Vulnerabilidades em [UNKNOWN]

239 resultados
Análise Vexday

Com 240 CVEs catalogadas e taxa de exploração ativa em linha com a média geral do catálogo, o perfil deste vendor não apresenta desvios alarmantes em volume, mas concentra atenção em pontos específicos. O valor máximo de EPSS observado (0,9179) indica que ao menos uma vulnerabilidade possui probabilidade muito elevada de exploração, e a CVE em exploração ativa confirmada pelo CISA KEV — CVE-2018-14667, com EPSS de 0,7417 — representa risco concreto e imediato, especialmente por ser uma falha com anos de exposição ainda não completamente mitigada em ambientes desatualizados. A falha mais comum é CWE-20 (validação inadequada de entrada), padrão que frequentemente viabiliza execução remota de código e injeção de dados maliciosos, e cuja presença recorrente sugere lacunas sistêmicas no tratamento de entradas. Com 11 CVEs com PoC pública e 7 de severidade crítica, equipes de segurança devem priorizar a verificação de exposição às vulnerabilidades com maior EPSS, mesmo na ausência de novas CVEs nos últimos 90 dias.

CVE-2019-14902MEDIUMThere is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4EPSS 1.4%CVE-2018-10859MEDIUMgit-annex is vulnerable to an Information Exposure when decrypting files. A malicious server for a special remote could trick git-annex intoEPSS 1.4%CVE-2018-10843HIGHsource-to-image component of Openshift Container Platform before versions atomic-openshift 3.7.53, atomic-openshift 3.9.31 is vulnerable to EPSS 1.4%CVE-2018-1090MEDIUMIn Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable to all users with reaEPSS 1.3%CVE-2019-10221MEDIUMA Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. EPSS 1.3%CVE-2019-14824MEDIUMA flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configEPSS 1.3%CVE-2018-10912MEDIUMkeycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could miEPSS 1.3%CVE-2017-2604MEDIUMIn Jenkins before versions 2.44, 2.32.2 low privilege users were able to act on administrative monitors due to them not being consistently pEPSS 1.3%CVE-2018-1122HIGHprocps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-contEPSS 1.3%CVE-2019-10169MEDIUMA flaw was found in Keycloak’s user-managed access interface, where it would permit a script to be set in the UMA policy. This flaw allows aEPSS 1.3%CVE-2018-10864MEDIUMAn uncontrolled resource consumption flaw has been discovered in redhat-certification in the way documents are loaded. A remote attacker mayEPSS 1.2%CVE-2017-2672MEDIUMA flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with access to the foreman log EPSS 1.2%CVE-2018-1116MEDIUMA flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization functionEPSS 1.2%CVE-2018-10908MEDIUMIt was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafEPSS 1.2%CVE-2019-14860HIGHIt was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lackEPSS 1.2%CVE-2019-10170MEDIUMA flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy. This flaw alEPSS 1.2%CVE-2017-2639MEDIUMIt was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when using a custom CA and EPSS 1.1%CVE-2017-2654LOWjenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure. The Email Extension Plugins is able to send emails to a dyEPSS 1.1%CVE-2018-10892MEDIUMThe default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw alloEPSS 1.1%CVE-2019-14881MEDIUMA vulnerability was found in moodle 3.7 before 3.7.3, where there is blind XSS reflected in some locations where user email is displayed.EPSS 1.1%