Security Radar

CVE-2023-35082 Severity under analysis Ransomware added on 01/18/2024

Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability

Ivanti · Endpoint Manager Mobile (EPMM) and MobileIron Core · CWE-287

Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core contain an authentication bypass vulnerability that allows unauthorized users to access restricted functionality or resources of the application.

CVE-2024-21887 Severity under analysis Ransomware added on 01/10/2024

Ivanti Connect Secure and Policy Secure Command Injection Vulnerability

Ivanti · Connect Secure and Policy Secure · CWE-77

Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products, which can allow an authenticated administrator to send crafted requests to execute code on affected appliances. This vulnerability can be leveraged in conjunction with CVE-2023-46805, an authenticated bypass issue.

CVE-2023-46805 Severity under analysis Ransomware added on 01/10/2024

Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability

Ivanti · Connect Secure and Policy Secure · CWE-287

Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that allows an attacker to access restricted resources by bypassing control checks. This vulnerability can be leveraged in conjunction with CVE-2024-21887, a command injection vulnerability.

CVE-2023-29357 Severity under analysis Ransomware added on 01/10/2024

Microsoft SharePoint Server Privilege Escalation Vulnerability

Microsoft · SharePoint Server · CWE-303

Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them for executing a network attack. This attack bypasses authentication, enabling the attacker to gain administrator privileges.

CVE-2023-38203 Severity under analysis Ransomware added on 01/08/2024

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe · ColdFusion · CWE-502

Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.

CVE-2023-29300 Severity under analysis Ransomware added on 01/08/2024

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe · ColdFusion · CWE-502

Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.

CVE-2023-41266 Severity under analysis Ransomware added on 12/07/2023

Qlik Sense Path Traversal Vulnerability

Qlik · Sense · CWE-20

Qlik Sense contains a path traversal vulnerability that allows a remote, unauthenticated attacker to create an anonymous session by sending maliciously crafted HTTP requests. This anonymous session could allow the attacker to send further requests to unauthorized endpoints.

CVE-2023-41265 Severity under analysis Ransomware added on 12/07/2023

Qlik Sense HTTP Tunneling Vulnerability

Qlik · Sense · CWE-444

Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.

CVE-2023-47246 Severity under analysis Ransomware added on 11/13/2023

SysAid Server Path Traversal Vulnerability

SysAid · SysAid Server · CWE-22

SysAid Server (on-premises version) contains a path traversal vulnerability that leads to code execution.

CVE-2023-22518 Severity under analysis Ransomware added on 11/07/2023

Atlassian Confluence Data Center and Server Improper Authorization Vulnerability

Atlassian · Confluence Data Center and Server · CWE-863

Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker. There is no impact on confidentiality since the attacker cannot exfiltrate any data.

CVE-2023-46604 Severity under analysis Ransomware added on 11/02/2023

Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

Apache · ActiveMQ · CWE-502

Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.

CVE-2023-46747 Severity under analysis Ransomware added on 10/31/2023

F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability

F5 · BIG-IP Configuration Utility · CWE-288

F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748.

CVE-2023-4966 Severity under analysis Ransomware added on 10/18/2023

Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability

Citrix · NetScaler ADC and NetScaler Gateway · CWE-119

Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.

CVE-2023-40044 Severity under analysis Ransomware added on 10/05/2023

Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability

Progress · WS_FTP Server · CWE-502

Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system.

CVE-2023-22515 Severity under analysis Ransomware added on 10/05/2023

Atlassian Confluence Data Center and Server Broken Access Control Vulnerability

Atlassian · Confluence Data Center and Server

Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.

CVE-2023-42793 Severity under analysis Ransomware added on 10/04/2023

JetBrains TeamCity Authentication Bypass Vulnerability

JetBrains · TeamCity · CWE-288

JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server.

CVE-2021-3129 Severity under analysis Ransomware added on 09/18/2023

Laravel Ignition File Upload Vulnerability

Laravel · Ignition

Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of file_get_contents() and file_put_contents().

CVE-2017-6884 Severity under analysis Ransomware added on 09/18/2023

Zyxel EMG2926 Routers Command Injection Vulnerability

Zyxel · EMG2926 Routers · CWE-78

Zyxel EMG2926 routers contain a command injection vulnerability located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute malicious commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.

CVE-2023-20269 Severity under analysis Ransomware added on 09/13/2023

Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability

Cisco · Adaptive Security Appliance and Firepower Threat Defense · CWE-288

Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user.

CVE-2023-38831 Severity under analysis Ransomware added on 08/24/2023

RARLAB WinRAR Code Execution Vulnerability

RARLAB · WinRAR · CWE-351

RARLAB WinRAR contains an unspecified vulnerability that allows an attacker to execute code when a user attempts to view a benign file within a ZIP archive.

CVE-2023-38035 Severity under analysis Ransomware added on 08/22/2023

Ivanti Sentry Authentication Bypass Vulnerability

Ivanti · Sentry · CWE-863

Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.

CVE-2023-27532 Severity under analysis Ransomware added on 08/22/2023

Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability

Veeam · Backup & Replication · CWE-306

Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts.

CVE-2023-35078 Severity under analysis Ransomware added on 07/25/2023

Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability

Ivanti · Endpoint Manager Mobile (EPMM) · CWE-287

Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contains an authentication bypass vulnerability that allows unauthenticated access to specific API paths. An attacker with access to these API paths can access personally identifiable information (PII) such as names, phone numbers, and other mobile device details for users on a vulnerable system. An attacker can also make other configuration changes including installing software and modifying security profiles on registered devices.

CVE-2023-3519 Severity under analysis Ransomware added on 07/19/2023

Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability

Citrix · NetScaler ADC and NetScaler Gateway · CWE-94

Citrix NetScaler ADC and NetScaler Gateway contains a code injection vulnerability that allows for unauthenticated remote code execution.