Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.180exploits catalogados

31.691CVEs con explotación pública

0probados en laboratorio

Todos Exploit-DB 22.469Referência 19.841GitHub PoC 13.140VulnCheck XDB 8078Nuclei 4190Metasploit 3462✓ solo verificadosrecientes populares riesgo

22.469 exploits

Exploit-DB

Microsoft DirectWrite / AFDKO - Stack Corruption in OpenType Font Handling Due to Negative nAxes

CVE-2019-1127—10 jul 2019

A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Rem

28RIESGO

Exploit-DB

Microsoft DirectWrite / AFDKO - Stack Corruption in OpenType Font Handling Due to Incorrect Handling of blendArray

CVE-2019-1119—10 jul 2019

A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Rem

28RIESGO

Exploit-DB

Microsoft DirectWrite / AFDKO - Stack Corruption in OpenType Font Handling While Processing CFF Blend DICT Operator

CVE-2019-1123—10 jul 2019

A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Rem

28RIESGO

Exploit-DB

Microsoft DirectWrite / AFDKO - Heap-Based Buffer Overflow in OpenType Font Handling in readCharset

CVE-2019-1128—10 jul 2019

A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Rem

28RIESGO

Exploit-DB

Microsoft DirectWrite / AFDKO - Heap-Based Out-of-Bounds Read/Write in OpenType Font Handling Due to Unbounded iFD

CVE-2019-1121—10 jul 2019

A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Rem

28RIESGO

Exploit-DB

Microsoft DirectWrite / AFDKO - Heap-Based Buffer Overflow in OpenType Font Handling in readStrings

CVE-2019-1122—10 jul 2019

A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Rem

28RIESGO

Exploit-DB

Microsoft DirectWrite / AFDKO - Heap-Based Out-of-Bounds Read/Write in OpenType Font Handling Due to Empty ROS Strings

CVE-2019-1124—10 jul 2019

A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Rem

28RIESGO

Exploit-DB

Microsoft DirectWrite / AFDKO - Heap-Based Buffer Overflow in OpenType Font Handling in readFDSelect

CVE-2019-1120—10 jul 2019

A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Rem

28RIESGO

Exploit-DB

Microsoft DirectWrite / AFDKO - Stack Corruption in OpenType Font Handling Due to Negative cubeStackDepth

CVE-2019-1118—10 jul 2019

A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Rem

28RIESGO

Exploit-DB

Microsoft DirectWrite / AFDKO - Stack Corruption in OpenType Font Handling due to Out-of-Bounds cubeStackDepth

CVE-2019-1117—10 jul 2019

A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Rem

28RIESGO

Exploit-DB

WordPress Plugin Like Button 1.6.0 - Authentication Bypass

CVE-2019-13344—08 jul 2019

An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress allows unauthent

35RIESGO

Exploit-DB

Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuckV2.c' Remote Buffer Overflow (2)

CVE-2002-0082—07 jul 2019

The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly

28RIESGO

Exploit-DB

Microsoft Exchange 2003 - base64-MIME Remote Code Execution

CVE-2007-0213—05 jul 2019

Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 does not properly decode certain MIME encoded e-mails, wh

35RIESGO

Exploit-DB

Symantec DLP 15.5 MP1 - Cross-Site Scripting

CVE-2019-9701—03 jul 2019

DLP 15.5 MP1 and all prior versions may be susceptible to a cross-site scripting (XSS) vulnerability, a type of issue th

23RIESGO

Exploit-DB

Apache Tomcat - CGIServlet enableCmdLineArguments Remote Code Execution (Metasploit)

CVE-2019-0232—03 jul 2019

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0

60RIESGO

Exploit-DB

Serv-U FTP Server - prepareinstallation Privilege Escalation (Metasploit)

CVE-2019-12181—03 jul 2019

A privilege escalation vulnerability exists in SolarWinds Serv-U before 15.1.7 for Linux.

50RIESGO

Exploit-DB

Mac OS X TimeMachine - 'tmdiagnose' Command Injection Privilege Escalation (Metasploit)

CVE-2019-8513—02 jul 2019

This issue was addressed with improved checks. This issue is fixed in macOS Mojave 10.14.4. A local user may be able to

38RIESGO

Exploit-DB

Centreon 19.04 - Remote Code Execution

CVE-2019-13024—02 jul 2019

Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitra

35RIESGO

Exploit-DB

SAP Crystal Reports - Information Disclosure

CVE-2019-0285—01 jul 2019

The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive databas

23RIESGO

Exploit-DB

LibreNMS 1.46 - 'addhost' Remote Code Execution

CVE-2018-20434—28 jun 2019

LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $_POST['community'] parameter to htm

60RIESGO

Exploit-DB

Mozilla Spidermonkey - IonMonkey 'Array.prototype.pop' Type Confusion

CVE-2019-11707HIGHbajo ataque26 jun 2019

A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow

83RIESGO

Exploit-DB

Nagios XI 5.5.6 - Magpie_debug.php Root Remote Code Execution (Metasploit)

CVE-2018-15708—26 jun 2019

Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP r

60RIESGO

Exploit-DB

Nagios XI 5.5.6 - Magpie_debug.php Root Remote Code Execution (Metasploit)

CVE-2018-15710—26 jun 2019

Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover_new.php.

50RIESGO

Exploit-DB

Microsoft Windows - 'CmpAddRemoveContainerToCLFSLog' Arbitrary File/Directory Creation

CVE-2019-0959HIGH24 jun 2019

Windows Common Log File System Driver Elevation of Privilege Vulnerability

41RIESGO

Exploit-DB

Microsoft Windows Font Cache Service - Insecure Sections Privilege Escalation

CVE-2019-0943—24 jun 2019

Windows ALPC Elevation of Privilege Vulnerability

23RIESGO

Exploit-DB

dotProject 2.1.9 - SQL Injection

CVE-2019-11354—24 jun 2019

The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Ori

28RIESGO

Exploit-DB

SeedDMS < 5.1.11 - 'out.GroupMgr.php' Cross-Site Scripting

CVE-2019-12801—24 jun 2019

out/out.GroupMgr.php in SeedDMS 5.1.11 has Stored XSS by making a new group with a JavaScript payload as the "GROUP" Nam

23RIESGO

Exploit-DB

GrandNode 4.40 - Path Traversal / Arbitrary File Download

CVE-2019-12276—24 jun 2019

A Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows

50RIESGO

Exploit-DB

SeedDMS < 5.1.11 - 'out.UsrMgr.php' Cross-Site Scripting

CVE-2019-12745—24 jun 2019

out/out.UsrMgr.php in SeedDMS before 5.1.11 allows Stored Cross-Site Scripting (XSS) via the name field.

23RIESGO

Exploit-DB

SeedDMS versions < 5.1.11 - Remote Command Execution

CVE-2019-12744—24 jun 2019

SeedDMS before 5.1.11 allows Remote Command Execution (RCE) because of unvalidated file upload of PHP scripts, a differe

28RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.