Directory	Apply updates per vendor instructions.	02/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability	CVE-2021-42287	Microsoft Active Directory	Apply updates per vendor instructions.	02/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
WatchGuard Firebox and XTM Privilege Escalation Vulnerability	CVE-2022-23176	WatchGuard Firebox and XTM	Apply updates per vendor instructions.	02/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft SMBv1 Server Remote Code Execution Vulnerability	CVE-2017-0148	Microsoft SMBv1 server	Apply updates per vendor instructions.	27/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability	CVE-2021-31166	Microsoft HTTP Protocol Stack	Apply updates per vendor instructions.	27/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Sudo Heap-Based Buffer Overflow Vulnerability	CVE-2021-3156	Sudo Sudo	Apply updates per vendor instructions.	27/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
D-Link Multiple Routers Remote Code Execution Vulnerability	CVE-2021-45382	D-Link Multiple Routers	The impacted product is end-of-life and should be disconnected if still in use.	25/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple macOS Out-of-Bounds Read Vulnerability	CVE-2022-22674	Apple macOS	Apply updates per vendor instructions.	25/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple macOS Out-of-Bounds Write Vulnerability	CVE-2022-22675	Apple macOS	Apply updates per vendor instructions.	25/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Spring Framework JDK 9+ Remote Code Execution Vulnerability	CVE-2022-22965	VMware Spring Framework	Apply updates per vendor instructions.	25/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Dasan GPON Routers Authentication Bypass Vulnerability	CVE-2018-10561	Dasan Gigabit Passive Optical Network (GPON) Routers	The impacted product is end-of-life and should be disconnected if still in use.	21/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Dasan GPON Routers Command Injection Vulnerability	CVE-2018-10562	Dasan Gigabit Passive Optical Network (GPON) Routers	The impacted product is end-of-life and should be disconnected if still in use.	21/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Dell dbutil Driver Insufficient Access Control Vulnerability	CVE-2021-21551	Dell dbutil Driver	Apply updates per vendor instructions.	21/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
QNAP NAS Improper Authorization Vulnerability	CVE-2021-28799	QNAP Network Attached Storage (NAS)	Apply updates per vendor instructions.	21/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows User Profile Service Privilege Escalation Vulnerability	CVE-2021-34484	Microsoft Windows	Apply updates per vendor instructions.	21/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Sophos Firewall Authentication Bypass Vulnerability	CVE-2022-1040	Sophos Firewall	Apply updates per vendor instructions.	21/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Trend Micro Apex Central Arbitrary File Upload Vulnerability	CVE-2022-26871	Trend Micro Apex Central	Apply updates per vendor instructions.	21/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability	CVE-2010-4398	Microsoft Windows	Apply updates per vendor instructions.	21/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Vulnerability	CVE-2011-2005	Microsoft Ancillary Function Driver (afd.sys)	Apply updates per vendor instructions.	18/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle Fusion Middleware Unspecified Vulnerability	CVE-2012-0518	Oracle Fusion Middleware	Apply updates per vendor instructions.	18/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Memory Corruption Vulnerability	CVE-2012-2034	Adobe Flash Player	The impacted product is end-of-life and should be disconnected if still in use.	18/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Word Remote Code Execution Vulnerability	CVE-2012-2539	Microsoft Word	Apply updates per vendor instructions.	18/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle Java SE Sandbox Bypass Vulnerability	CVE-2012-5076	Oracle Java SE	Apply updates per vendor instructions.	18/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability	CVE-2013-1690	Mozilla Firefox and Thunderbird	Apply updates per vendor instructions.	18/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle Java SE Unspecified Vulnerability	CVE-2013-2465	Oracle Java SE	Apply updates per vendor instructions.	18/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Use-After-Free Vulnerability	CVE-2013-2551	Microsoft Internet Explorer	Apply updates per vendor instructions.	18/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability	CVE-2013-2729	Adobe Reader and Acrobat	Apply updates per vendor instructions.	18/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Win32k Privilege Escalation Vulnerability	CVE-2013-3660	Microsoft Win32k	Apply updates per vendor instructions.	18/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office Uninitialized Memory Use Vulnerability	CVE-2015-1770	Microsoft Office	Apply updates per vendor instructions.	18/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Memory Corruption Vulnerability	CVE-2015-2419	Microsoft Internet Explorer	Apply updates per vendor instructions.	18/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Adobe Type Manager Library Remote Code Execution Vulnerability	CVE-2015-2426	Microsoft Windows	Apply updates per vendor instructions.	18/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Kernel Privilege Escalation Vulnerability	CVE-2016-0040	Microsoft Windows	Apply updates per vendor instructions.	18/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows CSRSS Security Feature Bypass Vulnerability	CVE-2016-0151	Microsoft Client-Server Run-time Subsystem (CSRSS)	Apply updates per vendor instructions.	18/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Memory Corruption Vulnerability	CVE-2016-0189	Microsoft Internet Explorer	Apply updates per vendor instructions.	18/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Edge Memory Corruption Vulnerability	CVE-2016-7200	Microsoft Edge	Apply updates per vendor instructions.	18/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Edge Memory Corruption Vulnerability	CVE-2016-7201	Microsoft Edge	Apply updates per vendor instructions.	18/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Edge and Internet Explorer Type Confusion Vulnerability	CVE-2017-0037	Microsoft Edge and Internet Explorer	Apply updates per vendor instructions.	18/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Information Disclosure Vulnerability	CVE-2017-0059	Microsoft Internet Explorer	Apply updates per vendor instructions.	18/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Privilege Escalation Vulnerability	CVE-2017-0213	Microsoft Windows	Apply updates per vendor instructions.	18/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability	CVE-2018-8405	Microsoft DirectX Graphics Kernel (DXGKRNL)	Apply updates per vendor instructions.	18/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability	CVE-2018-8406	Microsoft DirectX Graphics Kernel (DXGKRNL)	Apply updates per vendor instructions.	18/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Privilege Escalation Vulnerability	CVE-2018-8440	Microsoft Windows	Apply updates per vendor instructions.	18/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SonicWall SMA100 Directory Traversal Vulnerability	CVE-2019-7483	SonicWall SMA100	Apply updates per vendor instructions.	18/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability	CVE-2021-20028	SonicWall Secure Remote Access (SRA)	The impacted product is end-of-life and should be disconnected if still in use.	18/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability	CVE-2021-26085	Atlassian Confluence Server	Apply updates per vendor instructions.	18/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Event Tracing Privilege Escalation Vulnerability	CVE-2021-34486	Microsoft Windows	Apply updates per vendor instructions.	18/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability	CVE-2021-38646	Microsoft Office	Apply updates per vendor instructions.	18/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Debian-specific Redis Server Lua Sandbox Escape Vulnerability	CVE-2022-0543	Redis Debian-specific Redis Servers	Apply updates per vendor instructions.	18/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Type Confusion Vulnerability	CVE-2022-1096	Google Chromium V8	Apply updates per vendor instructions.	18/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
HP OpenView Network Node Manager Remote Code Execution Vulnerability	CVE-2005-2773	Hewlett Packard (HP) OpenView Network Node Manager	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability	CVE-2009-0927	Adobe Reader and Acrobat	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
phpMyAdmin Remote Code Execution Vulnerability	CVE-2009-1151	phpMyAdmin phpMyAdmin	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability	CVE-2009-2055	Cisco IOS XR	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe ColdFusion Directory Traversal Vulnerability	CVE-2010-2861	Adobe ColdFusion	Apply updates per vendor instructions.	15/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability	CVE-2010-3035	Cisco IOS XR	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Exim Heap-Based Buffer Overflow Vulnerability	CVE-2010-4344	Exim Exim	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Exim Privilege Escalation Vulnerability	CVE-2010-4345	Exim Exim	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
PHP-CGI Query String Parameter Vulnerability	CVE-2012-1823	PHP PHP	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache Struts Improper Input Validation Vulnerability	CVE-2013-2251	Apache Struts	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
HP Multiple Products Remote Code Execution Vulnerability	CVE-2013-4810	Hewlett Packard (HP) ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability	CVE-2013-5223	D-Link DSL-2760U	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ruby on Rails Directory Traversal Vulnerability	CVE-2014-0130	Rails Ruby on Rails	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Elasticsearch Remote Code Execution Vulnerability	CVE-2014-3120	Elastic Elasticsearch	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability	CVE-2014-6287	Rejetto HTTP File Server (HFS)	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability	CVE-2014-6324	Microsoft Kerberos Key Distribution Center (KDC)	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability	CVE-2014-6332	Microsoft Windows	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Prime Data Center Network Manager (DCNM) Directory Traversal Vulnerability	CVE-2015-0666	Cisco Prime Data Center Network Manager (DCNM)	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
D-Link and TRENDnet Multiple Devices Remote Code Execution Vulnerability	CVE-2015-1187	D-Link and TRENDnet Multiple Devices	The impacted product is end-of-life and should be disconnected if still in use.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability	CVE-2015-1427	Elastic Elasticsearch	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
TP-Link Multiple Archer Devices Directory Traversal Vulnerability	CVE-2015-3035	TP-Link Multiple Archer Devices	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Arcserve Unified Data Protection (UDP) Directory Traversal Vulnerability	CVE-2015-4068	Arcserve Unified Data Protection (UDP)	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ruby on Rails Directory Traversal Vulnerability	CVE-2016-0752	Rails Ruby on Rails	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability	CVE-2016-10174	NETGEAR WNR2000v5 Router	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
D-Link DCS-930L Devices OS Command Injection Vulnerability	CVE-2016-11021	D-Link DCS-930L Devices	The impacted product is end-of-life and should be disconnected if still in use.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
NETGEAR Multiple WAP Devices Command Injection Vulnerability	CVE-2016-1555	NETGEAR Wireless Access Point (WAP) Devices	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Remote Code Execution Vulnerability	CVE-2016-4171	Adobe Flash Player	The impacted product is end-of-life and should be disconnected if still in use.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Use-After-Free Vulnerability	CVE-2016-7892	Adobe Flash Player	The impacted product is end-of-life and should be disconnected if still in use.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows SMB Remote Code Execution Vulnerability	CVE-2017-0146	Microsoft Windows	Apply updates per vendor instructions.	15/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache Tomcat on Windows Remote Code Execution Vulnerability	CVE-2017-12615	Apache Tomcat	Apply updates per vendor instructions.	15/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache Tomcat Remote Code Execution Vulnerability	CVE-2017-12617	Apache Tomcat	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS and IOS XE Remote Code Execution Vulnerability	CVE-2017-3881	Cisco IOS and IOS XE	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Citrix Multiple Products Remote Code Execution Vulnerability	CVE-2017-6316	Citrix NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
NETGEAR DGN2200 Devices OS Command Injection Vulnerability	CVE-2017-6334	NETGEAR DGN2200 Devices	The impacted product is end-of-life and should be disconnected if still in use.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco VPN Routers Remote Code Execution Vulnerability	CVE-2018-0125	Cisco VPN Routers	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Secure Access Control System Java Deserialization Vulnerability	CVE-2018-0147	Cisco Secure Access Control System (ACS)	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Quest KACE System Management Appliance Remote Command Execution Vulnerability	CVE-2018-11138	Quest KACE System Management Appliance	Apply updates per vendor instructions.	15/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
VMware Tanzu Spring Data Commons Property Binder Vulnerability	CVE-2018-1273	VMware Tanzu Spring Data Commons	Apply updates per vendor instructions.	15/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
LG N1A1 NAS Remote Command Execution Vulnerability	CVE-2018-14839	LG N1A1 NAS	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability	CVE-2018-6961	VMware SD-WAN Edge	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Scripting Engine Memory Corruption Vulnerability	CVE-2018-8373	Microsoft Internet Explorer Scripting Engine	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Shell Remote Code Execution Vulnerability	CVE-2018-8414	Microsoft Windows	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft GDI Remote Code Execution Vulnerability	CVE-2019-0903	Microsoft Graphics Device Interface (GDI)	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Jenkins Matrix Project Plugin Remote Code Execution Vulnerability	CVE-2019-1003030	Jenkins Matrix Project Plugin	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Kentico Xperience Deserialization of Untrusted Data Vulnerability	CVE-2019-10068	Kentico Xperience	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability	CVE-2019-11043	PHP FastCGI Process Manager (FPM)	Apply updates per vendor instructions.	15/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Citrix SD-WAN and NetScaler SQL Injection Vulnerability	CVE-2019-12989	Citrix SD-WAN and NetScaler	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Citrix SD-WAN and NetScaler Command Injection Vulnerability	CVE-2019-12991	Citrix SD-WAN and NetScaler	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Webmin Command Injection Vulnerability	CVE-2019-15107	Webmin Webmin	Apply updates per vendor instructions.	15/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
D-Link Multiple Routers Command Injection Vulnerability	CVE-2019-16920	D-Link Multiple Routers	The impacted product is end-of-life and should be disconnected if still in use.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle BI Publisher Unauthorized Access Vulnerability	CVE-2019-2616	Oracle BI Publisher (Formerly XML Publisher)	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Drupal Core Remote Code Execution Vulnerability	CVE-2019-6340	Drupal Core	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Juniper Junos OS Path Traversal Vulnerability	CVE-2020-1631	Juniper Junos OS	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache Kylin OS Command Injection Vulnerability	CVE-2020-1956	Apache Kylin	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability	CVE-2020-2021	Palo Alto Networks PAN-OS	Apply updates per vendor instructions.	15/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
QNAP Helpdesk Improper Access Control Vulnerability	CVE-2020-2506	QNAP Systems Helpdesk	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Sophos SG UTM Remote Code Execution Vulnerability	CVE-2020-25223	Sophos SG UTM	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability	CVE-2020-5410	VMware Tanzu Spring Cloud Configuration (Config) Server	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
OpenSMTPD Remote Code Execution Vulnerability	CVE-2020-7247	OpenBSD OpenSMTPD	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Zyxel Multiple NAS Devices OS Command Injection Vulnerability	CVE-2020-9054	Zyxel Multiple Network-Attached Storage (NAS) Devices	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
D-Link DIR-610 Devices Remote Command Execution	CVE-2020-9377	D-Link DIR-610 Devices	The impacted product is end-of-life and should be disconnected if still in use.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Citrix ShareFile Improper Access Control Vulnerability	CVE-2021-22941	Citrix ShareFile	Apply updates per vendor instructions.	15/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Sitecore XP Remote Command Execution Vulnerability	CVE-2021-42237	Sitecore XP	Apply updates per vendor instructions.	15/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Print Spooler Privilege Escalation Vulnerability	CVE-2022-21999	Microsoft Windows	Apply updates per vendor instructions.	15/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
MiCollab, MiVoice Business Express Access Control Vulnerability	CVE-2022-26143	Mitel MiCollab, MiVoice Business Express	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
WatchGuard Firebox and XTM Appliances Arbitrary Code Execution	CVE-2022-26318	WatchGuard Firebox and XTM Appliances	Apply updates per vendor instructions.	15/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Win32k Memory Corruption Vulnerability	CVE-2015-2546	Microsoft Win32k	Apply updates per vendor instructions.	05/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Kernel Privilege Escalation Vulnerability	CVE-2016-3309	Microsoft Windows	Apply updates per vendor instructions.	05/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Transaction Manager Privilege Escalation Vulnerability	CVE-2017-0101	Microsoft Windows	Apply updates per vendor instructions.	05/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Win32k Privilege Escalation Vulnerability	CVE-2018-8120	Microsoft Win32k	Apply updates per vendor instructions.	05/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Privilege Escalation Vulnerability	CVE-2019-0543	Microsoft Windows	Apply updates per vendor instructions.	05/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability	CVE-2019-0841	Microsoft Windows	Apply updates per vendor instructions.	05/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability	CVE-2019-1064	Microsoft Windows	Apply updates per vendor instructions.	05/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Task Scheduler Privilege Escalation Vulnerability	CVE-2019-1069	Microsoft Task Scheduler	Apply updates per vendor instructions.	05/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability	CVE-2019-1129	Microsoft Windows	Apply updates per vendor instructions.	05/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Win32k Privilege Escalation Vulnerability	CVE-2019-1132	Microsoft Win32k	Apply updates per vendor instructions.	05/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability	CVE-2019-1253	Microsoft Windows	Apply updates per vendor instructions.	05/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Error Reporting Manager Privilege Escalation Vulnerability	CVE-2019-1315	Microsoft Windows	Apply updates per vendor instructions.	05/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Privilege Escalation Vulnerability	CVE-2019-1322	Microsoft Windows	Apply updates per vendor instructions.	05/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability	CVE-2019-1405	Microsoft Windows	Apply updates per vendor instructions.	05/04/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SonicWall SonicOS Buffer Overflow Vulnerability	CVE-2020-5135	SonicWall SonicOS	Apply updates per vendor instructions.	05/04/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe BlazeDS Information Disclosure Vulnerability	CVE-2009-3960	Adobe BlazeDS	Apply updates per vendor instructions.	07/09/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe ColdFusion Authentication Bypass Vulnerability	CVE-2013-0625	Adobe ColdFusion	Apply updates per vendor instructions.	07/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe ColdFusion Directory Traversal Vulnerability	CVE-2013-0629	Adobe ColdFusion	Apply updates per vendor instructions.	07/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe ColdFusion Information Disclosure Vulnerability	CVE-2013-0631	Adobe ColdFusion	Apply updates per vendor instructions.	07/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
NETGEAR Multiple Routers Remote Code Execution Vulnerability	CVE-2016-6277	NETGEAR Multiple Routers	Apply updates per vendor instructions.	07/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
NETGEAR DGN2200 Remote Code Execution Vulnerability	CVE-2017-6077	NETGEAR Wireless Router DGN2200	Apply updates per vendor instructions.	07/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability	CVE-2019-11581	Atlassian Jira Server and Data Center	Apply updates per vendor instructions.	07/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Pulse Connect Secure Code Injection Vulnerability	CVE-2020-8218	Pulse Secure Pulse Connect Secure	Apply updates per vendor instructions.	07/09/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability	CVE-2021-21973	VMware vCenter Server and Cloud Foundation	Apply updates per vendor instructions.	21/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Mozilla Firefox Use-After-Free Vulnerability	CVE-2022-26485	Mozilla Firefox	Apply updates per vendor instructions.	21/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Mozilla Firefox Use-After-Free Vulnerability	CVE-2022-26486	Mozilla Firefox	Apply updates per vendor instructions.	21/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Privilege Escalation Vulnerability	CVE-2002-0367	Microsoft Windows	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Privilege Escalation Vulnerability	CVE-2004-0210	Microsoft Windows	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Reader and Acrobat Input Validation Vulnerability	CVE-2008-2992	Adobe Acrobat and Reader	Apply updates per vendor instructions.	24/03/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle VirtualBox Insufficient Input Validation Vulnerability	CVE-2008-3431	Oracle VirtualBox	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Improper Input Validation Vulnerability	CVE-2009-1123	Microsoft Windows	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Excel Featheader Record Memory Corruption Vulnerability	CVE-2009-3129	Microsoft Excel	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability	CVE-2010-0188	Adobe Reader and Acrobat	Apply updates per vendor instructions.	24/03/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Kernel Exception Handler Vulnerability	CVE-2010-0232	Microsoft Windows	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office Stack-based Buffer Overflow Vulnerability	CVE-2010-3333	Microsoft Office	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Remote Code Execution Vulnerability	CVE-2011-0611	Adobe Flash Player	The impacted product is end-of-life and should be disconnected if still in use.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Forefront TMG Remote Code Execution Vulnerability	CVE-2011-1889	Microsoft Forefront Threat Management Gateway (TMG)	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability	CVE-2011-3544	Oracle Java SE JDK and JRE	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability	CVE-2012-0507	Oracle Java SE	Apply updates per vendor instructions.	24/03/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Arbitrary Code Execution Vulnerability	CVE-2012-1535	Adobe Flash Player	The impacted product is end-of-life and should be disconnected if still in use.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability	CVE-2012-1723	Oracle Java SE	Apply updates per vendor instructions.	24/03/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability	CVE-2012-1856	Microsoft Office	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability	CVE-2012-4681	Oracle Java SE	Apply updates per vendor instructions.	24/03/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe ColdFusion Authentication Bypass Vulnerability	CVE-2013-0632	Adobe ColdFusion	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Reader and Acrobat Memory Corruption Vulnerability	CVE-2013-0640	Adobe Reader and Acrobat	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Reader Buffer Overflow Vulnerability	CVE-2013-0641	Adobe Reader	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Remote Code Execution Vulnerability	CVE-2013-1347	Microsoft Internet Explorer	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Mozilla Firefox Information Disclosure Vulnerability	CVE-2013-1675	Mozilla Firefox	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Reader and Acrobat Memory Corruption Vulnerability	CVE-2013-3346	Adobe Reader and Acrobat	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Use-After-Free Vulnerability	CVE-2013-3897	Microsoft Internet Explorer	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Kernel Privilege Escalation Vulnerability	CVE-2013-5065	Microsoft Windows	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Reader and Acrobat Use-After-Free Vulnerability	CVE-2014-0496	Adobe Reader and Acrobat	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability	CVE-2014-4114	Microsoft Windows	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office Memory Corruption Vulnerability	CVE-2015-1642	Microsoft Office	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Win32k Privilege Escalation Vulnerability	CVE-2015-1701	Microsoft Win32k	Apply updates per vendor instructions.	24/03/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft ATM Font Driver Privilege Escalation Vulnerability	CVE-2015-2387	Microsoft ATM Font Driver	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft PowerPoint Memory Corruption Vulnerability	CVE-2015-2424	Microsoft PowerPoint	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office Malformed EPS File Vulnerability	CVE-2015-2545	Microsoft Office	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability	CVE-2015-2590	Oracle Java SE	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Memory Corruption Vulnerability	CVE-2015-3043	Adobe Flash Player	The impacted product is end-of-life and should be disconnected if still in use.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle Java SE Integrity Check Vulnerability	CVE-2015-4902	Oracle Java SE	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Use-After-Free Vulnerability	CVE-2015-5119	Adobe Flash Player	The impacted product is end-of-life and should be disconnected if still in use.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Arbitrary Code Execution Vulnerability	CVE-2015-7645	Adobe Flash Player	The impacted product is end-of-life and should be disconnected if still in use.	24/03/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability	CVE-2016-0099	Microsoft Windows	Apply updates per vendor instructions.	24/03/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Arbitrary Code Execution Vulnerability	CVE-2016-1019	Adobe Flash Player	The impacted product is end-of-life and should be disconnected if still in use.	24/03/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Arbitrary Code Execution Vulnerability	CVE-2016-4117	Adobe Flash Player	The impacted product is end-of-life and should be disconnected if still in use.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Linux Kernel Race Condition Vulnerability	CVE-2016-5195	Linux Kernel	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office Memory Corruption Vulnerability	CVE-2016-7193	Microsoft Office	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office Security Feature Bypass Vulnerability	CVE-2016-7262	Microsoft Excel	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Use-After-Free Vulnerability	CVE-2016-7855	Adobe Flash Player	The impacted product is end-of-life and should be disconnected if still in use.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability	CVE-2016-8562	Siemens SIMATIC CP	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Graphics Device Interface (GDI) Privilege Escalation Vulnerability	CVE-2017-0001	Microsoft Graphics Device Interface (GDI)	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office Use-After-Free Vulnerability	CVE-2017-0261	Microsoft Office	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Type Confusion Vulnerability	CVE-2017-11292	Adobe Flash Player	The impacted product is end-of-life and should be disconnected if still in use.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office Remote Code Execution Vulnerability	CVE-2017-11826	Microsoft Office	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS Software Network Address Translation Denial-of-Service Vulnerability	CVE-2017-12231	Cisco IOS software	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS Software for Cisco Integrated Services Routers Denial-of-Service Vulnerability	CVE-2017-12232	Cisco IOS software	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability	CVE-2017-12233	Cisco IOS software	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability	CVE-2017-12234	Cisco IOS software	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS Software for Cisco Industrial Ethernet Switches PROFINET Denial-of-Service Vulnerability	CVE-2017-12235	Cisco IOS software	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability	CVE-2017-12237	Cisco IOS and IOS XE Software	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Catalyst 6800 Series Switches VPLS Denial-of-Service Vulnerability	CVE-2017-12238	Cisco Catalyst 6800 Series Switches	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability	CVE-2017-12240	Cisco IOS and IOS XE Software	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service Vulnerability	CVE-2017-12319	Cisco IOS XE Software	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS Software and Cisco IOS XE Software UDP Packet Processing Denial-of-Service Vulnerability	CVE-2017-6627	Cisco IOS and IOS XE Software	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS Software and Cisco IOS XE Software Denial-of-Service Vulnerability	CVE-2017-6663	Cisco IOS and IOS XE Software	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability	CVE-2017-6736	Cisco IOS and IOS XE Software	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability	CVE-2017-6737	Cisco IOS and IOS XE Software	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability	CVE-2017-6738	Cisco IOS and IOS XE Software	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability	CVE-2017-6739	Cisco IOS and IOS XE Software	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability	CVE-2017-6740	Cisco IOS and IOS XE Software	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability	CVE-2017-6743	Cisco IOS and IOS XE Software	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS Software SNMP Remote Code Execution Vulnerability	CVE-2017-6744	Cisco IOS software	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability	CVE-2017-8540	Microsoft Malware Protection Engine	Apply updates per vendor instructions.	24/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Vulnerability	CVE-2018-0151	Cisco IOS and IOS XE Software	Apply updates per vendor instructions.	17/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS Software Integrated Services Module for VPN Denial-of-Service Vulnerability	CVE-2018-0154	Cisco IOS Software	Apply updates per vendor instructions.	17/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability	CVE-2018-0155	Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches	Apply updates per vendor instructions.	17/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability	CVE-2018-0156	Cisco IOS Software and Cisco IOS XE Software	Apply updates per vendor instructions.	17/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS and XE Software Internet Key Exchange Memory Leak Vulnerability	CVE-2018-0158	Cisco IOS Software and Cisco IOS XE Software	Apply updates per vendor instructions.	17/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability	CVE-2018-0159	Cisco IOS Software and Cisco IOS XE Software	Apply updates per vendor instructions.	17/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS Software Resource Management Errors Vulnerability	CVE-2018-0161	Cisco IOS Software	Apply updates per vendor instructions.	17/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability	CVE-2018-0167	Cisco IOS, XR, and XE Software	Apply updates per vendor instructions.	17/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS and IOS XE Software Improper Input Validation Vulnerability	CVE-2018-0172	Cisco IOS and IOS XE Software	Apply updates per vendor instructions.	17/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS and IOS XE Software Improper Input Validation Vulnerability	CVE-2018-0173	Cisco IOS and IOS XE Software	Apply updates per vendor instructions.	17/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS Software and Cisco IOS XE Software Improper Input Validation Vulnerability	CVE-2018-0174	Cisco IOS XE Software	Apply updates per vendor instructions.	17/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability	CVE-2018-0175	Cisco IOS, XR, and XE Software	Apply updates per vendor instructions.	17/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS Software Denial-of-Service Vulnerability	CVE-2018-0179	Cisco IOS Software	Apply updates per vendor instructions.	17/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS Software Denial-of-Service Vulnerability	CVE-2018-0180	Cisco IOS Software	Apply updates per vendor instructions.	17/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
ChakraCore Scripting Engine Type Confusion Vulnerability	CVE-2018-8298	ChakraCore ChakraCore scripting engine	Apply updates per vendor instructions.	17/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Exchange Server Privilege Escalation Vulnerability	CVE-2018-8581	Microsoft Exchange Server	Apply updates per vendor instructions.	17/03/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Excel Remote Code Execution Vulnerability	CVE-2019-1297	Microsoft Excel	Apply updates per vendor instructions.	17/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Small Business Routers Improper Input Validation Vulnerability	CVE-2019-1652	Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers	Apply updates per vendor instructions.	17/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Exim Out-of-bounds Write Vulnerability	CVE-2019-16928	Exim Exim Internet Mailer	Apply updates per vendor instructions.	17/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Treck TCP/IP stack Out-of-Bounds Read Vulnerability	CVE-2020-11899	Treck TCP/IP stack IPv6	Apply updates per vendor instructions.	17/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache Tomcat Improper Privilege Management Vulnerability	CVE-2020-1938	Apache Tomcat	Apply updates per vendor instructions.	17/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Installer Privilege Escalation Vulnerability	CVE-2021-41379	Microsoft Windows	Apply updates per vendor instructions.	17/03/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability	CVE-2022-20699	Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers	Apply updates per vendor instructions.	17/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability	CVE-2022-20700	Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers	Apply updates per vendor instructions.	17/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability	CVE-2022-20701	Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers	Apply updates per vendor instructions.	17/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability	CVE-2022-20703	Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers	Apply updates per vendor instructions.	17/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability	CVE-2022-20708	Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers	Apply updates per vendor instructions.	17/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Code Injection Vulnerability	CVE-2014-6352	Microsoft Windows	Apply updates per vendor instructions.	25/08/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Remote Code Execution Vulnerability	CVE-2017-0222	Microsoft Internet Explorer	Apply updates per vendor instructions.	25/08/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office Remote Code Execution Vulnerability	CVE-2017-8570	Microsoft Office	Apply updates per vendor instructions.	25/08/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability	CVE-2022-24682	Synacor Zimbra Collaborate Suite (ZCS)	Apply updates per vendor instructions.	11/03/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Zabbix Frontend Authentication Bypass Vulnerability	CVE-2022-23131	Zabbix Frontend	Apply updates per vendor instructions.	08/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Zabbix Frontend Improper Access Control Vulnerability	CVE-2022-23134	Zabbix Frontend	Apply updates per vendor instructions.	08/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Graphics Component Memory Corruption Vulnerability	CVE-2013-3906	Microsoft Graphics Component	Apply updates per vendor instructions.	15/08/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Word Memory Corruption Vulnerability	CVE-2014-1761	Microsoft Word	Apply updates per vendor instructions.	15/08/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
PHPUnit Command Injection Vulnerability	CVE-2017-9841	PHPUnit PHPUnit	Apply updates per vendor instructions.	15/08/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Use-After-Free Vulnerability	CVE-2018-15982	Adobe Flash Player	The impacted product is end-of-life and should be disconnected if still in use.	15/08/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
WinRAR Absolute Path Traversal Vulnerability	CVE-2018-20250	RARLAB WinRAR	Apply updates per vendor instructions.	15/08/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability	CVE-2018-8174	Microsoft Windows	Apply updates per vendor instructions.	15/08/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Type Confusion Vulnerability	CVE-2019-0752	Microsoft Internet Explorer	Apply updates per vendor instructions.	15/08/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium Animation Use-After-Free Vulnerability	CVE-2022-0609	Google Chromium Animation	Apply updates per vendor instructions.	01/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability	CVE-2022-24086	Adobe Commerce and Magento Open Source	Apply updates per vendor instructions.	01/03/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability	CVE-2022-22620	Apple iOS, iPadOS, and macOS	Apply updates per vendor instructions.	25/02/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple OS X Heap-Based Buffer Overflow Vulnerability	CVE-2014-4404	Apple OS X	Apply updates per vendor instructions.	10/08/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple OS X Authentication Bypass Vulnerability	CVE-2015-1130	Apple OS X	Apply updates per vendor instructions.	10/08/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft HTTP.sys Remote Code Execution Vulnerability	CVE-2015-1635	Microsoft HTTP.sys	Apply updates per vendor instructions.	10/08/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
D-Link DIR-645 Router Remote Code Execution Vulnerability	CVE-2015-2051	D-Link DIR-645 Router	The impacted product is end-of-life and should be disconnected if still in use.	10/08/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache ActiveMQ Improper Input Validation Vulnerability	CVE-2016-3088	Apache ActiveMQ	Apply updates per vendor instructions.	10/08/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft SMBv1 Remote Code Execution Vulnerability	CVE-2017-0144	Microsoft SMBv1	Apply updates per vendor instructions.	10/08/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft SMBv1 Remote Code Execution Vulnerability	CVE-2017-0145	Microsoft SMBv1	Apply updates per vendor instructions.	10/08/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office Remote Code Execution Vulnerability	CVE-2017-0262	Microsoft Office	Apply updates per vendor instructions.	10/08/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Win32k Privilege Escalation Vulnerability	CVE-2017-0263	Microsoft Win32k	Apply updates per vendor instructions.	10/08/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle Corporation WebLogic Server Remote Code Execution Vulnerability	CVE-2017-10271	Oracle WebLogic Server	Apply updates per vendor instructions.	10/08/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability	CVE-2017-8464	Microsoft Windows	Apply updates per vendor instructions.	10/08/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache Struts 1 Improper Input Validation Vulnerability	CVE-2017-9791	Apache Struts 1	Apply updates per vendor instructions.	10/08/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability	CVE-2018-1000861	Jenkins Jenkins Stapler Web Framework	Apply updates per vendor instructions.	10/08/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft SMBv3 Remote Code Execution Vulnerability	CVE-2020-0796	Microsoft SMBv3	Apply updates per vendor instructions.	10/08/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows SAM Local Privilege Escalation Vulnerability	CVE-2021-36934	Microsoft Windows	Apply updates per vendor instructions.	24/02/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Win32k Privilege Escalation Vulnerability	CVE-2022-21882	Microsoft Win32k	Apply updates per vendor instructions.	18/02/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Memory Corruption Vulnerability	CVE-2014-1776	Microsoft Internet Explorer	Apply updates per vendor instructions.	28/07/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability	CVE-2014-6271	GNU Bourne-Again Shell (Bash)	Apply updates per vendor instructions.	28/07/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability	CVE-2014-7169	GNU Bourne-Again Shell (Bash)	Apply updates per vendor instructions.	28/07/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability	CVE-2017-5689	Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability	Apply updates per vendor instructions.	28/07/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability	CVE-2020-0787	Microsoft Windows	Apply updates per vendor instructions.	28/07/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Grandstream Networks UCM6200 Series SQL Injection Vulnerability	CVE-2020-5722	Grandstream UCM6200	Apply updates per vendor instructions.	28/07/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability	CVE-2021-20038	SonicWall SMA 100 Appliances	Apply updates per vendor instructions.	11/02/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Memory Corruption Vulnerability	CVE-2022-22587	Apple iOS and macOS	Apply updates per vendor instructions.	11/02/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache Struts 1 ActionForm Denial-of-Service Vulnerability	CVE-2006-1547	Apache Struts 1	Apply updates per vendor instructions.	21/07/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache Struts 2 Improper Input Validation Vulnerability	CVE-2012-0391	Apache Struts 2	Apply updates per vendor instructions.	21/07/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Win32k Privilege Escalation Vulnerability	CVE-2018-8453	Microsoft Win32k	Apply updates per vendor instructions.	21/07/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SolarWinds Serv-U Improper Input Validation Vulnerability	CVE-2021-35247	SolarWinds Serv-U	Apply updates per vendor instructions.	04/02/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache Airflow Command Injection	CVE-2020-11978	Apache Airflow	Apply updates per vendor instructions.	18/07/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Drupal core Un-restricted Upload of File	CVE-2020-13671	Drupal Drupal core	Apply updates per vendor instructions.	18/07/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache Airflow's Experimental API Authentication Bypass	CVE-2020-13927	Apache Airflow's Experimental API	Apply updates per vendor instructions.	18/07/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle Business Intelligence Enterprise Edition Path Transversal	CVE-2020-14864	Oracle Intelligence Enterprise Edition	Apply updates per vendor instructions.	18/07/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
System Information Library for Node.JS Command Injection	CVE-2021-21315	Npm package System Information Library for Node.JS	Apply updates per vendor instructions.	01/02/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
VMware Server Side Request Forgery in vRealize Operations Manager API	CVE-2021-21975	VMware vRealize Operations Manager API	Apply updates per vendor instructions.	01/02/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
F5 BIG-IP Traffic Management Microkernel Buffer Overflow	CVE-2021-22991	F5 BIG-IP Traffic Management Microkernel	Apply updates per vendor instructions.	01/02/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Nagios XI OS Command Injection	CVE-2021-25296	Nagios Nagios XI	Apply updates per vendor instructions.	01/02/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Nagios XI OS Command Injection	CVE-2021-25297	Nagios Nagios XI	Apply updates per vendor instructions.	01/02/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Nagios XI OS Command Injection	CVE-2021-25298	Nagios Nagios XI	Apply updates per vendor instructions.	01/02/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
October CMS Improper Authentication	CVE-2021-32648	October CMS October CMS	Apply updates per vendor instructions.	01/02/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Exchange Server Information Disclosure	CVE-2021-33766	Microsoft Exchange Server	Apply updates per vendor instructions.	01/02/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Aviatrix Controller Unrestricted Upload of File	CVE-2021-40870	Aviatrix Aviatrix Controller	Apply updates per vendor instructions.	01/02/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft WinVerifyTrust function Remote Code Execution	CVE-2013-3900	Microsoft WinVerifyTrust function	Apply updates per vendor instructions.	10/07/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.	CVE-2015-7450	IBM WebSphere Application Server and Server Hypervisor Edition	Apply updates per vendor instructions.	10/07/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Primetek Primefaces Remote Code Execution Vulnerability	CVE-2017-1000486	Primetek Primefaces Application	Apply updates per vendor instructions.	10/07/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortinet FortiOS and FortiProxy Improper Authorization	CVE-2018-13382	Fortinet FortiOS and FortiProxy	Apply updates per vendor instructions.	10/07/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortinet FortiOS and FortiProxy Out-of-bounds Write	CVE-2018-13383	Fortinet FortiOS and FortiProxy	Apply updates per vendor instructions.	10/07/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Exim Mail Transfer Agent (MTA) Improper Input Validation	CVE-2019-10149	Exim Mail Transfer Agent (MTA)	Apply updates per vendor instructions.	10/07/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Win32k Privilege Escalation Vulnerability	CVE-2019-1458	Microsoft Win32k	Apply updates per vendor instructions.	10/07/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Palo Alto Networks PAN-OS Remote Code Execution Vulnerability	CVE-2019-1579	Palo Alto Networks PAN-OS	Apply updates per vendor instructions.	10/07/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle WebLogic Server, Injection	CVE-2019-2725	Oracle WebLogic Server	Apply updates per vendor instructions.	10/07/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Kibana Arbitrary Code Execution	CVE-2019-7609	Elastic Kibana	Apply updates per vendor instructions.	10/07/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference	CVE-2019-9670	Synacor Zimbra Collaboration Suite (ZCS)	Apply updates per vendor instructions.	10/07/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chrome Media Use-After-Free Vulnerability	CVE-2020-6572	Google Chrome Media	Apply updates per vendor instructions.	10/07/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
VMware vCenter Server Improper Access Control	CVE-2021-22017	VMware vCenter Server	Apply updates per vendor instructions.	24/01/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit	CVE-2021-27860	FatPipe WARP, IPVPN, and MPVPN software	Apply updates per vendor instructions.	24/01/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Hikvision Improper Input Validation	CVE-2021-36260	Hikvision Security cameras web server	Apply updates per vendor instructions.	24/01/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Use-After-Free Vulnerability	CVE-2021-4102	Google Chromium V8	Apply updates per vendor instructions.	29/12/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows AppX Installer Spoofing Vulnerability	CVE-2021-43890	Microsoft Windows	Apply updates per vendor instructions.	29/12/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability	CVE-2010-1871	Red Hat JBoss Seam 2	Apply updates per vendor instructions.	10/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Red Hat JBoss Application Server Remote Code Execution Vulnerability	CVE-2017-12149	Red Hat JBoss Application Server	Apply updates per vendor instructions.	10/06/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Embedthis GoAhead Remote Code Execution Vulnerability	CVE-2017-17562	Embedthis GoAhead	Apply updates per vendor instructions.	10/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache Solr DataImportHandler Code Injection Vulnerability	CVE-2019-0193	Apache Solr	Apply updates per vendor instructions.	10/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
MongoDB mongo-express Remote Code Execution Vulnerability	CVE-2019-10758	MongoDB mongo-express	Apply updates per vendor instructions.	10/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Linux Kernel Improper Privilege Management Vulnerability	CVE-2019-13272	Linux Kernel	Apply updates per vendor instructions.	10/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability	CVE-2019-7238	Sonatype Nexus Repository Manager	Apply updates per vendor instructions.	10/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fuel CMS SQL Injection Vulnerability	CVE-2020-17463	Fuel CMS Fuel CMS	Apply updates per vendor instructions.	10/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Pi-Hole AdminLTE Remote Code Execution Vulnerability	CVE-2020-8816	Pi-hole AdminLTE	Apply updates per vendor instructions.	10/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Realtek Jungle SDK Remote Code Execution Vulnerability	CVE-2021-35394	Realtek Jungle Software Development Kit (SDK)	Apply updates per vendor instructions.	24/12/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortinet FortiOS Arbitrary File Download	CVE-2021-44168	Fortinet FortiOS	Apply updates per vendor instructions.	24/12/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache Log4j2 Remote Code Execution Vulnerability	CVE-2021-44228	Apache Log4j2	For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.	24/12/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Zoho Desktop Central Authentication Bypass Vulnerability	CVE-2021-44515	Zoho Desktop Central	Apply updates per vendor instructions.	24/12/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
MikroTik Router OS Directory Traversal Vulnerability	CVE-2018-14847	MikroTik RouterOS	Apply updates per vendor instructions.	01/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Qualcomm Multiple Chipsets Improper Input Validation Vulnerability	CVE-2020-11261	Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables	Apply updates per vendor instructions.	01/06/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability	CVE-2021-37415	Zoho ManageEngine ServiceDesk Plus (SDP)	Apply updates per vendor instructions.	15/12/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache HTTP Server-Side Request Forgery (SSRF)	CVE-2021-40438	Apache Apache	Apply updates per vendor instructions.	15/12/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability	CVE-2021-44077	Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus	Apply updates per vendor instructions.	15/12/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
ExifTool Remote Code Execution Vulnerability	CVE-2021-22204	Perl Exiftool	Apply updates per vendor instructions.	01/12/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Win32k Privilege Escalation Vulnerability	CVE-2021-40449	Microsoft Windows	Apply updates per vendor instructions.	01/12/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Excel Security Feature Bypass	CVE-2021-42292	Microsoft Office	Apply updates per vendor instructions.	01/12/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Exchange Server Remote Code Execution Vulnerability	CVE-2021-42321	Microsoft Exchange	Apply updates per vendor instructions.	01/12/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SAP NetWeaver Remote Code Execution Vulnerability	CVE-2010-5326	SAP NetWeaver	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability	CVE-2012-0158	Microsoft MSCOMCTL.OCX	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle Fusion Middleware Unspecified Vulnerability	CVE-2012-3152	Oracle Fusion Middleware	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability	CVE-2014-1812	Microsoft Windows	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office Memory Corruption Vulnerability	CVE-2015-1641	Microsoft Office	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability	CVE-2015-4852	Oracle WebLogic Server	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Win32k Privilege Escalation Vulnerability	CVE-2016-0167	Microsoft Win32k	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Media Center Remote Code Execution Vulnerability	CVE-2016-0185	Microsoft Windows	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office OLE DLL Side Loading Vulnerability	CVE-2016-3235	Microsoft Office	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SolarWinds Virtualization Manager Privilege Escalation Vulnerability	CVE-2016-3643	SolarWinds Virtualization Manager	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
ImageMagick Arbitrary File Deletion Vulnerability	CVE-2016-3715	ImageMagick ImageMagick	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
ImageMagick Server-Side Request Forgery (SSRF) Vulnerability	CVE-2016-3718	ImageMagick ImageMagick	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SAP NetWeaver Directory Traversal Vulnerability	CVE-2016-3976	SAP NetWeaver	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache Shiro Code Execution Vulnerability	CVE-2016-4437	Apache Shiro	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Win32k Privilege Escalation Vulnerability	CVE-2016-7255	Microsoft Win32k	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SAP NetWeaver XML External Entity (XXE) Vulnerability	CVE-2016-9563	SAP NetWeaver	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability	CVE-2017-0143	Microsoft Windows	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office and WordPad Remote Code Execution Vulnerability	CVE-2017-0199	Microsoft Office and WordPad	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office Outlook Security Feature Bypass Vulnerability	CVE-2017-11774	Microsoft Office	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office Memory Corruption Vulnerability	CVE-2017-11882	Microsoft Office	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Roundcube Webmail File Disclosure Vulnerability	CVE-2017-16651	Roundcube Roundcube Webmail	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache Struts Remote Code Execution Vulnerability	CVE-2017-5638	Apache Struts	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Symantec Messaging Gateway Remote Code Execution Vulnerability	CVE-2017-6327	Symantec Symantec Messaging Gateway	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Server Buffer Overflow Vulnerability	CVE-2017-7269	Microsoft Internet Information Services (IIS)	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft .NET Framework Remote Code Execution Vulnerability	CVE-2017-8759	Microsoft .NET Framework	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability	CVE-2017-9248	Progress ASP.NET AJAX and Sitefinity	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache Struts Deserialization of Untrusted Data Vulnerability	CVE-2017-9805	Apache Struts	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
DotNetNuke (DNN) Remote Code Execution Vulnerability	CVE-2017-9822	DotNetNuke (DNN) DotNetNuke (DNN)	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability	CVE-2018-0171	Cisco IOS and IOS XE	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability	CVE-2018-0296	Cisco Adaptive Security Appliance (ASA)	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office Memory Corruption Vulnerability	CVE-2018-0798	Microsoft Office	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office Memory Corruption Vulnerability	CVE-2018-0802	Microsoft Office	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache Struts Remote Code Execution Vulnerability	CVE-2018-11776	Apache Struts	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortinet FortiOS SSL VPN Path Traversal Vulnerability	CVE-2018-13379	Fortinet FortiOS	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability	CVE-2018-14558	Tenda AC7, AC9, and AC10 Routers	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability	CVE-2018-15811	DotNetNuke (DNN) DotNetNuke (DNN)	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe ColdFusion Unrestricted File Upload Vulnerability	CVE-2018-15961	Adobe ColdFusion	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability	CVE-2018-18325	DotNetNuke (DNN) DotNetNuke (DNN)	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
ThinkPHP "noneCms" Remote Code Execution Vulnerability	CVE-2018-20062	ThinkPHP noneCms	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SAP Customer Relationship Management (CRM) Path Traversal Vulnerability	CVE-2018-2380	SAP Customer Relationship Management (CRM)	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Flash Player Use-After-Free Vulnerability	CVE-2018-4878	Adobe Flash Player	The impacted product is end-of-life and should be disconnected if still in use.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability	CVE-2018-4939	Adobe ColdFusion	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Exim Buffer Overflow Vulnerability	CVE-2018-6789	Exim Exim	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Drupal Core Remote Code Execution Vulnerability	CVE-2018-7600	Drupal Drupal Core	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability	CVE-2018-8653	Microsoft Internet Explorer	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache HTTP Server Privilege Escalation Vulnerability	CVE-2019-0211	Apache HTTP Server	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft MSHTML Remote Code Execution Vulnerability	CVE-2019-0541	Microsoft MSHTML	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft SharePoint Remote Code Execution Vulnerability	CVE-2019-0604	Microsoft SharePoint	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Remote Desktop Services Remote Code Execution Vulnerability	CVE-2019-0708	Microsoft Remote Desktop Services	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Win32k Privilege Escalation Vulnerability	CVE-2019-0797	Microsoft Win32k	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Win32k Privilege Escalation Vulnerability	CVE-2019-0803	Microsoft Win32k	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Win32k Privilege Escalation Vulnerability	CVE-2019-0808	Microsoft Win32k	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Win32k Privilege Escalation Vulnerability	CVE-2019-0859	Microsoft Win32k	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability	CVE-2019-0863	Microsoft Windows	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability	CVE-2019-11510	Ivanti Pulse Connect Secure	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability	CVE-2019-11539	Ivanti Pulse Connect Secure and Pulse Policy Secure	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability	CVE-2019-11580	Atlassian Crowd and Crowd Data Center	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability	CVE-2019-11634	Citrix Workspace Application and Receiver for Windows	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Privilege Common Log File System (CLFS) Escalation Vulnerability	CVE-2019-1214	Microsoft Windows	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Privilege Escalation Vulnerability	CVE-2019-1215	Microsoft Windows	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability	CVE-2019-13608	Citrix StoreFront Server	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability	CVE-2019-1367	Microsoft Internet Explorer	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability	CVE-2019-1429	Microsoft Internet Explorer	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Docker Desktop Community Edition Privilege Escalation Vulnerability	CVE-2019-15752	Docker Desktop Community Edition	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Nagios XI Remote Code Execution Vulnerability	CVE-2019-15949	Nagios Nagios XI	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SIMalliance Toolbox Browser Command Injection Vulnerability	CVE-2019-16256	SIMalliance Toolbox Browser	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability	CVE-2019-1653	Cisco Small Business RV320 and RV325 Routers	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
vBulletin PHP Module Remote Code Execution Vulnerability	CVE-2019-16759	vBulletin vBulletin	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Mozilla Firefox And Thunderbird Type Confusion Vulnerability	CVE-2019-17026	Mozilla Firefox and Thunderbird	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability	CVE-2019-17558	Apache Solr	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Trend Micro OfficeScan Directory Traversal Vulnerability	CVE-2019-18187	Trend Micro OfficeScan	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability	CVE-2019-18935	Progress Telerik UI for ASP.NET AJAX	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
TeamViewer Desktop Bypass Remote Login Vulnerability	CVE-2019-18988	TeamViewer Desktop	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Netis WF2419 Devices Remote Code Execution Vulnerability	CVE-2019-19356	Netis WF2419 Devices	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability	CVE-2019-19781	Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
TVT NVMS-1000 Directory Traversal Vulnerability	CVE-2019-20085	TVT NVMS-1000	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Android Kernel Use-After-Free Vulnerability	CVE-2019-2215	Android Android Kernel	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability	CVE-2019-3396	Atlassian Confluence Server and Data Server	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Atlassian Confluence Server and Data Center Path Traversal Vulnerability	CVE-2019-3398	Atlassian Confluence Server and Data Center	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
IBM Planning Analytics Remote Code Execution Vulnerability	CVE-2019-4716	IBM Planning Analytics	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability	CVE-2019-5544	VMware VMware ESXi and Horizon DaaS	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortinet FortiOS Default Configuration Vulnerability	CVE-2019-5591	Fortinet FortiOS	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS and macOS Group Facetime Vulnerability	CVE-2019-6223	Apple iOS and macOS	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SonicWall SMA100 SQL Injection Vulnerability	CVE-2019-7481	SonicWall SMA100	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability	CVE-2019-8394	Zoho ManageEngine	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
ThinkPHP Remote Code Execution Vulnerability	CVE-2019-9082	ThinkPHP ThinkPHP	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability	CVE-2019-9978	WordPress Social Warfare Plugin	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Android Kernel Out-of-Bounds Write Vulnerability	CVE-2020-0041	Android Android Kernel	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability	CVE-2020-0069	MediaTek Multiple Chipsets	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows CryptoAPI Spoofing Vulnerability	CVE-2020-0601	Microsoft Windows	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft .NET Framework Remote Code Execution Vulnerability	CVE-2020-0646	Microsoft .NET Framework	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability	CVE-2020-0674	Microsoft Internet Explorer	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Installer Privilege Escalation Vulnerability	CVE-2020-0683	Microsoft Windows	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability	CVE-2020-0688	Microsoft Exchange Server	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Edge and Internet Explorer Memory Corruption Vulnerability	CVE-2020-0878	Microsoft Edge and Internet Explorer	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability	CVE-2020-0938	Microsoft Windows	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability	CVE-2020-0968	Microsoft Internet Explorer	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Kernel Privilege Escalation Vulnerability	CVE-2020-0986	Microsoft Windows	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SolarWinds Orion Authentication Bypass Vulnerability	CVE-2020-10148	SolarWinds Orion	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Sumavision EMR Cross-Site Request Forgery (CSRF) Vulnerability	CVE-2020-10181	Sumavision Enhanced Multimedia Router (EMR)	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Zoho ManageEngine Desktop Central File Upload Vulnerability	CVE-2020-10189	Zoho ManageEngine	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Sonatype Nexus Repository Remote Code Execution Vulnerability	CVE-2020-10199	Sonatype Nexus Repository	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability	CVE-2020-1020	Microsoft Windows	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
rConfig OS Command Injection Vulnerability	CVE-2020-10221	rConfig rConfig	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability	CVE-2020-1040	Microsoft Hyper-V RemoteFX	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Win32k Privilege Escalation Vulnerability	CVE-2020-1054	Microsoft Win32k	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability	CVE-2020-10987	Tenda AC1900 Router AC15 Model	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability	CVE-2020-1147	Microsoft .NET Framework, SharePoint, Visual Studio	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SaltStack Salt Authentication Bypass Vulnerability	CVE-2020-11651	SaltStack Salt	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SaltStack Salt Path Traversal Vulnerability	CVE-2020-11652	SaltStack Salt	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
WordPress Snap Creek Duplicator Plugin File Download Vulnerability	CVE-2020-11738	WordPress Snap Creek Duplicator Plugin	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Sophos SFOS SQL Injection Vulnerability	CVE-2020-12271	Sophos SFOS	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Fortinet FortiOS SSL VPN Improper Authentication Vulnerability	CVE-2020-12812	Fortinet FortiOS	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows DNS Server Remote Code Execution Vulnerability	CVE-2020-1350	Microsoft Windows	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability	CVE-2020-1380	Microsoft Internet Explorer	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Spoofing Vulnerability	CVE-2020-1464	Microsoft Windows	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Netlogon Privilege Escalation Vulnerability	CVE-2020-1472	Microsoft Netlogon	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle WebLogic Server Remote Code Execution Vulnerability	CVE-2020-14750	Oracle WebLogic Server	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability	CVE-2020-14871	Oracle Solaris and Zettabyte File System (ZFS)	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle WebLogic Server Remote Code Execution Vulnerability	CVE-2020-14882	Oracle WebLogic Server	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle WebLogic Server Unspecified Vulnerability	CVE-2020-14883	Oracle WebLogic Server	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability	CVE-2020-15505	Ivanti MobileIron Multiple Products	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chrome FreeType Heap Buffer Overflow Vulnerability	CVE-2020-15999	Google Chrome FreeType	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Type Confusion Vulnerability	CVE-2020-16009	Google Chromium V8	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chrome for Android UI Heap Buffer Overflow Vulnerability	CVE-2020-16010	Google Chrome for Android UI	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Incorrect Implementation Vulnerabililty	CVE-2020-16013	Google Chromium V8	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chrome Use-After-Free Vulnerability	CVE-2020-16017	Google Chrome	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SaltStack Salt Shell Injection Vulnerability	CVE-2020-16846	SaltStack Salt	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Kernel Privilege Escalation Vulnerability	CVE-2020-17087	Microsoft Windows	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Exchange Server Remote Code Execution Vulnerability	CVE-2020-17144	Microsoft Exchange Server	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
vBulletin PHP Module Remote Code Execution Vulnerability	CVE-2020-17496	vBulletin vBulletin	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache Struts Remote Code Execution Vulnerability	CVE-2020-17530	Apache Struts	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Trend Micro Multiple Products Improper Access Control Vulnerability	CVE-2020-24557	Trend Micro Apex One, OfficeScan, and Worry-Free Business Security	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
WordPress File Manager Plugin Remote Code Execution Vulnerability	CVE-2020-25213	WordPress File Manager Plugin	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
D-Link DNS-320 Device Command Injection Vulnerability	CVE-2020-25506	D-Link DNS-320 Device	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Oracle Multiple Products Remote Code Execution Vulnerability	CVE-2020-2555	Oracle Multiple Products	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability	CVE-2020-26919	NETGEAR JGS516PE Devices	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Memory Corruption Vulnerability	CVE-2020-27930	Apple Multiple Products	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Type Confusion Vulnerability	CVE-2020-27932	Apple Multiple Products	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Memory Initialization Vulnerability	CVE-2020-27950	Apple Multiple Products	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability	CVE-2020-29557	D-Link DIR-825 R1 Devices	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability	CVE-2020-29583	Zyxel Multiple Products	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS XR Software Discovery Protocol Format String Vulnerability	CVE-2020-3118	Cisco IOS XR	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability	CVE-2020-3161	Cisco Cisco IP Phones	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco ASA and FTD Read-Only Path Traversal Vulnerability	CVE-2020-3452	Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability	CVE-2020-3566	Cisco IOS XR	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability	CVE-2020-3569	Cisco IOS XR	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability	CVE-2020-3580	Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
VMware Multiple Products Privilege Escalation Vulnerability	CVE-2020-3950	VMware Multiple Products	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
VMware vCenter Server Information Disclosure Vulnerability	CVE-2020-3952	VMware vCenter Server	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
VMware ESXi OpenSLP Use-After-Free Vulnerability	CVE-2020-3992	VMware ESXi	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Multiple VMware Products Command Injection Vulnerability	CVE-2020-4006	VMware Multiple Products	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
IBM Data Risk Manager Security Bypass Vulnerability	CVE-2020-4427	IBM Data Risk Manager	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
IBM Data Risk Manager Remote Code Execution Vulnerability	CVE-2020-4428	IBM Data Risk Manager	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
IBM Data Risk Manager Directory Traversal Vulnerability	CVE-2020-4430	IBM Data Risk Manager	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Amcrest Cameras and NVR Stack-based Buffer Overflow Vulnerability	CVE-2020-5735	Amcrest Cameras and Network Video Recorder (NVR)	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Unraid Remote Code Execution Vulnerability	CVE-2020-5847	Unraid Unraid	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Unraid Authentication Bypass Vulnerability	CVE-2020-5849	Unraid Unraid	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability	CVE-2020-5902	F5 BIG-IP	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SAP Solution Manager Missing Authentication for Critical Function Vulnerability	CVE-2020-6207	SAP Solution Manager	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SAP NetWeaver Missing Authentication for Critical Function Vulnerability	CVE-2020-6287	SAP NetWeaver	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Type Confusion Vulnerability	CVE-2020-6418	Google Chromium V8	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Mozilla Firefox And Thunderbird Use-After-Free Vulnerability	CVE-2020-6819	Mozilla Firefox and Thunderbird	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Mozilla Firefox And Thunderbird Use-After-Free Vulnerability	CVE-2020-6820	Mozilla Firefox and Thunderbird	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Liferay Portal Deserialization of Untrusted Data Vulnerability	CVE-2020-7961	Liferay Liferay Portal	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability	CVE-2020-8193	Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability	CVE-2020-8195	Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability	CVE-2020-8196	Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Pulse Connect Secure Code Execution Vulnerability	CVE-2020-8243	Ivanti Pulse Connect Secure	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Pulse Connect Secure Code Execution Vulnerability	CVE-2020-8260	Ivanti Pulse Connect Secure	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability	CVE-2020-8467	Trend Micro Apex One and OfficeScan	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Trend Micro Multiple Products Content Validation Escape Vulnerability	CVE-2020-8468	Trend Micro Apex One, OfficeScan and Worry-Free Business Security Agents	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Multiple DrayTek Vigor Routers Web Management Page Vulnerability	CVE-2020-8515	DrayTek Multiple Vigor Routers	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability	CVE-2020-8599	Trend Micro Apex One and OfficeScan	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
PlaySMS Server-Side Template Injection Vulnerability	CVE-2020-8644	PlaySMS PlaySMS	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
EyesOfNetwork Improper Privilege Management Vulnerability	CVE-2020-8655	EyesOfNetwork EyesOfNetwork	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
EyesOfNetwork Use of Hard-Coded Credentials Vulnerability	CVE-2020-8657	EyesOfNetwork EyesOfNetwork	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability	CVE-2020-9818	Apple iOS, iPadOS, and watchOS	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS, iPadOS, and watchOS Memory Corruption Vulnerability	CVE-2020-9819	Apple iOS, iPadOS, and watchOS	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Code Execution Vulnerability	CVE-2020-9859	Apple Multiple Products	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability	CVE-2021-1497	Cisco HyperFlex HX	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Cisco HyperFlex HX Data Platform Command Injection Vulnerability	CVE-2021-1498	Cisco HyperFlex HX	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Defender Remote Code Execution Vulnerability	CVE-2021-1647	Microsoft Defender	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Print Spooler Remote Code Execution Vulnerability	CVE-2021-1675	Microsoft Windows	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Win32k Privilege Escalation Vulnerability	CVE-2021-1732	Microsoft Win32k	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Race Condition Vulnerability	CVE-2021-1782	Apple Multiple Products	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability	CVE-2021-1870	Apple iOS, iPadOS, and macOS	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability	CVE-2021-1871	Apple iOS, iPadOS, and macOS	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS) Vulnerability	CVE-2021-1879	Apple iOS, iPadOS, and watchOS	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Qualcomm Multiple Chipsets Use-After-Free Vulnerability	CVE-2021-1905	Qualcomm Multiple Chipsets	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability	CVE-2021-1906	Qualcomm Multiple Chipsets	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SonicWall SSLVPN SMA100 SQL Injection Vulnerability	CVE-2021-20016	SonicWall SSLVPN SMA100	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SonicWall Email Security Improper Privilege Management Vulnerability	CVE-2021-20021	SonicWall SonicWall Email Security	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SonicWall Email Security Unrestricted Upload of File Vulnerability	CVE-2021-20022	SonicWall SonicWall Email Security	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SonicWall Email Security Path Traversal Vulnerability	CVE-2021-20023	SonicWall SonicWall Email Security	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Arcadyan Buffalo Firmware Path Traversal Vulnerability	CVE-2021-20090	Arcadyan Buffalo Firmware	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability	CVE-2021-21017	Adobe Acrobat and Reader	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Heap Buffer Overflow Vulnerability	CVE-2021-21148	Google Chromium V8	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium Race Condition Vulnerability	CVE-2021-21166	Google Chromium	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium Blink Use-After-Free Vulnerability	CVE-2021-21193	Google Chromium Blink	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium Blink Use-After-Free Vulnerability	CVE-2021-21206	Google Chromium Blink	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Improper Input Validation Vulnerability	CVE-2021-21220	Google Chromium V8	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Type Confusion Vulnerability	CVE-2021-21224	Google Chromium V8	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
VMware vCenter Server Remote Code Execution Vulnerability	CVE-2021-21972	VMware vCenter Server	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
VMware vCenter Server Improper Input Validation Vulnerability	CVE-2021-21985	VMware vCenter Server	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
VMware vCenter Server File Upload Vulnerability	CVE-2021-22005	VMware vCenter Server	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
GitLab Community and Enterprise Editions Remote Code Execution Vulnerability	CVE-2021-22205	GitLab Community and Enterprise Editions	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability	CVE-2021-22502	Micro Focus Operation Bridge Reporter (OBR)	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Micro Focus Access Manager Information Leakage Vulnerability	CVE-2021-22506	Micro Focus Micro Focus Access Manager	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Pulse Connect Secure Use-After-Free Vulnerability	CVE-2021-22893	Ivanti Pulse Connect Secure	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability	CVE-2021-22894	Ivanti Pulse Connect Secure	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Pulse Connect Secure Command Injection Vulnerability	CVE-2021-22899	Ivanti Pulse Connect Secure	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability	CVE-2021-22900	Ivanti Pulse Connect Secure	Apply updates per vendor instructions.	03/05/2022	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability	CVE-2021-22986	F5 BIG-IP and BIG-IQ Centralized Management	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
McAfee Total Protection (MTP) Improper Privilege Management Vulnerability	CVE-2021-23874	McAfee McAfee Total Protection (MTP)	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability	CVE-2021-26084	Atlassian Confluence Server and Data Center	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Memory Corruption Vulnerability	CVE-2021-26411	Microsoft Internet Explorer	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Exchange Server Remote Code Execution Vulnerability	CVE-2021-26855	Microsoft Exchange Server	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Exchange Server Remote Code Execution Vulnerability	CVE-2021-26857	Microsoft Exchange Server	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Exchange Server Remote Code Execution Vulnerability	CVE-2021-26858	Microsoft Exchange Server	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Office Remote Code Execution Vulnerability	CVE-2021-27059	Microsoft Office	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Exchange Server Remote Code Execution Vulnerability	CVE-2021-27065	Microsoft Exchange Server	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Internet Explorer Remote Code Execution Vulnerability	CVE-2021-27085	Microsoft Internet Explorer	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Accellion FTA SQL Injection Vulnerability	CVE-2021-27101	Accellion FTA	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Accellion FTA OS Command Injection Vulnerability	CVE-2021-27102	Accellion FTA	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability	CVE-2021-27103	Accellion FTA	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Accellion FTA OS Command Injection Vulnerability	CVE-2021-27104	Accellion FTA	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Yealink Device Management Server-Side Request Forgery (SSRF) Vulnerability	CVE-2021-27561	Yealink Device Management	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Arm Trusted Firmware Out-of-Bounds Write Vulnerability	CVE-2021-27562	Arm Trusted Firmware	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Win32k Privilege Escalation Vulnerability	CVE-2021-28310	Microsoft Win32k	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Adobe Acrobat and Reader Use-After-Free Vulnerability	CVE-2021-28550	Adobe Acrobat and Reader	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability	CVE-2021-28663	Arm Mali Graphics Processing Unit (GPU)	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Arm Mali Graphics Processing Unit (GPU) Unspecified Vulnerability	CVE-2021-28664	Arm Mali Graphics Processing Unit (GPU)	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability	CVE-2021-30116	Kaseya Virtual System/Server Administrator (VSA)	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Type Confusion Vulnerability	CVE-2021-30551	Google Chromium V8	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium WebGL Use-After-Free Vulnerability	CVE-2021-30554	Google Chromium WebGL	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Type Confusion Vulnerability	CVE-2021-30563	Google Chromium V8	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Out-of-Bounds Write Vulnerability	CVE-2021-30632	Google Chromium V8	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium Indexed DB API Use-After-Free Vulnerability	CVE-2021-30633	Google Chromium Indexed DB API	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple macOS Unspecified Vulnerability	CVE-2021-30657	Apple macOS	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products WebKit Storage Use-After-Free Vulnerability	CVE-2021-30661	Apple Multiple Products	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products WebKit Integer Overflow Vulnerability	CVE-2021-30663	Apple Multiple Products	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products WebKit Memory Corruption Vulnerability	CVE-2021-30665	Apple Multiple Products	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS WebKit Buffer Overflow Vulnerability	CVE-2021-30666	Apple iOS	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple macOS Unspecified Vulnerability	CVE-2021-30713	Apple macOS	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS WebKit Memory Corruption Vulnerability	CVE-2021-30761	Apple iOS	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS WebKit Use-After-Free Vulnerability	CVE-2021-30762	Apple iOS	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Memory Corruption Vulnerability	CVE-2021-30807	Apple Multiple Products	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS, iPadOS, macOS Use-After-Free Vulnerability	CVE-2021-30858	Apple iOS, iPadOS, and macOS	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple Multiple Products Integer Overflow Vulnerability	CVE-2021-30860	Apple Multiple Products	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apple iOS, iPadOS, and macOS Type Confusion Vulnerability	CVE-2021-30869	Apple iOS, iPadOS, and macOS	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability	CVE-2021-31199	Microsoft Enhanced Cryptographic Provider	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability	CVE-2021-31201	Microsoft Enhanced Cryptographic Provider	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Exchange Server Security Feature Bypass Vulnerability	CVE-2021-31207	Microsoft Exchange Server	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Tenda AC11 Router Stack Buffer Overflow Vulnerability	CVE-2021-31755	Tenda AC11 Router	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Kernel Information Disclosure Vulnerability	CVE-2021-31955	Microsoft Windows	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows NTFS Privilege Escalation Vulnerability	CVE-2021-31956	Microsoft Windows	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Kernel Privilege Escalation Vulnerability	CVE-2021-31979	Microsoft Windows	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability	CVE-2021-33739	Microsoft Windows	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability	CVE-2021-33742	Microsoft Windows	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Kernel Privilege Escalation Vulnerability	CVE-2021-33771	Microsoft Windows	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Scripting Engine Memory Corruption Vulnerability	CVE-2021-34448	Microsoft Windows	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Exchange Server Remote Code Execution Vulnerability	CVE-2021-34473	Microsoft Exchange Server	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Exchange Server Privilege Escalation Vulnerability	CVE-2021-34523	Microsoft Exchange Server	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Print Spooler Remote Code Execution Vulnerability	CVE-2021-34527	Microsoft Windows	Apply updates per vendor instructions.	03/05/2022	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
SolarWinds Serv-U Remote Code Execution Vulnerability	CVE-2021-35211	SolarWinds Serv-U	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Realtek AP-Router SDK Buffer Overflow Vulnerability	CVE-2021-35395	Realtek AP-Router SDK	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability	CVE-2021-35464	ForgeRock Access Management (AM)	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Trend Micro Multiple Products Improper Input Validation Vulnerability	CVE-2021-36741	Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Trend Micro Multiple Products Improper Input Validation Vulnerability	CVE-2021-36742	Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability	CVE-2021-36942	Microsoft Windows	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Update Medic Service Privilege Escalation Vulnerability	CVE-2021-36948	Microsoft Windows	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability	CVE-2021-36955	Microsoft Windows	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium Portals Use-After-Free Vulnerability	CVE-2021-37973	Google Chromium Portals	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Use-After-Free Vulnerability	CVE-2021-37975	Google Chromium V8	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium Information Disclosure Vulnerability	CVE-2021-37976	Google Chromium	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium Intents Improper Input Validation Vulnerability	CVE-2021-38000	Google Chromium Intents	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Google Chromium V8 Memory Corruption Vulnerability	CVE-2021-38003	Google Chromium V8	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability	CVE-2021-38645	Microsoft Open Management Infrastructure (OMI)	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability	CVE-2021-38647	Microsoft Open Management Infrastructure (OMI)	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability	CVE-2021-38648	Microsoft Open Management Infrastructure (OMI)	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability	CVE-2021-38649	Microsoft Open Management Infrastructure (OMI)	Apply updates per vendor instructions.	17/11/2021	Sin confirmar CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Microsoft MSHTML Remote Code Execution Vulnerability	CVE-2021-40444	Microsoft MSHTML	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability	CVE-2021-40539	Zoho ManageEngine	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache HTTP Server Path Traversal Vulnerability	CVE-2021-41773	Apache HTTP Server	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
Apache HTTP Server Path Traversal Vulnerability	CVE-2021-42013	Apache HTTP Server	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
BQE BillQuick Web Suite SQL Injection Vulnerability	CVE-2021-42258	BQE BillQuick Web Suite	Apply updates per vendor instructions.	17/11/2021	Confirmado CVSS SIN DATO (Sin dato) PoC GitHub: Sin dato
No se encontraron hallazgos con los filtros seleccionados.

Encuentra artículos por palabra clave

Panel de seguimiento de riesgo

Lectura operativa de exposición

Lo que observamos ahora