Security Radar

CVE-2024-38856 Severity under analysis added on 08/27/2024

Apache OFBiz Incorrect Authorization Vulnerability

Apache · OFBiz · CWE-863

Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker.

CVE-2024-7971 Severity under analysis added on 08/26/2024

Google Chromium V8 Type Confusion Vulnerability

Google · Chromium V8 · CWE-843

Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

CVE-2022-0185 Severity under analysis added on 08/21/2024

Linux Kernel Heap-Based Buffer Overflow Vulnerability

Linux · Kernel · CWE-190

Linux kernel contains a heap-based buffer overflow vulnerability in the legacy_parse_param function in the Filesystem Context functionality. This allows an attacker to open a filesystem that does not support the Filesystem Context API and ultimately escalate privileges.

CVE-2021-31196 Severity under analysis added on 08/21/2024

Microsoft Exchange Server Information Disclosure Vulnerability

Microsoft · Exchange Server

Microsoft Exchange Server contains an information disclosure vulnerability that allows for remote code execution.

CVE-2024-38213 Severity under analysis added on 08/13/2024

Microsoft Windows SmartScreen Security Feature Bypass Vulnerability

Microsoft · Windows · CWE-693

Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience via a malicious file.

CVE-2024-38193 Severity under analysis added on 08/13/2024

Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability

Microsoft · Windows · CWE-416

Microsoft Windows Ancillary Function Driver for WinSock contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.

CVE-2024-38189 Severity under analysis added on 08/13/2024

Microsoft Project Remote Code Execution Vulnerability

Microsoft · Project · CWE-20

Microsoft Project contains an unspecified vulnerability that allows for remote code execution via a malicious file.

CVE-2024-38178 Severity under analysis added on 08/13/2024

Microsoft Windows Scripting Engine Memory Corruption Vulnerability

Microsoft · Windows · CWE-843

Microsoft Windows Scripting Engine contains a memory corruption vulnerability that allows unauthenticated attacker to initiate remote code execution via a specially crafted URL.

CVE-2024-38107 Severity under analysis added on 08/13/2024

Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability

Microsoft · Windows · CWE-416

Microsoft Windows Power Dependency Coordinator contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to obtain SYSTEM privileges.

CVE-2024-38106 Severity under analysis added on 08/13/2024

Microsoft Windows Kernel Privilege Escalation Vulnerability

Microsoft · Windows · CWE-591

Microsoft Windows Kernel contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Successful exploitation of this vulnerability requires an attacker to win a race condition.

CVE-2024-32113 Severity under analysis added on 08/07/2024

Apache OFBiz Path Traversal Vulnerability

Apache · OFBiz · CWE-22

Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution.

CVE-2018-0824 Severity under analysis added on 08/05/2024

Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability

Microsoft · Windows · CWE-502

Microsoft COM for Windows contains a deserialization of untrusted data vulnerability that allows for privilege escalation and remote code execution via a specially crafted file or script.

CVE-2024-37085 Severity under analysis Ransomware added on 07/30/2024

VMware ESXi Authentication Bypass Vulnerability

VMware · ESXi · CWE-305

VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.

CVE-2012-4792 Severity under analysis added on 07/23/2024

Microsoft Internet Explorer Use-After-Free Vulnerability

Microsoft · Internet Explorer · CWE-416

Microsoft Internet Explorer contains a use-after-free vulnerability that allows a remote attacker to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object.

CVE-2024-34102 Severity under analysis added on 07/17/2024

Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability

Adobe · Commerce and Magento Open Source · CWE-611

Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution.

CVE-2022-22948 Severity under analysis added on 07/17/2024

VMware vCenter Server Incorrect Default File Permissions Vulnerability

VMware · vCenter Server · CWE-276

VMware vCenter Server contains an incorrect default file permissions vulnerability that allows a remote, privileged attacker to gain access to sensitive information.

CVE-2024-38112 Severity under analysis added on 07/09/2024

Microsoft Windows MSHTML Platform Spoofing Vulnerability

Microsoft · Windows · CWE-451

Microsoft Windows MSHTML Platform contains a spoofing vulnerability that has a high impact to confidentiality, integrity, and availability.

CVE-2024-38080 Severity under analysis added on 07/09/2024

Microsoft Windows Hyper-V Privilege Escalation Vulnerability

Microsoft · Windows · CWE-190

Microsoft Windows Hyper-V contains a privilege escalation vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.

CVE-2024-20399 Severity under analysis added on 07/02/2024

Cisco NX-OS Command Injection Vulnerability

Cisco · NX-OS · CWE-78

Cisco NX-OS contains a command injection vulnerability in the command line interface (CLI) that could allow an authenticated, local attacker to execute commands as root on the underlying operating system of an affected device.

CVE-2022-2586 Severity under analysis added on 06/26/2024

Linux Kernel Use-After-Free Vulnerability

Linux · Kernel · CWE-416

Linux Kernel contains a use-after-free vulnerability in the nft_object, allowing local attackers to escalate privileges.

CVE-2024-4358 Severity under analysis added on 06/13/2024

Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability

Progress · Telerik Report Server · CWE-290

Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access.

CVE-2024-26169 Severity under analysis Ransomware added on 06/13/2024

Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability

Microsoft · Windows · CWE-269

Microsoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.

CVE-2017-3506 Severity under analysis added on 06/03/2024

Oracle WebLogic Server OS Command Injection Vulnerability

Oracle · WebLogic Server · CWE-78

Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document.

CVE-2024-1086 Severity under analysis Ransomware added on 05/30/2024

Linux Kernel Use-After-Free Vulnerability

Linux · Kernel · CWE-416

Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation.