Il 29 settembre 2021 l'Ufficio federale della cibersicurezza (UFCS) è stato riconosciuto dall'organizzazione indipendente americana MITRE come autorità di assegnazione dei numeri CVE. In quanto tale, l'UFCS è incaricato di preparare e pubblicare gli identificatori CVE per le vulnerabilità che gli vengono segnalate nell'ambito del suo campo di applicazione. Ciò rende l'NCSC il punto di contatto ufficiale per la gestione delle pubblicazioni CVE relative alle vulnerabilità che interessano la Svizzera quando nessun altro CNA è rilevante.
Nell'ambito delle sue funzioni di CNA, l'UFCS tiene aggiornato un catalogo di identificatori CVE pubblicati sotto la sua autorità. Questo elenco esiste a scopo di monitoraggio e non costituisce una fonte di consulenza o un riferimento a una delle vulnerabilità elencate. Le informazioni rilevanti per le vulnerabilità elencate di seguito, come la disponibilità di patch e i riferimenti ufficiali, sono disponibili al link MITRE.
Vulnerabilità / CVE
CVE-2025-3519: Unblu Spark Replace uploaded files knowing the file upload ID
Published: 22 April 2025
Severity: 7.0 High
CVE-2025-3518: Unblu Spark File Upload functionality possible even when disabled
Published: 22 April 2025
Severity: 5.3 Medium
CVE-2025-1425: PocketBook InkPad, File Read Through Improper Sudo Privilege Management
Published: 04. March 2025
Severity: 4.7 Medium
CVE-2025-1424: PocketBook InkPad, Privilege Escalation Through SUID Binary and Developer Mode
Published: 04. March 2025
Severity: 8.6 High
CVE-2025-0425: bestinformed Web, Local Privilege Escalation via Config Manipulation
Published: 18. February 2025
Severity: 8.5 High
CVE-2025-0424: bestinformed Web, Multiple Authenticated Stored Cross-Site Scripting
Published: 18. February 2025
Severity: 5.1 High
CVE-2025-0423: bestinformed Web, Multiple Unauthenticated Stored Cross-Site Scripting
Published: 18. February 2025
Severity: 5.3 Medium
MITRE: CVE-2025-0423
CVE-2025-0422: bestinformed Web, Authenticated Remote Code Execution via ScriptVar
Published: 18. February 2025
Severity: 8.6 High
MITRE: CVE-2025-0422
CVE-2025-0001: Abacus ERP authenticated arbitrary file read vulnerability
Published: 17 February 2025
Severity: Medium 6.5
MITRE: CVE-2025-0001
CVE-2024-13503: Stack-Based Buffer Overflow in Newtec's update signaling causes RCE
Published: 17 January 2025
Severity: Critical 9.5
MITRE: CVE-2024-13503
CVE-2024-13502: Command injection in the NTC2218, NTC2250, NTC2299 modems' web interfaces
Published: 17 January 2025
Severity: Critical 9.3
MITRE: CVE-2024-13502
CVE-2024-12801: SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks
Published: 19 December 2024
Severity: Low 2.1
MITRE: CVE-2024-12801
CVE-2024-12798: Logback-core JaninoEventEvaluator vulnerability
Published: 19 December 2024
Severity: Medium 5.9
MITRE: CVE-2024-12798
CVE-2024-9102: phpLDAPadmin: Improper Neutralization of Formula Elements
Published: 19 December 2024
Severity: Medium 5.0
MITRE: CVE-2024-9102
CVE-2024-9101: phpLDAPadmin: Reflected Cross-Site Scripting in entry_chooser.php
Published: 19 December 2024
Severity: Low 2.1
MITRE: CVE-2024-9101
CVE-2024-12305: Object-Level Access Control Vulnerability Allows Unauthorized Access to Student Grades in Unifiedtransform
Published: 09 December 2024
Severity: Medium 4.3
MITRE: CVE-2024-12305
CVE-2024-12306: Access Control Vulnerabilities Allow Unauthorized Access to User Profiles in Unifiedtransform
Published: 09 December 2024
Severity: Medium 4.3
MITRE: CVE-2024-12306
CVE-2024-12307: Function-Level Access Control Vulnerability Allows Unauthorized Modification of Student Data in Unifiedtransform
Published: 09 December 2024
Severity: Medium 4.3
MITRE: CVE-2024-12307
CVE-2024-9044: XML External Entity (XXE) Vulnerability in EasyTax
Published: 29 November 2024
Severity: Medium 4.6
MITRE: CVE-2024-9044
CVE-2024-8602: XML Eternal Entity Attack in the Software Library taxstatement.jar
Published: 14 October 2024
Severity: Medium 6.3
MITRE: CVE-2024-8602
CVE-2024-6203: HaloITSM - Password Reset Poisoning
Published: 06 August 2024
Severity: High 8.3
MITRE: CVE-2024-6203
CVE-2024-6202: HaloITSM - SAML XML Signature Wrapping (XSW)
Published: 06 August 2024
Severity: Critical 9.8
MITRE: CVE-2024-6202
CVE-2024-6201: HaloITSM - Emailing Template Injection
Published: 06 August 2024
Severity: Medium 5.3
MITRE: CVE-2024-6201
CVE-2024-6200: HaloITSM - Stored Cross-Site Scripting in Tickets
Published: 06 August 2024
Severity: High 8.0
MITRE: CVE-2024-6200
Bludit - Insecure Token Generation
Published: 24 June 2024
Severity: Medium 6.0
MITRE: CVE-2024-24554
Bludit uses SHA1 as Password Hashing Algorithm
Published: 24 June 2024
Severity: Medium 5.9
MITRE: CVE-2024-24553
Bludit is Vulnerable to Session Fixation
Published: 24 June 2024
Severity: Medium 5.6
MITRE: CVE-2024-24552
Bludit - Remote Code Exection (RCE) through Image API
Published: 24 June 2024
Severity: High 8.9
MITRE: CVE-2024-24551
Bludit - Remote Code Exection (RCE) through File API
Published: 24 June 2024
Severity: High 8.9
MITRE: CVE-2024-24550
Improper Access Control Leads to Server-Side Request Forgery in Mautic
Published: 10 April 2024
Severity: MEDIUM 5.0
MITRE: CVE-2024-3448
Improper Access Control Issues Lead to Sensitive Data Exposure in Mautic
Published: 10 April 2024
Severity: MEDIUM 5.4
MITRE: CVE-2024-2731
Predictable Page Indexing Might Lead to Sensitive Data Exposure in Mautic
Published: 10 April 2024
Severity: MEDIUM 5.3
MITRE: CVE-2024-2730
Authenticated Remote Code Execution in Kiloview NDI N series products
Published: 21 March 2024
Severity: High 8.8
MITRE: CVE-2024-2162
Use of Hard-coded Credentials in Kiloview NDI N series products API middleware
Published: 21 March 2024
Severity: Critical 9.1
MITRE: CVE-2024-2161
WAF bypass of the ModSecurity v3 release line
Published: 30 January 2024
Severity: High 8.6
MITRE: CVE-2024-1019
Command Execution trough Serial Interface of u-blox TOBY-L2
Published: 20 December 2023
Severity: High 7.6
MITRE: CVE-2023-0011
Logback "receiver" DOS vulnerability CVE-2023-6378 incomplete fix
Published: 04. December 2023
Severity: 7.1 High
Logback "receiver" DOS vulnerability
Published: 21 November 2023
Severity 7.1 High
Weak Access Control between Domains in Wing FTP Server <= 7.2.0
Published: 12. September 2023
Severity: 4.9 Medium
Exposed Session Variable in Wing FTP Server <= 7.2.0
Published: 12. September 2023
Severity: 6.5 Medium
Insecure Default Permissions in Wing FTP Server <= 7.2.0
Published: 12. September 2023
Severity: 6.1 Medium
Cross-Site Scripting Vulnerability in Wing FTP Server <= 7.2.0
Published: 12. September 2023
Severity: 3.0 Low
Reflected XSS in BKG Ntrip Professional Caster version <=2.0.44
Published: 28. June 2023
Severity: 4.7 Medium
Yellowbrik PEC-1864 authentication bypass
Published: 06. April 2023
Severity : 9.8 Critical
Unauthenticated RCE affecting the AcyMailing plugin for Joomla
Published: 30. March 2023
Severity : 9.8 Critical
Missing access control affecting the AcyMailing plugin for Joomla
Published: 30. March 2023
Severity : 6.5 Medium
Stored XSS affecting the AcyMailing plugin for Joomla
Published: 30. March 2023
Severity : 7.2 High
Hard coded credentials in elvexys ISOS firmwares
Published: 28. December 2022
Severity : 4.5 Medium
Authentication bypass in elvexys StreamX using StreamView HTML component with public web server feature
Published: 28. December 2022
Severity : 7.5 High
Path traversal in elvexys StreamX using StreamView HTML component with public web server feature
Published: 28. December 2022
Severity : 6.5 Medium
STM32 USB Host Library Buffer Overflow
Published: 21. October 2022
Severity : 6.8 Medium
Response body bypass in OWASP ModSecurity Core Rule Set via repeated HTTP Range header submission with a small byte range
Published: 20. September 2022
Severity : 7.5 HIGH
Response body bypass in OWASP ModSecurity Core Rule Set via a specialy crafted charset in the HTTP Accept header
Published: 20. September 2022
Severity : 7.3 HIGH
Partial rule set bypass in OWASP ModSecurity Core Rule Set for HTTP multipart requests using character encoding in the Content-Type or Content-Transfer-Encoding header
Published: 20. September 2022
Severity : 7.3 HIGH
Partial rule set bypass in OWASP ModSecurity Core Rule Set by submitting a specially crafted HTTP Content-Type header
Published: 20. September 2022
Severity : 7.3 HIGH
Retbleed, Arbitrary Memory Disclosure through CPU Side-Channel Attacks
Published: 12. July 2022
Severity : 5.6 MEDIUM
Multi Factor Authentication Bypass in various versions of Abacus ERP
Published: 19. April 2022
Severity : 8.1 HIGH
Insecure EBICS messages encryption implementation in ebics-java/ebics-java-client could allow an adjacent attacker to decrypt EBICS payloads
Published: 14. April 2022
Severity : 6.5 MEDIUM
Novel attack against the Combined Charging System (CCS) in electric vehicles to remotely cause a denial of service
Published: 12. April 2022
Severity : 4.6 MEDIUM
Reflected XSS in Archivista DMS
Published: 15. March 2022
Severity: 6.1 MEDIUM
Reflected XSS in the search the functionality of AlCoda NetBiblio WebOPAC
Published: 14. January 2022
Severity: 6.1 MEDIUM
MITRE: CVE-2021-42551
Attacker with privileges to edit configuration files is able to execute code through JNDI lookup, logback
Published: 16. December 2021
Severity: 6.6 MEDIUM
Reflected XSS in search the functionality of Wordpress, WP Cloud Plugins Use-Your-Drive
Published: 13. Dezember 2021
Severity: 4.7 MEDIUM
Reflected XSS in search the functionality of Wordpress, WP Cloud Plugins Out-of-the-Box
Published: 13. Dezember 2021
Severity: 4.7 MEDIUM
Reflected XSS in search the functionality of Wordpress, WP Cloud Plugins Share-one-Drive
Published: 13. Dezember 2021
Severity: 4.7 MEDIUM
Reflected XSS in search the functionality of Wordpress, WP Cloud Plugins Lets-Box
Published: 13. Dezember 2021
Severity: 4.7 MEDIUM
Missing HTTPOnly flag on sensitive cookie in TopEase
Published: 30. November 2021
Severity: 8.1 - high
MITRE: CVE-2021-42115
Unauthorized Menu Item Access in TopEase
Published: 30. November 2021
Severity: 4.3 - medium
MITRE: CVE-2021-42116
UI Redressing in TopEase
Published: 30. November 2021
Severity: 3.5 - low
MITRE: CVE-2021-42117
Stored XSS in TopEase
Published: 30. November 2021
Severity: 8.1 - high
MITRE: CVE-2021-42118
Stored XSS in Search Function in TopEase
Published: 30. November 2021
Severity: 7.3 - high
MITRE: CVE-2021-42119
Missing Character Length (Denial of Service) in TopEase
Published: 30. November 2021
Severity: 6.5 - medium
MITRE: CVE-2021-42120
Denial of Service via Invalid Date Format in TopEase
Published: 30. November 2021
Severity: 4.3 - medium
MITRE: CVE-2021-42121
Denial of Service via Invalid Object Attribute in TopEase
Published: 30. November 2021
Severity: 4.3 - medium
MITRE: CVE-2021-42122
Missing Upload Filter in TopEase
Published: 30. November 2021
Severity: 7.3 - high
MITRE: CVE-2021-42123
Lack of Rate limiting in Authentication in TopEase
Published: 30. November 2021
Severity: 7.5 - high
MITRE: CVE-2021-42144
Insufficient Session Expiration in TopEase
Published: 30. November 2021
Severity: 8.1 - high
MITRE: CVE-2021-42145
Blacksmith, Scalable Rowhammering In the Frequency Domain to Bypass TRR Mitigations On Modern DDR4/LPDDR4X Devices
Published: 15. November 2021
Severity: 9.0 - critical
Ultima modifica 23.04.2025
