Vulnerabilidades (CVE) que estão sendo exploradas ativamente, segundo o catálogo KEV da CISA, com severidade CVSS e probabilidade de exploração (EPSS).
35exploradas nos últimos 30 dias
13críticas (CVSS ≥ 9)
0usadas em ransomware
1769no catálogo KEV
CVE-2022-27518Severidade em análiseno catálogo em 13/12/2022
Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability
Citrix · Application Delivery Controller (ADC) and Gateway · CWE-664
Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator. EN
CVE-2022-26501Severidade em análiseRansomwareno catálogo em 13/12/2022
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code. EN
CVE-2022-26500Severidade em análiseRansomwareno catálogo em 13/12/2022
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code. EN
CVE-2022-4262Severidade em análiseno catálogo em 05/12/2022
Google Chromium V8 Type Confusion Vulnerability
Google · Chromium V8 · CWE-122, CWE-843
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. EN
CVE-2022-4135Severidade em análiseno catálogo em 28/11/2022
Google Chromium GPU Heap Buffer Overflow Vulnerability
Google · Chromium GPU · CWE-787
Google Chromium GPU contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. EN
CVE-2021-35587Severidade em análiseno catálogo em 28/11/2022
Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product. EN
CVE-2022-41049Severidade em análiseno catálogo em 14/11/2022
Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability
Microsoft · Windows · CWE-274
Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features. EN
CVE-2022-41128Severidade em análiseno catálogo em 08/11/2022
Microsoft Windows Scripting Languages Remote Code Execution Vulnerability
Microsoft · Windows · CWE-787
Microsoft Windows contains an unspecified vulnerability in the JScript9 scripting language which allows for remote code execution. EN
CVE-2022-41125Severidade em análiseno catálogo em 08/11/2022
Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability
Microsoft · Windows · CWE-787
Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges. EN
CVE-2022-41091Severidade em análiseRansomwareno catálogo em 08/11/2022
Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability
Microsoft · Windows · CWE-863
Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features. EN
CVE-2022-41073Severidade em análiseRansomwareno catálogo em 08/11/2022
Microsoft Windows Print Spooler Privilege Escalation Vulnerability
Microsoft · Windows · CWE-787
Microsoft Windows Print Spooler contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges. EN
CVE-2022-3723Severidade em análiseno catálogo em 28/10/2022
Google Chromium V8 Type Confusion Vulnerability
Google · Chromium V8 · CWE-122, CWE-843
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. EN
CVE-2020-3433Severidade em análiseRansomwareno catálogo em 24/10/2022
Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability
Cisco · AnyConnect Secure · CWE-427
Cisco AnyConnect Secure Mobility Client for Windows interprocess communication (IPC) channel allows for insufficient validation of resources that are loaded by the application at run time. An attacker with valid credentials on Windows could execute code on the affected machine with SYSTEM privileges. EN
CVE-2020-3153Severidade em análiseRansomwareno catálogo em 24/10/2022
Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
Cisco · AnyConnect Secure · CWE-427
Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. EN
CVE-2021-3493Severidade em análiseno catálogo em 20/10/2022
Linux Kernel Privilege Escalation Vulnerability
Linux · Kernel · CWE-862
The overlayfs stacking file system in Linux kernel does not properly validate the application of file capabilities against user namespaces, which could lead to privilege escalation. EN
CVE-2022-41033Severidade em análiseno catálogo em 11/10/2022
Microsoft Windows COM+ Event System Service Privilege Escalation Vulnerability
Microsoft · Windows COM+ Event System Service · CWE-843
Microsoft Windows COM+ Event System Service contains an unspecified vulnerability that allows for privilege escalation. EN
CVE-2022-40684Severidade em análiseRansomwareno catálogo em 11/10/2022
Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests. EN
CVE-2022-41082Severidade em análiseRansomwareno catálogo em 30/09/2022
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange Server · CWE-502
Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution. EN
CVE-2022-41040Severidade em análiseRansomwareno catálogo em 30/09/2022
Microsoft Exchange Server Server-Side Request Forgery Vulnerability
Microsoft · Exchange Server · CWE-918
Microsoft Exchange Server allows for server-side request forgery. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution. EN
CVE-2022-36804Severidade em análiseno catálogo em 30/09/2022
Atlassian Bitbucket Server and Data Center Command Injection Vulnerability
Atlassian · Bitbucket Server and Data Center · CWE-78, CWE-88, CWE-158
Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request. EN
CVE-2013-6282Severidade em análiseno catálogo em 15/09/2022
Linux Kernel Improper Input Validation Vulnerability
Linux · Kernel · CWE-20
The get_user and put_user API functions of the Linux kernel fail to validate the target address when being used on ARM v6k/v7 platforms. This allows an application to read and write kernel memory which could lead to privilege escalation. EN
CVE-2013-2596Severidade em análiseno catálogo em 15/09/2022
Linux Kernel Integer Overflow Vulnerability
Linux · Kernel · CWE-189
Linux kernel fb_mmap function in drivers/video/fbmem.c contains an integer overflow vulnerability that allows for privilege escalation. EN
CVE-2013-2094Severidade em análiseno catálogo em 15/09/2022
Linux Kernel Privilege Escalation Vulnerability
Linux · Kernel · CWE-189
Linux kernel fails to check all 64 bits of attr.config passed by user space, resulting to out-of-bounds access of the perf_swevent_enabled array in sw_perf_event_destroy(). Explotation allows for privilege escalation. EN
CVE-2010-2568Severidade em análiseno catálogo em 15/09/2022
Microsoft Windows Remote Code Execution Vulnerability
Microsoft · Windows · CWE-20
Microsoft Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the operating system displays the icon of a malicious shortcut file. An attacker who successfully exploited this vulnerability could execute code as the logged-on user. EN
Quer saber se o seu ambiente está exposto?
Avaliamos versões, acessos e integrações do seu ERP e priorizamos as correções.
O Bit é uma IA e pode errar. Não compartilhe senhas ou dados pessoais. As conversas não são armazenadas. Saiba mais
Sua privacidade importa
Usamos cookies essenciais para o site funcionar e, com sua permissão, cookies do Google para medir audiência e exibir anúncios — inclusive personalizados — que mantêm as ferramentas gratuitas. Você pode mudar sua escolha a qualquer momento em “Preferências de cookies”, no rodapé. Saiba mais.
