Vulnerabilidades em HackerOne

470 resultados
Análise Vexday

Com 470 CVEs catalogadas e nenhuma entrada no catálogo CISA KEV, o perfil de risco ativo do HackerOne situa-se abaixo da média geral do catálogo, sem registros de exploração confirmada no momento. A ausência de vulnerabilidades críticas e de novos registros nos últimos 90 dias sugere estabilidade recente no volume de descobertas, embora a existência de uma PoC pública mereça atenção por ampliar a superfície de exploração potencial. O CWE-311 — relacionado à ausência ou proteção inadequada de dados sensíveis em trânsito ou armazenamento — representa o tipo de falha mais recorrente, indicando uma área técnica que justifica revisão continuada de controles criptográficos. A CVE mais relevante no momento, CVE-2017-0901, apresenta EPSS de 0,2944, sinalizando probabilidade não desprezível de exploração e recomendando priorização no processo de remediação, mesmo sem confirmação de exploração ativa catalogada.

CVE-2016-10689—The windows-iedriver module downloads fixed version of iedriverserver.exe windows-iedriver downloads binary resources over HTTP, which leaveEPSS 1.7%CVE-2016-10683—arcanist downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) EPSS 1.7%CVE-2016-10607—openframe-glsviewer is a Openframe extension which adds support for shaders via glslViewer. openframe-glsviewer downloads binary resources oEPSS 1.7%CVE-2016-10571—bkjs-wand is imagemagick wand support for node.js and backendjs bkjs-wand versions lower than 0.3.2 download binary resources over HTTP, whiEPSS 1.7%CVE-2016-10572—mongodb-instance before 0.0.3 installs mongodb locally. mongodb-instance downloads binary resources over HTTP, which leaves it vulnerable toEPSS 1.7%CVE-2016-10617—box2d-native downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execuEPSS 1.7%CVE-2016-10672—cloudpub-redis is a module for CloudPub: Redis Backend cloudpub-redis downloads binary resources over HTTP, which leaves it vulnerable to MIEPSS 1.7%CVE-2016-10657—co-cli-installer downloads the co-cli module as part of the install process, but does so over HTTP, which leaves it vulnerable to MITM attacEPSS 1.7%CVE-2016-10599—sauce-connect is a Node.js wrapper over the SauceLabs SauceConnect.jar program for establishing a secure tunnel for intranet testing. sauce-EPSS 1.7%CVE-2016-10664—mystem is a Node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem downloads binary resources over HTTP, which leaves it vuEPSS 1.7%CVE-2016-10629—nw-with-arm is a NW Installer including ARM-Build. nw-with-arm downloads binary resources over HTTP, which leaves it vulnerable to MITM attaEPSS 1.7%CVE-2016-10670—windows-seleniumjar-mirror downloads the Selenium Jar file windows-seleniumjar-mirror downloads binary resources over HTTP, which leaves it EPSS 1.7%CVE-2016-10582—closurecompiler is a Closure Compiler for node.js. closurecompiler downloads binary resources over HTTP, which leaves it vulnerable to MITM EPSS 1.7%CVE-2016-10626—mystem3 is a NodeJS wrapper for the Yandex MyStem 3. mystem3 downloads binary resources over HTTP, which leaves it vulnerable to MITM attackEPSS 1.7%CVE-2016-10631—jvminstall is a module for downloading and unpacking jvm to local system. jvminstall downloads binary resources over HTTP, which leaves it vEPSS 1.7%CVE-2016-10651—webdriver-launcher is a Node.js Selenium Webdriver Launcher. webdriver-launcher downloads binary resources over HTTP, which leaves it vulnerEPSS 1.7%CVE-2016-10562—iedriver is an NPM wrapper for Selenium IEDriver. iedriver versions below 3.0.0 download binary resources over HTTP, which leaves the moduleEPSS 1.7%CVE-2016-10606—grunt-webdriver-qunit is a grunt plugin to run qunit with webdriver in grunt grunt-webdriver-qunit downloads binary resources over HTTP, whiEPSS 1.7%CVE-2016-10643—jstestdriver is a wrapper for Google's jstestdriver. jstestdriver downloads binary resources over HTTP, which leaves it vulnerable to MITM aEPSS 1.7%CVE-2016-10638—js-given is a JavaScript frontend to jgiven. js-given downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It mEPSS 1.7%