Security Radar

CVE-2021-21985 Severity under analysis Ransomware added on 11/03/2021

VMware vCenter Server Improper Input Validation Vulnerability

VMware · vCenter Server · CWE-20, CWE-470, CWE-918

VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution.

CVE-2021-21972 Severity under analysis Ransomware added on 11/03/2021

VMware vCenter Server Remote Code Execution Vulnerability

VMware · vCenter Server · CWE-23

VMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system.

CVE-2021-20023 Severity under analysis Ransomware added on 11/03/2021

SonicWall Email Security Path Traversal Vulnerability

SonicWall · SonicWall Email Security · CWE-22

SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20022 to achieve privilege escalation.

CVE-2021-20022 Severity under analysis Ransomware added on 11/03/2021

SonicWall Email Security Unrestricted Upload of File Vulnerability

SonicWall · SonicWall Email Security · CWE-434

SonicWall Email Security contains an unrestricted upload of file with dangerous type vulnerability that allows a post-authenticated attacker to upload a file to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20023 to achieve privilege escalation.

CVE-2021-20021 Severity under analysis Ransomware added on 11/03/2021

SonicWall Email Security Improper Privilege Management Vulnerability

SonicWall · SonicWall Email Security · CWE-306

SonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20022 and CVE-2021-20023 to achieve privilege escalation.

CVE-2021-20016 Severity under analysis Ransomware added on 11/03/2021

SonicWall SSLVPN SMA100 SQL Injection Vulnerability

SonicWall · SSLVPN SMA100 · CWE-89

SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker.

CVE-2021-1732 Severity under analysis Ransomware added on 11/03/2021

Microsoft Win32k Privilege Escalation Vulnerability

Microsoft · Win32k · CWE-787

Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.

CVE-2021-1675 Severity under analysis Ransomware added on 11/03/2021

Microsoft Windows Print Spooler Remote Code Execution Vulnerability

Microsoft · Windows · CWE-285

Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution.

CVE-2020-5902 Severity under analysis Ransomware added on 11/03/2021

F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability

F5 · BIG-IP · CWE-22

F5 BIG-IP Traffic Management User Interface (TMUI) contains a remote code execution vulnerability in undisclosed pages.

CVE-2020-3992 Severity under analysis Ransomware added on 11/03/2021

VMware ESXi OpenSLP Use-After-Free Vulnerability

VMware · ESXi · CWE-416

VMware ESXi OpenSLP contains a use-after-free vulnerability that allows an attacker residing in the management network with access to port 427 to perform remote code execution.

CVE-2020-3580 Severity under analysis Ransomware added on 11/03/2021

Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability

Cisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) · CWE-79

Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an insufficient input validation vulnerability for user-supplied input by the web services interface. Successful exploitation could allow an attacker to perform cross-site scripting (XSS) in the context of the interface or access sensitive browser-based information.

CVE-2020-1472 Severity under analysis Ransomware added on 11/03/2021

Microsoft Netlogon Privilege Escalation Vulnerability

Microsoft · Netlogon · CWE-330

Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller. An attacker who successfully exploits the vulnerability could run a specially crafted application on a device on the network. The vulnerability is also known under the moniker of Zerologon.

CVE-2020-12812 Severity under analysis Ransomware added on 11/03/2021

Fortinet FortiOS SSL VPN Improper Authentication Vulnerability

Fortinet · FortiOS · CWE-178, CWE-287

Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username.

CVE-2020-12271 Severity under analysis Ransomware added on 11/03/2021

Sophos SFOS SQL Injection Vulnerability

Sophos · SFOS · CWE-89

Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).

CVE-2020-0968 Severity under analysis Ransomware added on 11/03/2021

Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability

Microsoft · Internet Explorer · CWE-787

Microsoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution.

CVE-2020-0878 Severity under analysis Ransomware added on 11/03/2021

Microsoft Edge and Internet Explorer Memory Corruption Vulnerability

Microsoft · Edge and Internet Explorer · CWE-787

Microsoft Edge and Internet Explorer contain a memory corruption vulnerability that allows attackers to execute code in the context of the current user.

CVE-2020-0688 Severity under analysis Ransomware added on 11/03/2021

Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability

Microsoft · Exchange Server · CWE-287

Microsoft Exchange Server Validation Key fails to properly create unique keys at install time, allowing for remote code execution.

CVE-2019-7481 Severity under analysis Ransomware added on 11/03/2021

SonicWall SMA100 SQL Injection Vulnerability

SonicWall · SMA100 · CWE-89

SonicWall SMA100 contains a SQL injection vulnerability allowing an unauthenticated user to gain read-only access to unauthorized resources.

CVE-2019-5591 Severity under analysis Ransomware added on 11/03/2021

Fortinet FortiOS Default Configuration Vulnerability

Fortinet · FortiOS · CWE-306

Fortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol (LDAP) server.

CVE-2019-5544 Severity under analysis Ransomware added on 11/03/2021

VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability

VMware · VMware ESXi and Horizon DaaS · CWE-787

VMware ESXi and Horizon Desktop as a Service (DaaS) OpenSLP contains a heap-based buffer overflow vulnerability that allows an attacker with network access to port 427 to overwrite the heap of the OpenSLP service to perform remote code execution.

CVE-2019-3396 Severity under analysis Ransomware added on 11/03/2021

Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability

Atlassian · Confluence Server and Data Server · CWE-22

Atlassian Confluence Server and Data Center contain a server-side template injection vulnerability that may allow an attacker to achieve path traversal and remote code execution.

CVE-2019-19781 Severity under analysis Ransomware added on 11/03/2021

Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability

Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance · CWE-22

Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an unspecified vulnerability that could allow an unauthenticated attacker to perform code execution.

CVE-2019-18935 Severity under analysis Ransomware added on 11/03/2021

Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability

Progress · Telerik UI for ASP.NET AJAX · CWE-502

Progress Telerik UI for ASP.NET AJAX contains a deserialization of untrusted data vulnerability through RadAsyncUpload which leads to code execution on the server in the context of the w3wp.exe process.

CVE-2019-1367 Severity under analysis Ransomware added on 11/03/2021

Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability

Microsoft · Internet Explorer · CWE-787

Microsoft Internet Explorer contains a memory corruption vulnerability in how the scripting engine handles objects in memory. Successful exploitation allows for remote code execution in the context of the current user.