Vulnerabilidades em Rapid7

102 resultados
Análise Vexday

O portfólio de vulnerabilidades da Rapid7 soma 100 CVEs catalogadas, com taxa de exploração ativa abaixo da média geral do catálogo — nenhuma entrada registrada no CISA KEV —, o que indica pressão operacional relativamente contida no momento. Ainda assim, 21 CVEs surgiram nos últimos 90 dias, sinalizando ritmo de descoberta recente que merece monitoramento contínuo. A falha mais comum é do tipo CWE-78 (OS Command Injection), categoria de alto impacto que facilita execução de comandos arbitrários quando explorada com sucesso. A CVE mais perigosa ativa no momento é CVE-2019-5645, com escore EPSS de 0,42, indicando probabilidade não desprezível de exploração — sendo prudente verificar se os controles de mitigação aplicáveis estão em vigor nos ambientes afetados.

CVE-2019-5645HIGHRapid7 Metasploit HTTP Handler Denial of ServiceEPSS 41.7%CVE-2020-7384HIGHClient-Side Command Injection in Rapid7 MetasploitEPSS 30.5%CVE-2020-7350MEDIUMMetasploit Framework Plugin Libnotify Command InjectionEPSS 4.9%CVE-2019-5624HIGHRapid7 Metasploit Framework Zip Import Directory TraversalEPSS 2.8%CVE-2017-5264—Versions of Nexpose prior to 6.4.66 fail to adequately validate the source of HTTP requests intended for the Automated Actions administrativEPSS 2.7%CVE-2020-7385HIGHMetasploit Framework 'drb_remote_codeexec' code executionEPSS 1.8%CVE-2017-5230—The Java keystore in all versions and editions of Rapid7 Nexpose prior to 6.4.50 is encrypted with a static password of 'r@p1d7k3y5t0r3' whiEPSS 1.5%CVE-2022-0757MEDIUMRapid7 Nexpose SQL InjectionEPSS 1.2%CVE-2017-5231—All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi CEPSS 1.2%CVE-2017-5228—All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi DEPSS 1.2%CVE-2017-5229—All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter extapi CEPSS 1.2%CVE-2023-1306HIGHRapid7 InsightCloudSec resource.db() method accessEPSS 1.2%CVE-2020-7383MEDIUMSQL Injection in Rapid7 NexposeEPSS 1.1%CVE-2020-7376HIGHRapid7 Metasploit Framework Relative Path Traversal in enum_osx moduleEPSS 1.1%CVE-2023-1304HIGHRapid7 InsightCloudSec getattr() method accessEPSS 1.1%CVE-2020-7377HIGHRapid7 Metasploit Framework Relative Path Traversal in telpho10_credential_dump moduleEPSS 1.1%CVE-2019-5631HIGHRapid7 InsightAppSec Local Privilege EscalationEPSS 1.1%CVE-2017-5240—Editions of Rapid7 AppSpider Pro prior to version 6.14.060 contain a heap-based buffer overflow in the FLAnalyzer.exe component. A maliciousEPSS 1.0%CVE-2019-5638HIGHRapid7 Nexpose Insufficient Session ManagementEPSS 1.0%CVE-2025-6264MEDIUMVelociraptor priviledge escalation via UpdateConfig artifactEPSS 1.0%