Vulnerabilidades em Facebook

144 resultados
Análise Vexday

Com 140 CVEs catalogadas, o histórico do Facebook apresenta uma taxa de exploração ativa 4,8 vezes acima da média geral do catálogo CISA KEV, o que indica que vulnerabilidades nesse ecossistema têm probabilidade significativamente maior de serem efetivamente armadas por atacantes. O tipo de falha mais recorrente é CWE-122 (heap-based buffer overflow), categoria que historicamente viabiliza execução de código e elevação de privilégios. A CVE mais perigosa em exploração ativa no momento é CVE-2019-18426, com score EPSS de 0,6786 — valor elevado que reflete alta probabilidade de exploração — e deve ser tratada como prioridade imediata em qualquer plano de remediação. As 14 CVEs críticas, 4 com PoC pública e 3 surgidas nos últimos 90 dias reforçam a necessidade de monitoramento contínuo e ciclos curtos de aplicação de patches.

CVE-2023-49062—Katran could disclose non-initialized kernel memory as part of an IP header. The issue was present for IPv4 encapsulation and ICMP (v4) Too EPSS 0.6%CVE-2026-44909HIGHProxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could expEPSS 0.6%CVE-2026-23863MEDIUMAn attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents wEPSS 0.5%CVE-2022-36937CRITICALHHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension. TLS1.0 has numerouEPSS 0.5%CVE-2018-6336HIGHAn issue was discovered in osquery. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing EPSS 0.5%CVE-2024-45773HIGHA use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code executionEPSS 0.5%CVE-2026-23866MEDIUMIncomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for AndroidEPSS 0.5%CVE-2021-24031—In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matchinEPSS 0.4%CVE-2020-1885—Writing to an unprivileged file from a privileged OVRRedir.exe process in Oculus Desktop before 1.44.0.32849 on Windows allows local users tEPSS 0.4%CVE-2020-36838HIGHFacebook Chat Plugin <= 1.5 - Missing Capabilities CheckEPSS 0.4%CVE-2024-45863MEDIUMA null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to crash or potentially rEPSS 0.4%CVE-2021-24032—Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output fileEPSS 0.3%CVE-2020-1906—A buffer overflow in WhatsApp for Android prior to v2.20.130 and WhatsApp Business for Android prior to v2.20.46 could have allowed an out-oEPSS 0.3%CVE-2025-55181MEDIUMSending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blEPSS 0.3%CVE-2020-1908—Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of SEPSS 0.3%CVE-2025-30403HIGHA heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session. This issue affects mvfst veEPSS 0.3%CVE-2023-38537MEDIUMA race condition in a network transport subsystem led to a heap use-after-free issue in established or unsilenced incoming audio/video callsEPSS 0.2%CVE-2026-49059MEDIUMWordPress Facebook for WooCommerce plugin <= 3.7.0 - Open Redirection vulnerabilityEPSS 0.2%CVE-2021-24038—Due to a bug with management of handles in OVRServiceLauncher.exe, an attacker could expose a privileged process handle to an unprivileged pEPSS 0.2%CVE-2025-64296MEDIUMWordPress Facebook for WooCommerce plugin <= 3.5.7 - Broken Access Control to Notice Dismissal vulnerabilityEPSS 0.2%