CVE.org, NVD, CISA KEV y los avisos de seguridad de Ubuntu se revisan cada hora. Siga el software que usa y le avisaremos por correo cuando se publique una vulnerabilidad nueva o empiece a explotarse.
SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL injection while logged in.
The affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header. Successful exploitation can l…
The user search function within the management console fails to properly encode user-supplied input before rendering it in the browser. This allows an attacker to inject malicious scripts that are then executed by the user's browser in the context of the mana…
A memory corruption vulnerability in the QMqttClient class of the Qt MQTT module. Under certain MQTT 5 connection settings between client and server, QMqttClient may corrupt memory, which can cause the application to crash.
Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an authenticated Remote Code Execution vulnerability.
Permission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affect availability.
Permission control vulnerability in the autofill service module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation a…
Permission control vulnerability in the Optimizer module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
DoS vulnerability in the DSoftBus module. Impact: Successful exploitation of this vulnerability may affect availability.
DoS vulnerability in the DSoftBus module. Impact: Successful exploitation of this vulnerability may affect availability.
Permission control vulnerability in the event notification management module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
DoS vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect availability.
OOB read vulnerability in the peripheral module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
UAF vulnerability in the location service module. Impact: Successful exploitation of this vulnerability may affect availability.
Race condition vulnerability in the location service module. Impact: Successful exploitation of this vulnerability may affect availability.
Permission control vulnerability in the WLAN module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
DoS vulnerability in the file parsing module. Impact: Successful exploitation of this vulnerability may affect availability.
Buffer overflow vulnerability in the file preview module. Impact: Successful exploitation of this vulnerability may affect availability.
Null pointer dereference vulnerability in the ArkWeb module. Impact: Successful exploitation of this vulnerability may affect availability.
Permission control vulnerability in the background task management module. Impact: Successful exploitation of this vulnerability may affect service integrity.
DoS vulnerability in the file parsing module. Impact: Successful exploitation of this vulnerability may affect availability.
Permission control vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect confidentiality.
A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code …
The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user st…
Vulnerabilidades publicadas en los últimos 30 días. Pulse para ver todas las CVE del producto y recibir alertas.
Los registros oficiales de CVE.org (el aviso del fabricante y el enriquecimiento de CISA), el catálogo CISA KEV y los avisos de Ubuntu cada hora; los nombres CPE y puntuaciones de NVD cada 2 horas, como pide NVD; EPSS a diario.
Cada registro se asocia a más de 90 productos por los nombres del fabricante y los nombres CPE: nginx, PHP, Apache, Windows 10/11/Server, versiones LTS de Ubuntu, el kernel de Linux, equipos de red…
Cuando un producto que sigue recibe una CVE nueva, cuando una vulnerabilidad entra en la lista de explotadas o cuando Ubuntu publica la corrección, recibe un correo, al instante o como resumen diario.
Un ID CVE (Common Vulnerabilities and Exposures) es el número único de cada vulnerabilidad publicada, como CVE-2024-4577. Lo asigna la organización que la encontró o la propietaria del software (una CNA) y se publica en CVE.org.
CVSS valora la gravedad técnica de 0 a 10: desde 9,0 es crítica, 7,0–8,9 alta, 4,0–6,9 media. Mide lo fácil y lo remota que es su explotación, no si alguien la está explotando.
CISA KEV recoge vulnerabilidades con explotación demostrada en ataques reales; si una aparece, corríjala sin esperar. EPSS estima la probabilidad de explotación en los próximos 30 días. Juntas indican cuál de miles de CVE corregir primero.
Las fuentes se revisan cada hora; con envío instantáneo, una CVE que coincide con un producto que sigue llega en menos de una hora. Si aparecen muchas a la vez se agrupan en un solo correo.
No. IP-DB es un servicio gratuito de interés público; para las alertas solo necesita una cuenta con un correo verificado.
Nuestro sensor honeypot gratuito y de código abierto espera en puertos que su servidor no usa y reporta a una lista compartida los escáneres y atacantes que se conectan.
