Vulnerabilidades (CVE) que se están explotando activamente, según el catálogo KEV de CISA, con severidad CVSS y probabilidad de explotación (EPSS).
30explotadas en los últimos 30 días
11críticas (CVSS ≥ 9)
0usadas en ransomware
1769en el catálogo KEV
CVE-2021-28664Severidad en análisisen el catálogo el 03/11/2021
Arm Mali Graphics Processing Unit (GPU) Unspecified Vulnerability
Arm · Mali Graphics Processing Unit (GPU) · CWE-787
Arm Mali Graphics Processing Unit (GPU) kernel driver contains an unspecified vulnerability that may allow a non-privileged user to gain write access to read-only memory, gain root privilege, corrupt memory, and modify the memory of other processes. EN
CVE-2021-28663Severidad en análisisen el catálogo el 03/11/2021
Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability
Arm · Mali Graphics Processing Unit (GPU) · CWE-416
Arm Mali Graphics Processing Unit (GPU) kernel driver contains a use-after-free vulnerability that may allow a non-privileged user to make improper operations on GPU memory to gain root privilege, and/or disclose information. EN
CVE-2021-28550Severidad en análisisen el catálogo el 03/11/2021
Adobe Acrobat and Reader Use-After-Free Vulnerability
Adobe · Acrobat and Reader · CWE-416
Adobe Acrobat and Reader contains a use-after-free vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user. EN
CVE-2021-28310Severidad en análisisen el catálogo el 03/11/2021
Microsoft Win32k Privilege Escalation Vulnerability
Microsoft · Win32k · CWE-787
Microsoft Windows Win32k contains an unspecified vulnerability that allows for privilege escalation. EN
CVE-2021-27562Severidad en análisisen el catálogo el 03/11/2021
Arm Trusted Firmware Out-of-Bounds Write Vulnerability
Arm · Trusted Firmware · CWE-787
Arm Trusted Firmware contains an out-of-bounds write vulnerability allowing the non-secure (NS) world to trigger a system halt, overwrite secure data, or print out secure data when calling secure functions under the non-secure processing environment (NSPE) handler mode. This vulnerability affects Yealink Device Management servers. EN
CVE-2021-27561Severidad en análisisen el catálogo el 03/11/2021
Accellion FTA contains a server-side request forgery (SSRF) vulnerability exploited via a crafted POST request to wmProgressstat.html. EN
CVE-2021-27102Severidad en análisisRansomwareen el catálogo el 03/11/2021
Accellion FTA OS Command Injection Vulnerability
Accellion · FTA · CWE-20, CWE-78
Accellion FTA contains an OS command injection vulnerability exploited via a local web service call. EN
CVE-2021-27101Severidad en análisisRansomwareen el catálogo el 03/11/2021
Accellion FTA SQL Injection Vulnerability
Accellion · FTA · CWE-89, CWE-138
Accellion FTA contains a SQL injection vulnerability exploited via a crafted host header in a request to document_root.html. EN
CVE-2021-27085Severidad en análisisen el catálogo el 03/11/2021
Microsoft Internet Explorer Remote Code Execution Vulnerability
Microsoft · Internet Explorer
Microsoft Internet Explorer contains an unspecified vulnerability that allows for remote code execution. EN
CVE-2021-27065Severidad en análisisRansomwareen el catálogo el 03/11/2021
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange Server · CWE-39
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain. EN
CVE-2021-27059Severidad en análisisen el catálogo el 03/11/2021
Microsoft Office Remote Code Execution Vulnerability
Microsoft · Office
Microsoft Office contains an unspecified vulnerability that allows for remote code execution. EN
CVE-2021-26858Severidad en análisisRansomwareen el catálogo el 03/11/2021
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange Server
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain. EN
CVE-2021-26857Severidad en análisisRansomwareen el catálogo el 03/11/2021
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange Server · CWE-502
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain. EN
CVE-2021-26855Severidad en análisisRansomwareen el catálogo el 03/11/2021
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange Server · CWE-918
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain. EN
CVE-2021-26411Severidad en análisisRansomwareen el catálogo el 03/11/2021
Microsoft Internet Explorer Memory Corruption Vulnerability
Microsoft · Internet Explorer · CWE-416
Microsoft Internet Explorer contains an unspecified vulnerability that allows for memory corruption. EN
CVE-2021-26084Severidad en análisisRansomwareen el catálogo el 03/11/2021
Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
Atlassian · Confluence Server and Data Center · CWE-917
Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code. EN
CVE-2021-23874Severidad en análisisen el catálogo el 03/11/2021
McAfee Total Protection (MTP) Improper Privilege Management Vulnerability
McAfee · McAfee Total Protection (MTP) · CWE-284
McAfee Total Protection (MTP) contains an improper privilege management vulnerability that allows a local user to gain elevated privileges and execute code, bypassing MTP self-defense. EN
CVE-2021-22986Severidad en análisisRansomwareen el catálogo el 03/11/2021
F5 · BIG-IP and BIG-IQ Centralized Management · CWE-863
F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability in the iControl REST interface that allows unauthenticated attackers with network access to execute system commands, create or delete files, and disable services. EN
CVE-2021-22900Severidad en análisisen el catálogo el 03/11/2021
Ivanti Pulse Connect Secure contains an unrestricted file upload vulnerability that allows an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface. EN
CVE-2021-22899Severidad en análisisen el catálogo el 03/11/2021
Ivanti Pulse Connect Secure contains a command injection vulnerability that allows remote authenticated users to perform remote code execution via Windows File Resource Profiles. EN
CVE-2021-22894Severidad en análisisen el catálogo el 03/11/2021
Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability
Ivanti · Pulse Connect Secure · CWE-94
Ivanti Pulse Connect Secure Collaboration Suite contains a buffer overflow vulnerabilities that allows a remote authenticated users to execute code as the root user via maliciously crafted meeting room. EN
CVE-2021-22893Severidad en análisisRansomwareen el catálogo el 03/11/2021
Ivanti Pulse Connect Secure contains a use-after-free vulnerability that allow a remote, unauthenticated attacker to execute code via license services. EN
¿Quiere saber si su entorno está expuesto?
Evaluamos versiones, accesos e integraciones de su ERP y de la infraestructura y priorizamos las correcciones.
Bit es una IA y puede equivocarse. No compartas contraseñas ni datos personales. Las conversaciones no se almacenan. Más información
Tu privacidad importa
Usamos cookies esenciales para que el sitio funcione y, con tu permiso, cookies de Google para medir la audiencia y mostrar anuncios, incluso personalizados, que mantienen gratuitas las herramientas. Puedes cambiar tu elección en cualquier momento en “Preferencias de cookies”, en el pie de página. Más información.
