160 vulnerabilidades · Windows · ⚡ Nuclei Orden: CVSS EPSS Año ID
CVE-2021-44228
🔥 KEV Apache Log4j2 Web Windows ⚡ nuclei
10.0
CRITICAL
EPSS
94.4%
2021 CWE-502 276 PoCs

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnera

Scanner Automatizado
nuclei -t CVE-2021-44228.yaml ⎘
CVE-2021-30116
🔥 KEV Software Genérico Web Windows ⚡ nuclei
10.0
CRITICAL
EPSS
54.1%
2021 3 PoCs

Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client for Windows and installs it, the file KaseyaD.ini is generated (C:\Program Files (x86)\Kaseya\XXXXXXXXXX\KaseyaD.ini) which contains an Agent_Guid and AgentPassword This Agent_Guid and AgentPassword can be used to log in on dl.asp (https://x.x.x.x/dl.asp?un=840997037507813&pw=113cc622839a4077a84837485

Scanner Automatizado
nuclei -t CVE-2021-30116.yaml ⎘
CVE-2021-4073
RegistrationMagic Web Windows ⚡ nuclei
9.8
CRITICAL
EPSS
63.0%
2021 CWE-287 0 PoCs

The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including administrators, if they knew a valid username on the site due to missing identity validation in the social login function social_login_using_email() of the plugin. This affects versions equal to, and less than, 5.0.1.7.

Scanner Automatizado
nuclei -t CVE-2021-4073.yaml ⎘
Exploits & PoCs
🔍 GCVE ⚔ EDB
CVE-2021-34624
ProfilePress Web Windows ⚡ nuclei
9.8
CRITICAL
EPSS
68.3%
2021 CWE-434 0 PoCs

A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3. .

Scanner Automatizado
nuclei -t CVE-2021-34624.yaml ⎘
Exploits & PoCs
🔍 GCVE ⚔ EDB
CVE-2021-34621
ProfilePress Web Windows ⚡ nuclei
9.8
CRITICAL
EPSS
93.5%
2021 CWE-269 4 PoCs

A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register on sites as an administrator. This issue affects versions 3.0.0 - 3.1.3. .

Scanner Automatizado
nuclei -t CVE-2021-34621.yaml ⎘
CVE-2021-36888
Image Hover Effects Ultimate (WordPress plugin) Web Windows ⚡ nuclei
9.8
CRITICAL
EPSS
68.3%
2021 CWE-284 0 PoCs

Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPress plugin.

Scanner Automatizado
nuclei -t CVE-2021-36888.yaml ⎘
Exploits & PoCs
🔍 GCVE ⚔ EDB
CVE-2021-34622
ProfilePress Web Windows ⚡ nuclei
9.8
CRITICAL
EPSS
61.6%
2021 CWE-269 0 PoCs

A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible for users to escalate their privileges to that of an administrator while editing their profile. This issue affects versions 3.0.0 - 3.1.3. .

Scanner Automatizado
nuclei -t CVE-2021-34622.yaml ⎘
Exploits & PoCs
🔍 GCVE ⚔ EDB
CVE-2021-4380
Pinterest Automatic Web Windows ⚡ nuclei
9.8
CRITICAL
EPSS
81.3%
2021 CWE-284 0 PoCs

The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the 'wp_pinterest_automatic_parse_request' function and the 'process_form.php' script in versions up to, and including, 1.14.3. This makes it possible for unauthenticated attackers to update arbitrary options on a site that can be used to create new administrative user accounts or redirect unsuspecting site visitors.

Scanner Automatizado
nuclei -t CVE-2021-4380.yaml ⎘
Exploits & PoCs
🔍 GCVE ⚔ EDB
CVE-2021-4449
ZoomSounds - WordPress Wave Audio Player with Playlist Web Windows ⚡ nuclei
9.8
CRITICAL
EPSS
80.8%
2021 CWE-434 1 PoC

The ZoomSounds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'savepng.php' file in versions up to, and including, 5.96. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2021-4457 is a duplicate of this.

Scanner Automatizado
nuclei -t CVE-2021-4449.yaml ⎘
CVE-2021-28480
Microsoft Exchange Server 2013 Cumulative Update 23 Windows ⚡ nuclei
9.8
CRITICAL
EPSS
87.1%
2021 2 PoCs

Microsoft Exchange Server Remote Code Execution Vulnerability

Scanner Automatizado
nuclei -t CVE-2021-28480.yaml ⎘
CVE-2021-4436
3DPrint Lite Web Windows ⚡ nuclei
9.8
CRITICAL
EPSS
76.9%
2021 1 PoC

The 3DPrint Lite WordPress plugin before 1.9.1.5 does not have any authorisation and does not check the uploaded file in its p3dlite_handle_upload AJAX action , allowing unauthenticated users to upload arbitrary file to the web server. However, there is a .htaccess, preventing the file to be accessed on Web servers such as Apache.

Scanner Automatizado
nuclei -t CVE-2021-4436.yaml ⎘
CVE-2021-28481
Microsoft Exchange Server 2019 Cumulative Update 9 Windows ⚡ nuclei
9.8
CRITICAL
EPSS
34.4%
2021 0 PoCs

Microsoft Exchange Server Remote Code Execution Vulnerability

Scanner Automatizado
nuclei -t CVE-2021-28481.yaml ⎘
Exploits & PoCs
🔍 GCVE ⚔ EDB
CVE-2021-4374
WordPress Automatic Plugin Web Windows ⚡ nuclei
9.1
CRITICAL
EPSS
75.0%
2021 CWE-862 0 PoCs

The WordPress Automatic Plugin for WordPress is vulnerable to arbitrary options updates in versions up to, and including, 3.53.2. This is due to missing authorization and option validation in the process_form.php file. This makes it possible for unauthenticated attackers to arbitrarily update the settings of a vulnerable site and ultimately compromise the entire site.

Scanner Automatizado
nuclei -t CVE-2021-4374.yaml ⎘
Exploits & PoCs
🔍 GCVE ⚔ EDB
CVE-2021-25296
🔥 KEV Software Genérico Web Windows ⚡ nuclei
8.8
HIGH
EPSS
93.3%
2021 3 PoCs

Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.

Scanner Automatizado
nuclei -t CVE-2021-25296.yaml ⎘
CVE-2021-39341
OptinMonster Web Windows ⚡ nuclei
8.2
HIGH
EPSS
44.3%
2021 CWE-285 0 PoCs

The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the logged_in_or_has_api_key function in the ~/OMAPI/RestApi.php file that can used to exploit inject malicious web scripts on sites with the plugin installed. This affects versions up to, and including, 2.6.4.

Scanner Automatizado
nuclei -t CVE-2021-39341.yaml ⎘
Exploits & PoCs
🔍 GCVE ⚔ EDB
CVE-2021-21389
BuddyPress Web Windows ⚡ nuclei
8.1
HIGH
EPSS
93.3%
2021 CWE-863 2 PoCs

BuddyPress is an open source WordPress plugin to build a community site. In releases of BuddyPress from 5.0.0 before 7.2.1 it's possible for a non-privileged, regular user to obtain administrator rights by exploiting an issue in the REST API members endpoint. The vulnerability has been fixed in BuddyPress 7.2.1. Existing installations of the plugin should be updated to this version to mitigate the issue.

Scanner Automatizado
nuclei -t CVE-2021-21389.yaml ⎘
CVE-2021-21402
jellyfin Windows ⚡ nuclei
7.7
HIGH
EPSS
90.5%
2021 CWE-22 4 PoCs

Jellyfin is a Free Software Media System. In Jellyfin before version 10.7.1, with certain endpoints, well crafted requests will allow arbitrary file read from a Jellyfin server's file system. This issue is more prevalent when Windows is used as the host OS. Servers that are exposed to the public Internet are potentially at risk. This is fixed in version 10.7.1. As a workaround, users may be able to restrict some access by enforcing strict security permissions on their filesystem, however, it is recommended to update as soon as possible.

Scanner Automatizado
nuclei -t CVE-2021-21402.yaml ⎘
CVE-2021-39316
ZoomSounds - WordPress Wave Audio Player with Playlist Web Windows ⚡ nuclei
7.5
HIGH
EPSS
93.5%
2021 CWE-22 2 PoCs

The Zoomsounds plugin <= 6.45 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the `dzsap_download` action using directory traversal in the `link` parameter.

Scanner Automatizado
nuclei -t CVE-2021-39316.yaml ⎘