Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2980▼ 83 respecto a la semana anterior

Críticas / altas1452▲ 101 respecto a la semana anterior

Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)353▼ 157 respecto a la semana anterior

83 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2016-2174	Modificada	Alta (7.2)	1.9%	—	Apache Ranger	13/6/2016	17/6/2026	SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/eventTime.
CVE-2016-0733	Modificada	Crítica (9.8)	3.1%	—	Apache Ranger	12/4/2016	17/6/2026	The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username.
CVE-2015-5167	Modificada	Media (6.5)	1.9%	—	Apache Ranger	12/4/2016	17/6/2026	The Policy Admin Tool in Apache Ranger before 0.5.1 allows remote authenticated users to bypass intended access restrictions via the REST API.
CVE-2016-0735	Modificada	Alta (8.8)	1.7%	—	Apache Ranger	11/4/2016	17/6/2026	Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy.
CVE-2015-0266	Modificada	Alta (7.1)	2.1%	—	Apache Ranger	11/4/2016	17/6/2026	The Policy Admin Tool in Apache Ranger before 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs.
CVE-2015-0265	Modificada	Media (6.1)	4.9%	—	Apache Ranger	11/4/2016	17/6/2026	Cross-site scripting (XSS) vulnerability in the Policy Admin Tool in Apache Ranger before 0.5.0 allows remote attackers to inject arbitrary web script or HTML via the HTTP User-Agent header.
CVE-2014-8801	Modificada	Media (5)	18%	💥 Exploit	Strangerstudios Paid Memberships PRO	28/11/2014	17/6/2026	Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin before 1.7.15 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the QUERY_STRING in a getfile action to wp-admin/admin-ajax.php.
CVE-2009-4797	Modificada	Alta (7.5)	0.99%	💥 Exploit	Jobhut.spranger Jobhut	22/4/2010	16/6/2026	SQL injection vulnerability in browse.php in JobHut 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the pk parameter.