Vulnerabilidades (CVE) que estão sendo exploradas ativamente, segundo o catálogo KEV da CISA, com severidade CVSS e probabilidade de exploração (EPSS).
34exploradas nos últimos 30 dias
13críticas (CVSS ≥ 9)
0usadas em ransomware
1768no catálogo KEV
CVE-2020-12271Severidade em análiseRansomwareno catálogo em 03/11/2021
Sophos SFOS SQL Injection Vulnerability
Sophos · SFOS · CWE-89
Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords). EN
CVE-2020-11738Severidade em análiseno catálogo em 03/11/2021
WordPress Snap Creek Duplicator Plugin File Download Vulnerability
WordPress · Snap Creek Duplicator Plugin · CWE-22
WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro. EN
CVE-2020-11652Severidade em análiseno catálogo em 03/11/2021
SaltStack Salt Path Traversal Vulnerability
SaltStack · Salt · CWE-22
SaltStack Salt contains a path traversal vulnerability in the salt-master process ClearFuncs which allows directory access to authenticated users. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability. EN
CVE-2020-11651Severidade em análiseno catálogo em 03/11/2021
SaltStack Salt Authentication Bypass Vulnerability
SaltStack · Salt
SaltStack Salt contains an authentication bypass vulnerability in the salt-master process ClearFuncs due to improperly validating method calls. The vulnerability allows a remote user to access some methods without authentication, which can be used to retrieve user tokens from the salt master and/or run commands on salt minions. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability. EN
CVE-2020-1147Severidade em análiseno catálogo em 03/11/2021
Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability
Microsoft · .NET Framework, SharePoint, Visual Studio
Microsoft .NET Framework, Microsoft SharePoint, and Visual Studio contain a remote code execution vulnerability when the software fails to check the source markup of XML file input. Successful exploitation allows an attacker to execute code in the context of the process responsible for deserialization of the XML content. EN
CVE-2020-10987Severidade em análiseno catálogo em 03/11/2021
Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability
Tenda · AC1900 Router AC15 Model · CWE-78
Tenda AC1900 Router AC15 Model contains an unspecified vulnerability that allows remote attackers to execute system commands via the deviceName POST parameter. EN
CVE-2020-1054Severidade em análiseno catálogo em 03/11/2021
Microsoft Win32k Privilege Escalation Vulnerability
Microsoft · Win32k · CWE-787
Microsoft Win32k contains a privilege escalation vulnerability when the Windows kernel-mode driver fails to properly handle objects in memory. Successful exploitation allows an attacker to execute code in kernel mode. EN
CVE-2020-1040Severidade em análiseno catálogo em 03/11/2021
Microsoft Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability
Microsoft · Hyper-V RemoteFX · CWE-20
Microsoft Hyper-V RemoteFX vGPU contains an improper input validation vulnerability due to the host server failing to properly validate input from an authenticated user on a guest operating system. Successful exploitation allows for remote code execution on the host operating system. EN
CVE-2020-10221Severidade em análiseno catálogo em 03/11/2021
rConfig OS Command Injection Vulnerability
rConfig · rConfig · CWE-78
rConfig lib/ajaxHandlers/ajaxAddTemplate.php contains an OS command injection vulnerability that allows remote attackers to execute OS commands via shell metacharacters in the fileName POST parameter. EN
CVE-2020-1020Severidade em análiseno catálogo em 03/11/2021
Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability
Microsoft · Windows · CWE-787
Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities. EN
CVE-2020-10199Severidade em análiseno catálogo em 03/11/2021
Sumavision Enhanced Multimedia Router (EMR) contains a cross-site request forgery (CSRF) vulnerability allowing the creation of users with elevated privileges as administrator on a device. EN
CVE-2020-10148Severidade em análiseno catálogo em 03/11/2021
SolarWinds Orion API contains an authentication bypass vulnerability that could allow a remote attacker to execute API commands. EN
CVE-2020-0986Severidade em análiseno catálogo em 03/11/2021
Microsoft Windows Kernel Privilege Escalation Vulnerability
Microsoft · Windows · CWE-787
Microsoft Windows kernel contains an unspecified vulnerability when handling objects in memory that allows attackers to escalate privileges and execute code in kernel mode. EN
CVE-2020-0968Severidade em análiseRansomwareno catálogo em 03/11/2021
Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
Microsoft · Internet Explorer · CWE-787
Microsoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution. EN
CVE-2020-0938Severidade em análiseno catálogo em 03/11/2021
Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability
Microsoft · Windows · CWE-787
Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities. EN
CVE-2020-0878Severidade em análiseRansomwareno catálogo em 03/11/2021
Microsoft Edge and Internet Explorer Memory Corruption Vulnerability
Microsoft · Edge and Internet Explorer · CWE-787
Microsoft Edge and Internet Explorer contain a memory corruption vulnerability that allows attackers to execute code in the context of the current user. EN
CVE-2020-0688Severidade em análiseRansomwareno catálogo em 03/11/2021
Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability
Microsoft · Exchange Server · CWE-287
Microsoft Exchange Server Validation Key fails to properly create unique keys at install time, allowing for remote code execution. EN
CVE-2020-0683Severidade em análiseno catálogo em 03/11/2021
Microsoft Windows Installer Privilege Escalation Vulnerability
Microsoft · Windows
Microsoft Windows Installer contains a privilege escalation vulnerability when MSI packages process symbolic links, which allows attackers to bypass access restrictions to add or remove files. EN
CVE-2020-0674Severidade em análiseno catálogo em 03/11/2021
Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
Microsoft · Internet Explorer · CWE-416
Microsoft Internet Explorer contains a memory corruption vulnerability due to the way the Scripting Engine handles objects in memory. Successful exploitation could allow remote code execution in the context of the current user. EN
CVE-2020-0646Severidade em análiseno catálogo em 03/11/2021
Microsoft .NET Framework Remote Code Execution Vulnerability
Microsoft · .NET Framework · CWE-91
Microsoft .NET Framework contains an improper input validation vulnerability that allows for remote code execution. EN
CVE-2020-0601Severidade em análiseno catálogo em 03/11/2021
Microsoft Windows CryptoAPI Spoofing Vulnerability
Microsoft · Windows · CWE-295
Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall. EN
CVE-2020-0069Severidade em análiseno catálogo em 03/11/2021
Multiple MediaTek chipsets contain an insufficient input validation vulnerability and have missing SELinux restrictions in the Command Queue drivers ioctl handlers. This causes an out-of-bounds write leading to privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0041 under exploit chain "AbstractEmu." EN
Quer saber se o seu ambiente está exposto?
Avaliamos versões, acessos e integrações do seu ERP e priorizamos as correções.
O Bit é uma IA e pode errar. Não compartilhe senhas ou dados pessoais. As conversas não são armazenadas. Saiba mais
Sua privacidade importa
Usamos cookies essenciais para o site funcionar e, com sua permissão, cookies do Google para medir audiência e exibir anúncios — inclusive personalizados — que mantêm as ferramentas gratuitas. Você pode mudar sua escolha a qualquer momento em “Preferências de cookies”, no rodapé. Saiba mais.
