Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2751▲ 48 respecto a la semana anterior
Críticas / altas1479▲ 371 respecto a la semana anterior
Nueva explotación activa (KEV)7▼ 3 respecto a la semana anterior
Sin puntuar (sin CVSS)64▼ 462 respecto a la semana anterior
3 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Modificada | Crítica (9.8) | 1.1% | — | Unix4lyfe Darkhttpd | 22/1/2024 | 17/6/2026 | darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel. | |
| Modificada | Media (5.5) | 0.24% | — | Unix4lyfe Darkhttpd | 22/1/2024 | 17/6/2026 | darkhttpd through 1.15 allows local users to discover credentials (for --auth) by listing processes and their arguments. | |
| Modificada | Alta (7.5) | 1.3% | — | Unix4lyfe Darkhttpd | 1/4/2022 | 17/6/2026 | A flaw was found in darkhttpd. Invalid error handling allows remote attackers to cause denial-of-service by accessing a file with a large modification date. The highest threat from this vulnerability is to system availability. |