94322 vulnerabilidades Orden: CVSS EPSS Año ID
CVE-2021-43811
sockeye General
7.8
HIGH
EPSS
8.7%
2021 CWE-94 1 PoC

Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary code embedded in config files. An attacker can add malicious code to the config file of a trained model and attempt to convince users to download and run it. If users run the model, the embedded code will run locally. The issue is fixed in version 2.3.24.

Scanner Automatizado
Sin template local disponible
CVE-2021-31453
Reader General
7.8
HIGH
EPSS
3.1%
2021 CWE-416 1 PoC

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of XFA Forms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13092.

Scanner Automatizado
Sin template local disponible
CVE-2021-43226
🔥 KEV Windows 10 Version 1809 Windows
7.8
HIGH
EPSS
8.4%
2021 1 PoC

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Scanner Automatizado
Sin template local disponible
CVE-2009-0082
Software Genérico Windows
7.8
HIGH
EPSS
1.0%
2009 1 PoC

The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not properly validate handles, which allows local users to gain privileges via a crafted application that triggers unspecified "actions," aka "Windows Kernel Handle Validation Vulnerability."

Scanner Automatizado
Sin template local disponible
CVE-2009-1123
🔥 KEV Software Genérico Windows
7.8
HIGH
EPSS
5.2%
2009 1 PoC

The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly validate changes to unspecified kernel objects, which allows local users to gain privileges via a crafted application, aka "Windows Kernel Desktop Vulnerability."

Scanner Automatizado
Sin template local disponible
CVE-2009-0557
🔥 KEV Software Genérico General
7.8
HIGH
EPSS
86.4%
2009 1 PoC

Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open XML File Format Converter for Mac; Microsoft Office Excel Viewer 2003 SP3; Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a crafted Excel file with a malformed record object, aka "Object Record Corruption Vulnerability."

Scanner Automatizado
Sin template local disponible
CVE-2009-3129
🔥 KEV Software Genérico General
7.8
HIGH
EPSS
91.2%
2009 1 PoC

Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset, aka "Excel Featheader Record Memory Corruption Vulnerability."

Scanner Automatizado
Sin template local disponible
CVE-2009-1862
🔥 KEV Software Genérico General
7.8
HIGH
EPSS
58.6%
2009 3 PoCs

Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (1) a crafted Flash application in a .pdf file or (2) a crafted .swf file, related to authplay.dll, as exploited in the wild in July 2009.

Scanner Automatizado
Sin template local disponible
CVE-2009-0563
🔥 KEV Software Genérico General
7.8
HIGH
EPSS
79.9%
2009 1 PoC

Stack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for Mac; Microsoft Office Word Viewer 2003 SP3; Microsoft Office Word Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a Word document with a crafted tag containing an invalid length field, aka "Word Buffer Overflow Vulnerability."

Scanner Automatizado
Sin template local disponible
CVE-2009-4324
🔥 KEV Software Genérico Web Windows
7.8
HIGH
EPSS
92.9%
2009 2 PoCs

Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.

Scanner Automatizado
Sin template local disponible
CVE-2008-2992
🔥 KEV Software Genérico Web
7.8
HIGH
EPSS
93.7%
2008 4 PoCs

Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file that calls the util.printf JavaScript function with a crafted format string argument, a related issue to CVE-2008-1104.

Scanner Automatizado
Sin template local disponible
CVE-2017-0101
🔥 KEV Windows Windows
7.8
HIGH
EPSS
72.3%
2017 1 PoC

The kernel-mode drivers in Transaction Manager in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allow local users to gain privileges via a crafted application, aka "Windows Elevation of Privilege Vulnerability."

Scanner Automatizado
Sin template local disponible
CVE-2017-11882
🔥 KEV Microsoft Office General
7.8
HIGH
EPSS
94.4%
2017 37 PoCs

Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11884.

Scanner Automatizado
Sin template local disponible
CVE-2017-0358
ntfs-3g General
7.8
HIGH
EPSS
8.3%
2017 4 PoCs

Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation.

Scanner Automatizado
Sin template local disponible
CVE-2017-11197
Software Genérico General
7.8
HIGH
EPSS
0.6%
2017 1 PoC

In CyberArk Viewfinity 5.5.10.95 and 6.x before 6.1.1.220, a low privilege user can escalate to an administrative user via a bug within the "add printer" option.

Scanner Automatizado
Sin template local disponible
CVE-2017-18837
Software Genérico General
7.8
HIGH
EPSS
0.0%
2017 1 PoC

Certain NETGEAR devices are affected by vertical privilege escalation. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ before 12.0.2.15, M4300-52G-POE+ before 12.0.2.15, M4300-8X8F before 12.0.2.15, M4300-12X12F before 12.0.2.15, M4300-24X24F before 12.0.2.15, M4300-24X before 12.0.2.15, M4300-48X before 12.0.2.15, and M4200 before 12.0.2.15.

Scanner Automatizado
Sin template local disponible
CVE-2017-20121
Management Console General
7.8
HIGH
EPSS
0.1%
2017 CWE-269 1 PoC

A vulnerability was found in Teradici Management Console 2.2.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Database Management. The manipulation leads to improper privilege management. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.

Scanner Automatizado
Sin template local disponible
CVE-2017-0261
🔥 KEV Microsoft Office General
7.8
HIGH
EPSS
92.3%
2017 2 PoCs

Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0262 and CVE-2017-0281.

Scanner Automatizado
Sin template local disponible
CVE-2017-8570
🔥 KEV Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, and Microsoft Office 2016. General
7.8
HIGH
EPSS
94.2%
2017 6 PoCs

Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0243.

Scanner Automatizado
Sin template local disponible
CVE-2017-8759
🔥 KEV Microsoft .NET Framework General
7.8
HIGH
EPSS
94.0%
2017 16 PoCs

Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely via a malicious document or application, aka ".NET Framework Remote Code Execution Vulnerability."

Scanner Automatizado
Sin template local disponible