Base de datos CVE
Archivo de vulnerabilidades conocidas (CVE) con puntuación CVSS, gravedad, productos y fabricantes afectados. Filtra por año y severidad.
- CVE-2015-0311Crítica9.8
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in January 2015.
- CVE-2015-0310Alta7.8
Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism on Windows, and have an unspecified impact on other platforms, via unknown vectors, as exploited in the wild in January 2015.
- CVE-2015-0016Alta7.8
Directory traversal vulnerability in the TS WebProxy (aka TSWbPrxy) component in Microsoft Windows Vista SP2, Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to gain privileges via a crafted pathname in an executable file, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Directory Traversal Elevation of Privilege Vulnerability."
- CVE-2014-100005Alta8.0
Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account or (2) enable remote management via a crafted configuration module to hedwig.cgi, (3) activate new configuration settings via a SETCFG,SAVE,ACTIVATE action to pigwidgeon.cgi, or (4) send a ping via a ping action to diagnostic.php.
- CVE-2014-9163Alta7.8
Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in December 2014.
- CVE-2014-8439Alta8.8
Adobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and OS X and before 11.2.202.424 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allow attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference) via unspecified vectors.
- CVE-2014-6324Alta8.8
The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote authenticated domain users to obtain domain administrator privileges via a forged signature in a ticket, as exploited in the wild in November 2014, aka "Kerberos Checksum Vulnerability."
- CVE-2014-6332Alta8.8
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted web site, as demonstrated by an array-redimensioning attempt that triggers improper handling of a size value in the SafeArrayDimen function, aka "Windows OLE Automation Array Remote Code Execution Vulnerability."
- CVE-2014-4077Alta7.8
Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Office 2007 SP3, when IMJPDCT.EXE (aka IME for Japanese) is installed, allow remote attackers to bypass a sandbox protection mechanism via a crafted PDF document, aka "Microsoft IME (Japanese) Elevation of Privilege Vulnerability," as exploited in the wild in 2014.
- CVE-2014-6352Alta7.8
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object, as exploited in the wild in October 2014 with a crafted PowerPoint document.
- CVE-2014-4148Alta8.8
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted TrueType font, as exploited in the wild in October 2014, aka "TrueType Font Parsing Remote Code Execution Vulnerability."
- CVE-2014-4123Alta8.8
Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," as exploited in the wild in October 2014, a different vulnerability than CVE-2014-4124.
- CVE-2014-4114Alta7.8
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object in an Office document, as exploited in the wild with a "Sandworm" attack in June through October 2014, aka "Windows OLE Remote Code Execution Vulnerability."
- CVE-2014-4113Alta7.8
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, as exploited in the wild in October 2014, aka "Win32k.sys Elevation of Privilege Vulnerability."
- CVE-2014-6287Crítica9.8
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.
- CVE-2014-6278Alta8.8
GNU Bash hasta la versión 4.3 bash43-026 no analiza correctamente las definiciones de funciones en los valores de las variables de entorno, lo que permite a atacantes remotos ejecutar comandos arbitrarios mediante un entorno manipulado, como se demostró con vectores que involucran la función ForceCommand de OpenSSH sshd, los módulos mod_cgi y mod_cgid del servidor HTTP Apache, scripts ejecutados por clientes DHCP no especificados, y otras situaciones en las que la configuración del entorno cruza un límite de privilegios desde la ejecución de Bash. NOTA: esta vulnerabilidad existe debido a una corrección incompleta de CVE-2014-6271, CVE-2014-7169 y CVE-2014-6277.
- CVE-2014-6277Crítica10.0
GNU Bash hasta 4.3 bash43-026 no analiza correctamente las definiciones de funciones en los valores de las variables de entorno, lo que permite a atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (acceso a memoria no inicializada y operaciones de lectura y escritura de punteros no confiables) mediante un entorno manipulado, como demuestran los vectores que implican la función ForceCommand de OpenSSH sshd, los módulos mod_cgi y mod_cgid de Apache HTTP Server, scripts ejecutados por clientes DHCP no especificados y otras situaciones en las que la configuración del entorno se produce a través de un límite de privilegios desde la ejecución de Bash. NOTA: esta vulnerabilidad existe debido a una corrección incompleta de CVE-2014-6271 y CVE-2014-7169.
- CVE-2014-7169Crítica9.8
GNU Bash hasta la versión 4.3 bash43-025 procesa cadenas finales tras ciertas definiciones de función mal formadas en los valores de las variables de entorno, lo que permite a atacantes remotos escribir en archivos o, posiblemente, causar otro impacto desconocido mediante un entorno manipulado, como se demostró con vectores que involucran la característica ForceCommand en OpenSSH sshd, los módulos mod_cgi y mod_cgid del Servidor HTTP Apache, scripts ejecutados por clientes DHCP no especificados, y otras situaciones en las que establecer el entorno ocurre a través de un límite de privilegios desde la ejecución de Bash. NOTA: esta vulnerabilidad existe debido a una corrección incompleta de CVE-2014-6271.
- CVE-2014-6271Crítica9.8
GNU Bash hasta la versión 4.3 procesa cadenas finales posteriores a las definiciones de funciones en los valores de las variables de entorno, lo que permite a atacantes remotos ejecutar código arbitrario mediante un entorno manipulado, como se demostró con vectores que involucran la función ForceCommand de OpenSSH sshd, los módulos mod_cgi y mod_cgid del servidor HTTP Apache, scripts ejecutados por clientes DHCP no especificados, y otras situaciones en las que el establecimiento del entorno ocurre a través de un límite de privilegios desde la ejecución de Bash, también conocido como "ShellShock". NOTA: la corrección original de este problema fue incorrecta; se ha asignado CVE-2014-7169 para cubrir la vulnerabilidad que sigue presente tras la corrección incorrecta.
- CVE-2014-4404Alta7.8
Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted key-mapping properties.
This product uses the NVD API but is not endorsed or certified by the NVD.