Radar de Segurança

CVE-2025-49706 Severidade em análise Ransomware no catálogo em 22/07/2025

Microsoft SharePoint Improper Authentication Vulnerability

Microsoft · SharePoint · CWE-287

Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706. EN

CVE-2025-49704 Severidade em análise Ransomware no catálogo em 22/07/2025

Microsoft SharePoint Code Injection Vulnerability

Microsoft · SharePoint · CWE-94

Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704. EN

CVE-2025-53770 Severidade em análise Ransomware no catálogo em 20/07/2025

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Microsoft · SharePoint · CWE-502

Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704. EN

CVE-2025-25257 Severidade em análise no catálogo em 18/07/2025

Fortinet FortiWeb SQL Injection Vulnerability

Fortinet · FortiWeb · CWE-89

Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests. EN

CVE-2025-5777 Severidade em análise Ransomware no catálogo em 10/07/2025

Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability

Citrix · NetScaler ADC and Gateway · CWE-125

Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server. EN

CVE-2016-10033 Severidade em análise no catálogo em 07/07/2025

PHPMailer Command Injection Vulnerability

PHP · PHPMailer · CWE-77, CWE-88

PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition. EN

CVE-2025-6554 Severidade em análise no catálogo em 02/07/2025

Google Chromium V8 Type Confusion Vulnerability

Google · Chromium V8 · CWE-843

Google Chromium V8 contains a type confusion vulnerability that could allow a remote attacker to perform arbitrary read/write via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. EN

CVE-2025-6543 Severidade em análise no catálogo em 30/06/2025

Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability

Citrix · NetScaler ADC and Gateway · CWE-119

Citrix NetScaler ADC and Gateway contain a buffer overflow vulnerability leading to unintended control flow and Denial of Service. NetScaler must be configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server. EN

CVE-2019-6693 Severidade em análise Ransomware no catálogo em 25/06/2025

Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability

Fortinet · FortiOS · CWE-798

Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key. EN

CVE-2023-0386 Severidade em análise no catálogo em 17/06/2025

Linux Kernel Improper Ownership Management Vulnerability

Linux · Kernel · CWE-282

Linux Kernel contains an improper ownership management vulnerability, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system. EN

CVE-2025-33053 Severidade em análise no catálogo em 10/06/2025

Microsoft Windows External Control of File Name or Path Vulnerability

Microsoft · Windows · CWE-73

Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files. EN

CVE-2025-5419 Severidade em análise no catálogo em 05/06/2025

Google Chromium V8 Out-of-Bounds Read and Write Vulnerability

Google · Chromium V8 · CWE-125, CWE-787

Google Chromium V8 contains an out-of-bounds read and write vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. EN

CVE-2025-4428 Severidade em análise no catálogo em 19/05/2025

Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

Ivanti · Endpoint Manager Mobile (EPMM) · CWE-94

Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in the API component that allows an authenticated attacker to remotely execute arbitrary code via crafted API requests. This vulnerability results from an insecure implementation of the Hibernate Validator open-source library, as represented by CVE-2025-35036. EN

CVE-2025-4427 Severidade em análise no catálogo em 19/05/2025

Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability

Ivanti · Endpoint Manager Mobile (EPMM) · CWE-288

Ivanti Endpoint Manager Mobile (EPMM) contains an authentication bypass vulnerability in the API component that allows an attacker to access protected resources without proper credentials via crafted API requests. This vulnerability results from an insecure implementation of the Spring Framework open-source library. EN

CVE-2025-42999 Severidade em análise Ransomware no catálogo em 15/05/2025

SAP NetWeaver Deserialization Vulnerability

SAP · NetWeaver · CWE-502

SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content. EN

CVE-2025-32756 Severidade em análise no catálogo em 14/05/2025

Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability

Fortinet · Multiple Products · CWE-124

Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests. EN

CVE-2025-32709 Severidade em análise no catálogo em 13/05/2025

Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

Microsoft · Windows · CWE-416

Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to escalate privileges to administrator. EN

CVE-2025-32706 Severidade em análise no catálogo em 13/05/2025

Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability

Microsoft · Windows · CWE-122

Microsoft Windows Common Log File System (CLFS) Driver contains a heap-based buffer overflow vulnerability that allows an authorized attacker to elevate privileges locally. EN

CVE-2025-32701 Severidade em análise no catálogo em 13/05/2025

Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability

Microsoft · Windows · CWE-416

Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. EN

CVE-2025-30400 Severidade em análise no catálogo em 13/05/2025

Microsoft Windows DWM Core Library Use-After-Free Vulnerability

Microsoft · Windows · CWE-416

Microsoft Windows DWM Core Library contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. EN

CVE-2025-30397 Severidade em análise no catálogo em 13/05/2025

Microsoft Windows Scripting Engine Type Confusion Vulnerability

Microsoft · Windows · CWE-843

Microsoft Windows Scripting Engine contains a type confusion vulnerability that allows an unauthorized attacker to execute code over a network via a specially crafted URL. EN

CVE-2024-38475 Severidade em análise no catálogo em 01/05/2025

Apache HTTP Server Improper Escaping of Output Vulnerability

Apache · HTTP Server · CWE-116

Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. EN

CVE-2023-44221 Severidade em análise no catálogo em 01/05/2025

SonicWall SMA100 Appliances OS Command Injection Vulnerability

SonicWall · SMA100 Appliances · CWE-78

SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user. EN

CVE-2025-31324 Severidade em análise Ransomware no catálogo em 29/04/2025

SAP NetWeaver Unrestricted File Upload Vulnerability

SAP · NetWeaver · CWE-434

SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries. EN