Radar de Segurança

CVE-2025-24054 Severidade em análise no catálogo em 17/04/2025

Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability

Microsoft · Windows · CWE-73

Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network. EN

CVE-2021-20035 Severidade em análise no catálogo em 16/04/2025

SonicWall SMA100 Appliances OS Command Injection Vulnerability

SonicWall · SMA100 Appliances · CWE-78

SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution. EN

CVE-2024-53197 Severidade em análise no catálogo em 09/04/2025

Linux Kernel Out-of-Bounds Access Vulnerability

Linux · Kernel · CWE-787

Linux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the system to use a malicious USB device to potentially manipulate system memory, escalate privileges, or execute arbitrary code. EN

CVE-2024-53150 Severidade em análise no catálogo em 09/04/2025

Linux Kernel Out-of-Bounds Read Vulnerability

Linux · Kernel · CWE-125

Linux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain potentially sensitive information. EN

CVE-2025-29824 Severidade em análise Ransomware no catálogo em 08/04/2025

Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability

Microsoft · Windows · CWE-416

Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. EN

CVE-2025-22457 Severidade em análise Ransomware no catálogo em 04/04/2025

Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

Ivanti · Connect Secure, Policy Secure, and ZTA Gateways · CWE-121

Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution. EN

CVE-2025-24813 Severidade em análise no catálogo em 01/04/2025

Apache Tomcat Path Equivalence Vulnerability

Apache · Tomcat · CWE-44, CWE-502

Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486. EN

CVE-2024-20439 Severidade em análise no catálogo em 31/03/2025

Cisco Smart Licensing Utility Static Credential Vulnerability

Cisco · Smart Licensing Utility · CWE-912

Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials. EN

CVE-2025-2783 Severidade em análise no catálogo em 27/03/2025

Google Chromium Mojo Sandbox Escape Vulnerability

Google · Chromium Mojo

Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. EN

CVE-2017-12637 Severidade em análise no catálogo em 19/03/2025

SAP NetWeaver Directory Traversal Vulnerability

SAP · NetWeaver · CWE-22

SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string. EN

CVE-2025-24472 Severidade em análise Ransomware no catálogo em 18/03/2025

Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

Fortinet · FortiOS and FortiProxy · CWE-288

Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests. EN

CVE-2025-21590 Severidade em análise no catálogo em 13/03/2025

Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability

Juniper · Junos OS · CWE-653

Juniper Junos OS contains an improper isolation or compartmentalization vulnerability. This vulnerability could allows a local attacker with high privileges to inject arbitrary code. EN

CVE-2025-26633 Severidade em análise Ransomware no catálogo em 11/03/2025

Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability

Microsoft · Windows · CWE-707

Microsoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally. EN

CVE-2025-24993 Severidade em análise no catálogo em 11/03/2025

Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability

Microsoft · Windows · CWE-122

Microsoft Windows New Technology File System (NTFS) contains a heap-based buffer overflow vulnerability that allows an unauthorized attacker to execute code locally. EN

CVE-2025-24991 Severidade em análise no catálogo em 11/03/2025

Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability

Microsoft · Windows · CWE-125

Microsoft Windows New Technology File System (NTFS) contains an out-of-bounds read vulnerability that allows an authorized attacker to disclose information locally. EN

CVE-2025-24985 Severidade em análise no catálogo em 11/03/2025

Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability

Microsoft · Windows · CWE-190, CWE-122

Microsoft Windows Fast FAT File System Driver contains an integer overflow or wraparound vulnerability that allows an unauthorized attacker to execute code locally. EN

CVE-2025-24984 Severidade em análise no catálogo em 11/03/2025

Microsoft Windows NTFS Information Disclosure Vulnerability

Microsoft · Windows · CWE-532

Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory. EN

CVE-2025-24983 Severidade em análise no catálogo em 11/03/2025

Microsoft Windows Win32k Use-After-Free Vulnerability

Microsoft · Windows · CWE-416

Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. EN

CVE-2024-13161 Severidade em análise no catálogo em 10/03/2025

Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

Ivanti · Endpoint Manager (EPM) · CWE-36

Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information. EN

CVE-2024-13160 Severidade em análise no catálogo em 10/03/2025

Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

Ivanti · Endpoint Manager (EPM) · CWE-36

Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information. EN

CVE-2024-13159 Severidade em análise no catálogo em 10/03/2025

Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability

Ivanti · Endpoint Manager (EPM) · CWE-36

Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information. EN

CVE-2025-22226 Severidade em análise no catálogo em 04/03/2025

VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability

VMware · ESXi, Workstation, and Fusion · CWE-125

VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. Successful exploitation allows an attacker with administrative privileges to a virtual machine to leak memory from the vmx process. EN

CVE-2025-22225 Severidade em análise Ransomware no catálogo em 04/03/2025

VMware ESXi Arbitrary Write Vulnerability

VMware · ESXi · CWE-123

VMware ESXi contains an arbitrary write vulnerability. Successful exploitation allows an attacker with privileges within the VMX process to trigger an arbitrary kernel write leading to an escape of the sandbox. EN

CVE-2025-22224 Severidade em análise no catálogo em 04/03/2025

VMware ESXi and Workstation TOCTOU Race Condition Vulnerability

VMware · ESXi and Workstation · CWE-367

VMware ESXi and Workstation contain a time-of-check time-of-use (TOCTOU) race condition vulnerability that leads to an out-of-bounds write. Successful exploitation enables an attacker with local administrative privileges on a virtual machine to execute code as the virtual machine's VMX process running on the host. EN