Security Radar

CVE-2019-0604 Severity under analysis Ransomware added on 11/03/2021

Microsoft SharePoint Remote Code Execution Vulnerability

Microsoft · SharePoint · CWE-20

Microsoft SharePoint fails to check the source markup of an application package. An attacker who successfully exploits the vulnerability could run remote code in the context of the SharePoint application pool and the SharePoint server farm account.

CVE-2019-0541 Severity under analysis added on 11/03/2021

Microsoft MSHTML Remote Code Execution Vulnerability

Microsoft · MSHTML · CWE-77

Microsoft MSHTML engine contains an improper input validation vulnerability that allows for remote code execution vulnerability.

CVE-2019-0211 Severity under analysis added on 11/03/2021

Apache HTTP Server Privilege Escalation Vulnerability

Apache · HTTP Server · CWE-416

Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute code with the privileges of the parent process (usually root) by manipulating the scoreboard.

CVE-2018-8653 Severity under analysis added on 11/03/2021

Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability

Microsoft · Internet Explorer · CWE-787

Microsoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution.

CVE-2018-4939 Severity under analysis added on 11/03/2021

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe · ColdFusion · CWE-502

Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could allow for code execution.

CVE-2018-4878 Severity under analysis Ransomware added on 11/03/2021

Adobe Flash Player Use-After-Free Vulnerability

Adobe · Flash Player · CWE-416

Adobe Flash Player contains a use-after-free vulnerability that could allow for code execution.

CVE-2018-2380 Severity under analysis Ransomware added on 11/03/2021

SAP Customer Relationship Management (CRM) Path Traversal Vulnerability

SAP · Customer Relationship Management (CRM) · CWE-22

SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.

CVE-2018-15961 Severity under analysis added on 11/03/2021

Adobe ColdFusion Unrestricted File Upload Vulnerability

Adobe · ColdFusion · CWE-434

Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution.

CVE-2018-13379 Severity under analysis Ransomware added on 11/03/2021

Fortinet FortiOS SSL VPN Path Traversal Vulnerability

Fortinet · FortiOS · CWE-22

Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.

CVE-2018-11776 Severity under analysis added on 11/03/2021

Apache Struts Remote Code Execution Vulnerability

Apache · Struts · CWE-20

Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace. Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace.

CVE-2018-0802 Severity under analysis Ransomware added on 11/03/2021

Microsoft Office Memory Corruption Vulnerability

Microsoft · Office · CWE-787

Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0798.

CVE-2018-0798 Severity under analysis added on 11/03/2021

Microsoft Office Memory Corruption Vulnerability

Microsoft · Office · CWE-787

Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0802.

CVE-2018-0296 Severity under analysis added on 11/03/2021

Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability

Cisco · Adaptive Security Appliance (ASA) · CWE-20

Cisco Adaptive Security Appliance (ASA) contains an improper input validation vulnerability with HTTP URLs. Exploitation could allow an attacker to cause a denial-of-service (DoS) condition or information disclosure.

CVE-2018-0171 Severity under analysis added on 11/03/2021

Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability

Cisco · IOS and IOS XE · CWE-20

Cisco IOS and IOS XE Software improperly validates packet data, allowing an unauthenticated, remote attacker to trigger a reload of an affected device, cause a denial-of-service (DoS) condition, or perform code execution on the affected device.

CVE-2017-9805 Severity under analysis added on 11/03/2021

Apache Struts Deserialization of Untrusted Data Vulnerability

Apache · Struts · CWE-502

Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.

CVE-2017-9248 Severity under analysis added on 11/03/2021

Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability

Progress · ASP.NET AJAX and Sitefinity · CWE-522

Progress Telerik UI for ASP.NET AJAX and Sitefinity have a cryptographic weakness in Telerik.Web.UI.dll that can be exploited to disclose encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or the MachineKey), perform cross-site-scripting (XSS) attacks, compromise the ASP.NET ViewState, and/or upload and download files.

CVE-2017-8759 Severity under analysis added on 11/03/2021

Microsoft .NET Framework Remote Code Execution Vulnerability

Microsoft · .NET Framework · CWE-20

Microsoft .NET Framework contains a remote code execution vulnerability when processing untrusted input that could allow an attacker to take control of an affected system.

CVE-2017-7269 Severity under analysis added on 11/03/2021

Microsoft Windows Server Buffer Overflow Vulnerability

Microsoft · Internet Information Services (IIS) · CWE-119

Microsoft Windows Server 2003 R2 contains a buffer overflow vulnerability in Internet Information Services (IIS) 6.0 which allows remote attackers to execute code via a long header beginning with "If:

CVE-2017-5638 Severity under analysis Ransomware added on 11/03/2021

Apache Struts Remote Code Execution Vulnerability

Apache · Struts · CWE-20

Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.

CVE-2017-11882 Severity under analysis Ransomware added on 11/03/2021

Microsoft Office Memory Corruption Vulnerability

Microsoft · Office · CWE-119

Microsoft Office contains a memory corruption vulnerability that allows remote code execution in the context of the current user.

CVE-2017-11774 Severity under analysis added on 11/03/2021

Microsoft Office Outlook Security Feature Bypass Vulnerability

Microsoft · Office · CWE-119

Microsoft Office Outlook contains a security feature bypass vulnerability due to improperly handling objects in memory. Successful exploitation allows an attacker to execute commands.

CVE-2017-0199 Severity under analysis Ransomware added on 11/03/2021

Microsoft Office and WordPad Remote Code Execution Vulnerability

Microsoft · Office and WordPad

Microsoft Office and WordPad contain an unspecified vulnerability due to the way the applications parse specially crafted files. Successful exploitation allows for remote code execution.

CVE-2017-0143 Severity under analysis Ransomware added on 11/03/2021

Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability

Microsoft · Windows · CWE-20

Microsoft Windows Server Message Block 1.0 (SMBv1) contains an unspecified vulnerability that allows for remote code execution.

CVE-2016-9563 Severity under analysis added on 11/03/2021

SAP NetWeaver XML External Entity (XXE) Vulnerability

SAP · NetWeaver · CWE-611

SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity (XXE) attacks.