Security Radar

CVE-2022-27926 Severity under analysis added on 04/03/2023

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Synacor · Zimbra Collaboration Suite (ZCS) · CWE-79, CWE-138

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability by allowing an endpoint URL to accept parameters without sanitizing.

CVE-2023-0266 Severity under analysis added on 03/30/2023

Linux Kernel Use-After-Free Vulnerability

Linux · Kernel · CWE-416

Linux kernel contains a use-after-free vulnerability that allows for privilege escalation to gain ring0 access from the system user.

CVE-2022-42948 Severity under analysis added on 03/30/2023

Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability

Fortra · Cobalt Strike · CWE-79, CWE-116

Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution.

CVE-2022-39197 Severity under analysis added on 03/30/2023

Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability

Fortra · Cobalt Strike · CWE-20, CWE-79

Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely.

CVE-2022-38181 Severity under analysis added on 03/30/2023

Arm Mali GPU Kernel Driver Use-After-Free Vulnerability

Arm · Mali Graphics Processing Unit (GPU) · CWE-416

Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.

CVE-2022-3038 Severity under analysis added on 03/30/2023

Google Chromium Network Service Use-After-Free Vulnerability

Google · Chromium Network Service · CWE-416

Google Chromium Network Service contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

CVE-2022-22706 Severity under analysis added on 03/30/2023

Arm Mali GPU Kernel Driver Unspecified Vulnerability

Arm · Mali Graphics Processing Unit (GPU) · CWE-119

Arm Mali GPU Kernel Driver contains an unspecified vulnerability that allows a non-privileged user to achieve write access to read-only memory pages.

CVE-2021-30900 Severity under analysis added on 03/30/2023

Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability

Apple · iOS, iPadOS, and macOS · CWE-20, CWE-787

Apple GPU drivers, included in iOS, iPadOS, and macOS, contain an out-of-bounds write vulnerability that may allow a malicious application to execute code with kernel privileges.

CVE-2017-7494 Severity under analysis Ransomware added on 03/30/2023

Samba Remote Code Execution Vulnerability

Samba · Samba · CWE-94

Samba contains a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share and then cause the server to load and execute it.

CVE-2013-3163 Severity under analysis added on 03/30/2023

Microsoft Internet Explorer Memory Corruption Vulnerability

Microsoft · Internet Explorer · CWE-94

Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial of service via a crafted website.

CVE-2023-26360 Severity under analysis added on 03/15/2023

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe · ColdFusion · CWE-284

Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution.

CVE-2023-24880 Severity under analysis Ransomware added on 03/14/2023

Microsoft Windows SmartScreen Security Feature Bypass Vulnerability

Microsoft · Windows · CWE-863

Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.

CVE-2023-23397 Severity under analysis added on 03/14/2023

Microsoft Office Outlook Privilege Escalation Vulnerability

Microsoft · Office · CWE-294

Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user.

CVE-2022-41328 Severity under analysis added on 03/14/2023

Fortinet FortiOS Path Traversal Vulnerability

Fortinet · FortiOS · CWE-22

Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands.

CVE-2021-39144 Severity under analysis added on 03/10/2023

XStream Remote Code Execution Vulnerability

XStream · XStream · CWE-94, CWE-502

XStream contains a remote code execution vulnerability that allows an attacker to manipulate the processed input stream and replace or inject objects that result in the execution of a local command on the server. This vulnerability can affect multiple products, including but not limited to VMware Cloud Foundation.

CVE-2020-5741 Severity under analysis added on 03/10/2023

Plex Media Server Remote Code Execution Vulnerability

Plex · Media Server · CWE-502

Plex Media Server contains a remote code execution vulnerability that allows an attacker with access to the server administrator's Plex account to upload a malicious file via the Camera Upload feature and have the media server execute it.

CVE-2022-35914 Severity under analysis added on 03/07/2023

Teclib GLPI Remote Code Execution Vulnerability

Teclib · GLPI · CWE-74

Teclib GLPI contains a remote code execution vulnerability in the third-party library, htmlawed.

CVE-2022-33891 Severity under analysis added on 03/07/2023

Apache Spark Command Injection Vulnerability

Apache · Spark · CWE-78

Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled.

CVE-2022-28810 Severity under analysis added on 03/07/2023

Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability

Zoho · ManageEngine · CWE-78, CWE-259

Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset.

CVE-2022-36537 Severity under analysis Ransomware added on 02/27/2023

ZK Framework AuUploader Unspecified Vulnerability

ZK Framework · AuUploader · CWE-441

ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager.

CVE-2022-47986 Severity under analysis Ransomware added on 02/21/2023

IBM Aspera Faspex Code Execution Vulnerability

IBM · Aspera Faspex · CWE-502

IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw.

CVE-2022-41223 Severity under analysis Ransomware added on 02/21/2023

Mitel MiVoice Connect Code Injection Vulnerability

Mitel · MiVoice Connect · CWE-94

The Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application.

CVE-2022-40765 Severity under analysis Ransomware added on 02/21/2023

Mitel MiVoice Connect Command Injection Vulnerability

Mitel · MiVoice Connect · CWE-77

The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system.

CVE-2022-46169 Severity under analysis added on 02/16/2023

Cacti Command Injection Vulnerability

Cacti · Cacti · CWE-74

Cacti contains a command injection vulnerability that allows an unauthenticated user to execute code.