Security Radar

CVE-2022-37969 Severity under analysis Ransomware added on 09/14/2022

Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability

Microsoft · Windows · CWE-20, CWE-787

Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.

CVE-2022-3075 Severity under analysis added on 09/08/2022

Google Chromium Mojo Insufficient Data Validation Vulnerability

Google · Chromium Mojo · CWE-20

Google Chromium Mojo contains an insufficient data validation vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

CVE-2018-2628 Severity under analysis added on 09/08/2022

Oracle WebLogic Server Unspecified Vulnerability

Oracle · WebLogic Server · CWE-502

Oracle WebLogic Server contains an unspecified vulnerability which can allow an unauthenticated attacker with T3 network access to compromise the server.

CVE-2018-13374 Severity under analysis Ransomware added on 09/08/2022

Fortinet FortiOS and FortiADC Improper Access Control Vulnerability

Fortinet · FortiOS and FortiADC · CWE-732

Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server.

CVE-2022-24706 Severity under analysis added on 08/25/2022

Apache CouchDB Insecure Default Initialization of Resource Vulnerability

Apache · CouchDB · CWE-1188

Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow an attacker to escalate to administrative privileges.

CVE-2022-24112 Severity under analysis added on 08/25/2022

Apache APISIX Authentication Bypass Vulnerability

Apache · APISIX · CWE-290

Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution.

CVE-2022-0028 Severity under analysis added on 08/22/2022

Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability

Palo Alto Networks · PAN-OS · CWE-940

A Palo Alto Networks PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks.

CVE-2022-2856 Severity under analysis added on 08/18/2022

Google Chromium Intents Insufficient Input Validation Vulnerability

Google · Chromium Intents · CWE-20

Google Chromium Intents contains an insufficient validation of untrusted input vulnerability that allows a remote attacker to browse to a malicious website via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

CVE-2022-26923 Severity under analysis added on 08/18/2022

Microsoft Active Directory Domain Services Privilege Escalation Vulnerability

Microsoft · Active Directory · CWE-295

An authenticated user could manipulate attributes on computer accounts they own or manage, and acquire a certificate from Active Directory Certificate Services that would allow for privilege escalation to SYSTEM.

CVE-2022-22536 Severity under analysis added on 08/18/2022

SAP Multiple Products HTTP Request Smuggling Vulnerability

SAP · Multiple Products · CWE-444

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.

CVE-2022-21971 Severity under analysis added on 08/18/2022

Microsoft Windows Runtime Remote Code Execution Vulnerability

Microsoft · Windows · CWE-824

Microsoft Windows Runtime contains an unspecified vulnerability that allows for remote code execution.

CVE-2017-15944 Severity under analysis added on 08/18/2022

Palo Alto Networks PAN-OS Remote Code Execution Vulnerability

Palo Alto Networks · PAN-OS

Palo Alto Networks PAN-OS contains multiple, unspecified vulnerabilities which can allow for remote code execution when chained.

CVE-2022-34713 Severity under analysis added on 08/09/2022

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

Microsoft · Windows

A remote code execution vulnerability exists when Microsoft Windows MSDT is called using the URL protocol from a calling application.

CVE-2022-26138 Severity under analysis added on 07/29/2022

Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability

Atlassian · Confluence · CWE-798

Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group.

CVE-2022-22047 Severity under analysis added on 07/12/2022

Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability

Microsoft · Windows · CWE-426

Microsoft Windows CSRSS contains an unspecified vulnerability that allows for privilege escalation to SYSTEM privileges.

CVE-2022-26925 Severity under analysis added on 07/01/2022

Microsoft Windows LSA Spoofing Vulnerability

Microsoft · Windows · CWE-306

Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM.

CVE-2021-30533 Severity under analysis added on 06/27/2022

Google Chromium PopupBlocker Security Bypass Vulnerability

Google · Chromium PopupBlocker · CWE-863

Google Chromium PopupBlocker contains an insufficient policy enforcement vulnerability that allows a remote attacker to bypass navigation restrictions via a crafted iframe. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

CVE-2022-30190 Severity under analysis Ransomware added on 06/14/2022

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

Microsoft · Windows · CWE-610

A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.

CVE-2021-38163 Severity under analysis added on 06/09/2022

SAP NetWeaver Unrestricted File Upload Vulnerability

SAP · NetWeaver · CWE-23

SAP NetWeaver contains a vulnerability that allows unrestricted file upload.

CVE-2016-2388 Severity under analysis added on 06/09/2022

SAP NetWeaver Information Disclosure Vulnerability

SAP · NetWeaver · CWE-200

The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request.

CVE-2016-2386 Severity under analysis added on 06/09/2022

SAP NetWeaver SQL Injection Vulnerability

SAP · NetWeaver · CWE-89

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2019-5825 Severity under analysis added on 06/08/2022

Google Chromium V8 Out-of-Bounds Write Vulnerability

Google · Chromium V8 · CWE-787

Google Chromium V8 Engine contains an out-of-bounds write vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

CVE-2019-15271 Severity under analysis added on 06/08/2022

Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability

Cisco · RV Series Routers · CWE-502

A deserialization of untrusted data vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an attacker to execute code with root privileges.

CVE-2018-6065 Severity under analysis added on 06/08/2022

Google Chromium V8 Integer Overflow Vulnerability

Google · Chromium V8 · CWE-190, CWE-787

Google Chromium V8 Engine contains an integer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.