Base de datos CVE
Archivo de vulnerabilidades conocidas (CVE) con puntuación CVSS, gravedad, productos y fabricantes afectados. Filtra por año y severidad.
- CVE-2023-36025Alta8.8
Windows SmartScreen Security Feature Bypass Vulnerability
- CVE-2023-47246Crítica9.8
In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023.
- CVE-2023-22518Crítica9.8
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
- CVE-2023-46604Crítica10.0
El serializador del protocolo Java OpenWire es vulnerable a la ejecución remota de código. Esta vulnerabilidad puede permitir que un atacante remoto con acceso de red a un broker o cliente OpenWire basado en Java ejecute comandos de shell arbitrarios manipulando los tipos de clase serializados en el protocolo OpenWire para hacer que el cliente o el broker (respectivamente) instancie cualquier clase del classpath. Se recomienda a los usuarios actualizar tanto los brokers como los clientes a la versión 5.15.16, 5.16.7, 5.17.6 o 5.18.3, que corrige este problema.
- CVE-2023-46748Alta8.8
An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- CVE-2023-46747Crítica9.8
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- CVE-2023-43208Crítica9.8
NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679.
- CVE-2023-34048Crítica9.8
vCenter Server contiene una vulnerabilidad de escritura fuera de límites en la implementación del protocolo DCERPC. Un actor malicioso con acceso de red a vCenter Server puede desencadenar una escritura fuera de límites que podría conducir a la ejecución remota de código.
- CVE-2023-20273Alta7.2
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.
- CVE-2023-5631Media6.1
Roundcube anterior a 1.4.15, 1.5.x anterior a 1.5.5 y 1.6.x anterior a 1.6.4 permite XSS almacenado a través de un mensaje de correo electrónico HTML con un documento SVG manipulado debido al comportamiento de program/lib/Roundcube/rcube_washtml.php. Esto podría permitir a un atacante remoto cargar código JavaScript arbitrario.
- CVE-2023-45727Alta7.5
Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker.
- CVE-2023-20598Alta7.8
Una gestión inadecuada de privilegios en el controlador AMD Radeon™ Graphics puede permitir a un atacante autenticado elaborar una solicitud IOCTL para obtener control de E/S sobre puertos de hardware arbitrarios o direcciones físicas, lo que podría dar lugar a una ejecución arbitraria de código.
- CVE-2023-20198Crítica10.0
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.
- CVE-2023-41763Media5.3
Skype for Business Elevation of Privilege Vulnerability
- CVE-2023-36584Media5.4
Windows Mark of the Web Security Feature Bypass Vulnerability
- CVE-2023-36563Media6.5
Microsoft WordPad Information Disclosure Vulnerability
- CVE-2023-4966Crítica9.4
Divulgación de información sensible en NetScaler ADC y NetScaler Gateway cuando se configura como Gateway (servidor virtual VPN, ICA Proxy, CVPN, RDP Proxy) o servidor virtual AAA.
- CVE-2023-44487Alta7.5
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
- CVE-2023-45208Alta8.8
Una inyección de comandos en la función parsing_xml_stasurvey dentro de libcgifunc.so del repetidor D-Link DAP-X1860 1.00 a 1.01b05-01 permite a los atacantes (dentro del alcance del repetidor) ejecutar comandos de shell como root durante el proceso de configuración del repetidor, mediante un SSID manipulado. Además, los nombres de red que contienen comillas simples (en el alcance del repetidor) pueden provocar una denegación de servicio.
- CVE-2023-42824Alta7.8
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.1 and iPadOS 16.7.1. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6.
This product uses the NVD API but is not endorsed or certified by the NVD.