Radar de Segurança

CVE-2025-47729 Severidade em análise no catálogo em 12/05/2025

TeleMessage TM SGNL Hidden Functionality Vulnerability

TeleMessage · TM SGNL · CWE-912

TeleMessage TM SGNL contains a hidden functionality vulnerability in which the archiving backend holds cleartext copies of messages from TM SGNL application users. EN

CVE-2024-6047 Severidade em análise no catálogo em 07/05/2025

GeoVision Devices OS Command Injection Vulnerability

GeoVision · Multiple Devices · CWE-78

Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. EN

CVE-2024-11120 Severidade em análise no catálogo em 07/05/2025

GeoVision Devices OS Command Injection Vulnerability

GeoVision · Multiple Devices · CWE-78

Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. EN

CVE-2025-27363 Severidade em análise no catálogo em 06/05/2025

FreeType Out-of-Bounds Write Vulnerability

FreeType · FreeType · CWE-787

FreeType contains an out-of-bounds write vulnerability when attempting to parse font subglyph structures related to TrueType GX and variable font files that may allow for arbitrary code execution. EN

CVE-2025-3248 Severidade em análise Ransomware no catálogo em 05/05/2025

Langflow Missing Authentication Vulnerability

Langflow · Langflow · CWE-306

Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests. EN

CVE-2025-34028 Severidade em análise no catálogo em 02/05/2025

Commvault Command Center Path Traversal Vulnerability

Commvault · Command Center · CWE-22

Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code. EN

CVE-2024-58136 Severidade em análise no catálogo em 02/05/2025

Yiiframework Yii Improper Protection of Alternate Path Vulnerability

Yiiframework · Yii · CWE-424

Yii Framework contains an improper protection of alternate path vulnerability that may allow a remote attacker to execute arbitrary code. This vulnerability could affect other products that implement Yii, including—but not limited to—Craft CMS, as represented by CVE-2025-32432. EN

CVE-2024-38475 Severidade em análise no catálogo em 01/05/2025

Apache HTTP Server Improper Escaping of Output Vulnerability

Apache · HTTP Server · CWE-116

Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. EN

CVE-2023-44221 Severidade em análise no catálogo em 01/05/2025

SonicWall SMA100 Appliances OS Command Injection Vulnerability

SonicWall · SMA100 Appliances · CWE-78

SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user. EN

CVE-2025-31324 Severidade em análise Ransomware no catálogo em 29/04/2025

SAP NetWeaver Unrestricted File Upload Vulnerability

SAP · NetWeaver · CWE-434

SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries. EN

CVE-2025-42599 Severidade em análise no catálogo em 28/04/2025

Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability

Qualitia · Active! Mail · CWE-121

Qualitia Active! Mail contains a stack-based buffer overflow vulnerability that allows a remote, unauthenticated attacker to execute arbitrary or trigger a denial-of-service via a specially crafted request. EN

CVE-2025-3928 Severidade em análise no catálogo em 28/04/2025

Commvault Web Server Unspecified Vulnerability

Commvault · Web Server

Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells. EN

CVE-2025-1976 Severidade em análise no catálogo em 28/04/2025

Broadcom Brocade Fabric OS Code Injection Vulnerability

Broadcom · Brocade Fabric OS · CWE-94

Broadcom Brocade Fabric OS contains a code injection vulnerability that allows a local user with administrative privileges to execute arbitrary code with full root privileges. EN

CVE-2025-31201 Severidade em análise no catálogo em 17/04/2025

Apple Multiple Products Arbitrary Read and Write Vulnerability

Apple · Multiple Products

Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Pointer Authentication. EN

CVE-2025-31200 Severidade em análise no catálogo em 17/04/2025

Apple Multiple Products Memory Corruption Vulnerability

Apple · Multiple Products

Apple iOS, iPadOS, macOS, and other Apple products contain a memory corruption vulnerability that allows for code execution when processing an audio stream in a maliciously crafted media file. EN

CVE-2025-24054 Severidade em análise no catálogo em 17/04/2025

Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability

Microsoft · Windows · CWE-73

Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network. EN

CVE-2021-20035 Severidade em análise no catálogo em 16/04/2025

SonicWall SMA100 Appliances OS Command Injection Vulnerability

SonicWall · SMA100 Appliances · CWE-78

SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution. EN

CVE-2024-53197 Severidade em análise no catálogo em 09/04/2025

Linux Kernel Out-of-Bounds Access Vulnerability

Linux · Kernel · CWE-787

Linux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the system to use a malicious USB device to potentially manipulate system memory, escalate privileges, or execute arbitrary code. EN

CVE-2024-53150 Severidade em análise no catálogo em 09/04/2025

Linux Kernel Out-of-Bounds Read Vulnerability

Linux · Kernel · CWE-125

Linux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain potentially sensitive information. EN

CVE-2025-30406 Severidade em análise no catálogo em 08/04/2025

Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability

Gladinet · CentreStack · CWE-321

Gladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys used for ViewState integrity verification. Successful exploitation allows an attacker to forge ViewState payloads for server-side deserialization, allowing for remote code execution. EN

CVE-2025-29824 Severidade em análise Ransomware no catálogo em 08/04/2025

Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability

Microsoft · Windows · CWE-416

Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. EN

CVE-2025-31161 Severidade em análise Ransomware no catálogo em 07/04/2025

CrushFTP Authentication Bypass Vulnerability

CrushFTP · CrushFTP · CWE-305

CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise. EN

CVE-2025-22457 Severidade em análise Ransomware no catálogo em 04/04/2025

Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

Ivanti · Connect Secure, Policy Secure, and ZTA Gateways · CWE-121

Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution. EN

CVE-2025-24813 Severidade em análise no catálogo em 01/04/2025

Apache Tomcat Path Equivalence Vulnerability

Apache · Tomcat · CWE-44, CWE-502

Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486. EN