Exposição de Windows Server

Operating systems
1.429
score de exposição
221.496
sites usam
32
em exploração
3
críticos
Análise Vexday

Windows Server acumula 831 CVEs catalogadas, das quais 33 estão confirmadas em exploração ativa no catálogo KEV da CISA — uma taxa 8,8 vezes acima da média geral do catálogo, o que indica exposição operacional significativamente elevada. A CVE mais perigosa em atividade, CVE-2019-0708, registra EPSS de 1,0, sinalizando probabilidade máxima de exploração e exigindo atenção prioritária em ambientes que ainda não aplicaram a correção correspondente. O tipo de falha mais recorrente é CWE-59 (improper link resolution before file access, ou "link following"), sugerindo que controles de integridade de sistema de arquivos e privilégios de acesso devem compor a linha de defesa prioritária. Embora nenhuma CVE nova tenha surgido nos últimos 90 dias, o perfil histórico da plataforma — com 3 falhas críticas ativas e EPSS máximo observado de 0,99999 — reforça a necessidade de gestão contínua e rigorosa de patches.

CVEs

755 resultados
CVE-2019-1368—A security feature bypass exists when Windows Secure Boot improperly restricts access to debugging functionality, aka 'Windows Secure Boot SEPSS 1.4%CVE-2019-0627—A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka 'Windows Security FeaturEPSS 1.3%CVE-2020-1361—An information disclosure vulnerability exists in the way that the WalletService handles memory.To exploit the vulnerability, an attacker woEPSS 1.3%CVE-2019-1274—An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka 'Windows Kernel InEPSS 1.3%CVE-2019-1282—An information disclosure exists in the Windows Common Log File System (CLFS) driver when it fails to properly handle sandbox checks, aka 'WEPSS 1.3%CVE-2020-1194—A denial of service vulnerability exists when Windows Registry improperly handles filesystem operations, aka 'Windows Registry Denial of SerEPSS 1.3%CVE-2019-0631—A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka 'Windows Security FeaturEPSS 1.3%CVE-2019-0632—A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka 'Windows Security FeaturEPSS 1.3%CVE-2019-1254—An information disclosure vulnerability exists when Windows Hyper-V writes uninitialized memory to disk, aka 'Windows Hyper-V Information DiEPSS 1.3%CVE-2020-1007—An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel InformationEPSS 1.3%CVE-2019-1391—A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'. TEPSS 1.3%CVE-2020-0634—An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aEPSS 1.3%CVE-2019-1339—An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error ReportEPSS 1.3%CVE-2020-0775—An information disclosure vulnerability exists when Windows Error Reporting improperly handles file operations.To exploit this vulnerabilityEPSS 1.3%CVE-2019-1294—A security feature bypass exists when Windows Secure Boot improperly restricts access to debugging functionality, aka 'Windows Secure Boot SEPSS 1.3%CVE-2020-1358—An information disclosure vulnerability exists when the Windows Resource Policy component improperly handles memory.To exploit this vulnerabEPSS 1.3%CVE-2020-1420—An information disclosure vulnerability exists when Windows Error Reporting improperly handles file operations.To exploit this vulnerabilityEPSS 1.3%CVE-2020-1367—An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel InformationEPSS 1.3%CVE-2020-1330—An information disclosure vulnerability exists when Windows Mobile Device Management (MDM) Diagnostics improperly handles junctions, aka 'WiEPSS 1.3%CVE-2020-1386—An information vulnerability exists when Windows Connected User Experiences and Telemetry Service improperly discloses file information, akaEPSS 1.3%