Database CVE
Archivio delle vulnerabilità note (CVE) con punteggio CVSS, gravità, prodotti e vendor coinvolti. Filtra per anno e severità, collegato ai nostri articoli.
- CVE-2023-52163Alta8.8
Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- CVE-2025-25181Media5.8
A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter.
- CVE-2024-57968Critica9.9
Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible during web browsing by other users). upload.aspx can be used for this.
- CVE-2025-24085Critica10.0
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3, watchOS 11.3. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2.
- CVE-2025-0411Alta7.0
7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.
- CVE-2025-23006Critica9.8
È stata identificata una vulnerabilità di deserializzazione di dati non attendibili pre-autenticazione in SMA1000 Appliance Management Console (AMC) e Central Management Console (CMC), che in condizioni specifiche potrebbe potenzialmente consentire a un attaccante remoto non autenticato di eseguire comandi OS arbitrari.
- CVE-2025-23209Alta8.0
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.
- CVE-2024-57728Alta7.2
SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.
- CVE-2024-57727Alta7.5
SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords.
- CVE-2024-57726Critica9.9
SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.
- CVE-2025-21335Alta7.8
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
- CVE-2025-21334Alta7.8
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
- CVE-2025-21333Alta7.8
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
- CVE-2024-13161Critica9.8
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
- CVE-2024-13160Critica9.8
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
- CVE-2024-13159Critica9.8
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
- CVE-2024-55591Critica9.8
Una vulnerabilità di bypass dell'autenticazione tramite percorso o canale alternativo [CWE-288] che interessa FortiOS dalla versione 7.0.0 alla 7.0.16 e FortiProxy dalla versione 7.0.0 alla 7.0.19 e dalla versione 7.2.0 alla 7.2.12 consente a un attaccante remoto di ottenere privilegi di super-admin tramite richieste appositamente create al modulo websocket di Node.js.
- CVE-2024-53704Critica9.8
Una vulnerabilità di autenticazione impropria nel meccanismo di autenticazione SSLVPN consente a un attaccante remoto di bypassare l'autenticazione.
- CVE-2025-0282Critica9.0
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
- CVE-2024-50603Critica10.0
An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.
This product uses the NVD API but is not endorsed or certified by the NVD.