Base de datos CVE
Archivo de vulnerabilidades conocidas (CVE) con puntuación CVSS, gravedad, productos y fabricantes afectados. Filtra por año y severidad.
- CVE-2025-12480Crítica9.1
Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete.
- CVE-2025-64328Alta7.2
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to obtain remote access to the system as an asterisk user. This issue is fixed in version 17.0.3.
- CVE-2025-27918Crítica9.8
An issue was discovered in AnyDesk for Windows before 9.0.5, AnyDesk for macOS before 9.0.1, AnyDesk for Linux before 7.0.0, AnyDesk for iOS before 7.1.2, and AnyDesk for Android before 8.0.0. It has an integer overflow and resultant heap-based buffer overflow via a UDP packet during processing of an Identity user image within the Discovery feature, or when establishing a connection between any two clients.
- CVE-2023-43000Alta8.8
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.
- CVE-2025-21079Alta7.1
Validación de entrada incorrecta en Samsung Members anterior a la versión 5.5.01.3 permite a atacantes remotos conectar una URL arbitraria y lanzar una actividad arbitraria con privilegio de Samsung Members. Se requiere interacción del usuario para desencadenar esta vulnerabilidad.
- CVE-2025-11953Crítica9.8
The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.
- CVE-2025-61757Crítica9.8
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- CVE-2025-7851Crítica9.8
Un atacante puede obtener el shell de root en el sistema operativo subyacente bajo condiciones restringidas en las puertas de enlace Omada.
- CVE-2025-7850Alta7.2
Una vulnerabilidad de inyección de comandos puede explotarse tras la autenticación del administrador en el portal web de los gateways Omada.
- CVE-2025-61932Crítica9.8
Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to execute arbitrary code by sending specially crafted packets.
- CVE-2025-53521Crítica9.8
When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- CVE-2024-26008Media5.3
Una vulnerabilidad de comprobación o manejo incorrecto de condiciones excepcionales [CWE-703] en FortiOS versión 7.4.0 hasta 7.4.3 y anteriores a 7.2.7, FortiProxy versión 7.4.0 hasta 7.4.3 y anteriores a 7.2.9, FortiPAM anterior a 1.2.0 y FortiSwitchManager versión 7.2.0 hasta 7.2.3 y versión 7.0.0 hasta 7.0.3, el demonio fgfm puede permitir que un atacante no autenticado restablezca repetidamente la conexión fgfm mediante solicitudes TCP cifradas con SSL manipuladas.
- CVE-2025-59287Crítica9.8
Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
- CVE-2025-59230Alta7.8
Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
- CVE-2025-24990Alta7.8
Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcement of the upcoming removal of ltmdm64.sys driver. The driver has been removed in the October cumulative update. Fax modem hardware dependent on this specific driver will no longer work on Windows. Microsoft recommends removing any existing dependencies on this hardware.
- CVE-2025-39964Alta7.8
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: crypto: af_alg - No permitir escrituras concurrentes en af_alg_sendmsg Emitir dos escrituras en el mismo socket af_alg es incorrecto, ya que los datos se intercalarán de una forma impredecible. Además, las escrituras concurrentes pueden crear inconsistencias en el estado interno del socket. Impedirlo añadiendo un nuevo campo ctx->write que indique la propiedad exclusiva para la escritura.
- CVE-2025-61884Alta7.5
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
- CVE-2025-31718Alta7.5
En el módem, existe un posible bloqueo del sistema debido a una validación de entrada incorrecta. Esto podría dar lugar a una escalada remota de privilegios sin necesidad de privilegios de ejecución adicionales.
- CVE-2025-11371Alta7.5
In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560
- CVE-2025-61882Crítica9.8
Vulnerabilidad en el producto Oracle Concurrent Processing de Oracle E-Business Suite (componente: BI Publisher Integration). Las versiones compatibles afectadas son 12.2.3-12.2.14. Una vulnerabilidad fácilmente explotable permite que un atacante no autenticado con acceso a la red mediante HTTP comprometa Oracle Concurrent Processing. Los ataques exitosos a esta vulnerabilidad pueden resultar en la toma de control de Oracle Concurrent Processing. Puntuación base CVSS 3.1: 9.8 (impactos en la confidencialidad, integridad y disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
This product uses the NVD API but is not endorsed or certified by the NVD.