Base de datos CVE
Archivo de vulnerabilidades conocidas (CVE) con puntuación CVSS, gravedad, productos y fabricantes afectados. Filtra por año y severidad.
- CVE-2024-40766Crítica9.8
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.
- CVE-2024-39717Alta7.2
The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.
- CVE-2024-28987Crítica9.1
The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.
- CVE-2024-7971Crítica9.6
Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CVE-2024-7965Alta8.8
Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CVE-2024-28000Crítica9.8
Vulnerabilidad de asignación incorrecta de privilegios en LiteSpeed Technologies LiteSpeed Cache litespeed-cache. Este problema afecta a LiteSpeed Cache: desde n/a hasta <= 6.3.0.1.
- CVE-2024-7262Alta7.8
Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a single-click exploit in the form of a deceptive spreadsheet document
- CVE-2024-28986Crítica9.8
SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing. However, out of an abundance of caution, we recommend all Web Help Desk customers apply the patch, which is now available.
- CVE-2024-7593Crítica9.8
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.
- CVE-2024-38213Media6.5
Windows Mark of the Web Security Feature Bypass Vulnerability
- CVE-2024-38193Alta7.8
Vulnerabilidad de elevación de privilegios en Windows Ancillary Function Driver for WinSock
- CVE-2024-38189Alta8.8
Microsoft Project Remote Code Execution Vulnerability
- CVE-2024-38178Alta7.5
Scripting Engine Memory Corruption Vulnerability
- CVE-2024-38107Alta7.8
Windows Power Dependency Coordinator Elevation of Privilege Vulnerability
- CVE-2024-38106Alta7.0
Windows Kernel Elevation of Privilege Vulnerability
- CVE-2024-41710Alta7.2
A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack, due to insufficient parameter sanitization during the boot process. A successful exploit could allow an attacker to execute arbitrary commands within the context of the system.
- CVE-2024-27443Media6.1
Se descubrió un problema en Zimbra Collaboration (ZCS) 9.0 y 10.0. Existe una vulnerabilidad de Cross-Site Scripting (XSS) en la función CalendarInvite de la interfaz de usuario clásica de Zimbra webmail, debido a una validación de entrada inadecuada en el manejo del encabezado del calendario. Un atacante puede explotarla mediante un mensaje de correo electrónico que contenga un encabezado de calendario manipulado con una carga útil XSS incrustada. Cuando una víctima visualiza este mensaje en la interfaz clásica de Zimbra webmail, la carga útil se ejecuta en el contexto de la sesión de la víctima, lo que podría conducir a la ejecución de código JavaScript arbitrario.
- CVE-2024-7694Alta7.2
ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system command on the server.
- CVE-2024-7399Alta8.8
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.
- CVE-2024-42009Crítica9.3
Una vulnerabilidad de Cross-Site Scripting en Roundcube hasta 1.5.7 y 1.6.x hasta 1.6.7 permite a un atacante remoto robar y enviar correos electrónicos de una víctima mediante un mensaje de correo electrónico manipulado que abusa de un problema de desanitización en message_body() en program/actions/mail/show.php.
This product uses the NVD API but is not endorsed or certified by the NVD.