Security Radar

CVE-2014-6324 Severity under analysis added on 03/25/2022

Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability

Microsoft · Kerberos Key Distribution Center (KDC) · CWE-264

The Kerberos Key Distribution Center (KDC) in Microsoft allows remote authenticated domain users to obtain domain administrator privileges.

CVE-2014-6287 Severity under analysis added on 03/25/2022

Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability

Rejetto · HTTP File Server (HFS) · CWE-94

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (HFS or HttpFileServer) allows remote attackers to execute arbitrary programs.

CVE-2014-3120 Severity under analysis added on 03/25/2022

Elasticsearch Remote Code Execution Vulnerability

Elastic · Elasticsearch · CWE-284

Elasticsearch enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code.

CVE-2014-0130 Severity under analysis added on 03/25/2022

Ruby on Rails Directory Traversal Vulnerability

Rails · Ruby on Rails · CWE-22

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails allows remote attackers to read arbitrary files via a crafted request.

CVE-2013-5223 Severity under analysis added on 03/25/2022

D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability

D-Link · DSL-2760U · CWE-79

A cross-site scripting (XSS) vulnerability exists in the D-Link DSL-2760U gateway, allowing remote authenticated users to inject arbitrary web script or HTML.

CVE-2013-4810 Severity under analysis added on 03/25/2022

HP Multiple Products Remote Code Execution Vulnerability

Hewlett Packard (HP) · ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management · CWE-94

HP ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet.

CVE-2013-2251 Severity under analysis added on 03/25/2022

Apache Struts Improper Input Validation Vulnerability

Apache · Struts · CWE-20

Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigation Language (OGNL) expressions.

CVE-2012-1823 Severity under analysis added on 03/25/2022

PHP-CGI Query String Parameter Vulnerability

PHP · PHP · CWE-20

sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code.

CVE-2010-4345 Severity under analysis added on 03/25/2022

Exim Privilege Escalation Vulnerability

Exim · Exim · CWE-264

Exim allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands.

CVE-2010-4344 Severity under analysis added on 03/25/2022

Exim Heap-Based Buffer Overflow Vulnerability

Exim · Exim · CWE-119

Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session.

CVE-2010-3035 Severity under analysis added on 03/25/2022

Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability

Cisco · IOS XR · CWE-20

Cisco IOS XR, when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).

CVE-2010-2861 Severity under analysis Ransomware added on 03/25/2022

Adobe ColdFusion Directory Traversal Vulnerability

Adobe · ColdFusion · CWE-22

A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files.

CVE-2009-2055 Severity under analysis added on 03/25/2022

Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability

Cisco · IOS XR · CWE-20

Cisco IOS XR,when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).

CVE-2009-1151 Severity under analysis added on 03/25/2022

phpMyAdmin Remote Code Execution Vulnerability

phpMyAdmin · phpMyAdmin · CWE-94

Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file.

CVE-2009-0927 Severity under analysis added on 03/25/2022

Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability

Adobe · Reader and Acrobat · CWE-20

Stack-based buffer overflow in Adobe Reader and Adobe Acrobat allows remote attackers to execute arbitrary code.

CVE-2005-2773 Severity under analysis added on 03/25/2022

HP OpenView Network Node Manager Remote Code Execution Vulnerability

Hewlett Packard (HP) · OpenView Network Node Manager

HP OpenView Network Node Manager could allow a remote attacker to execute arbitrary commands on the system.

CVE-2020-5135 Severity under analysis Ransomware added on 03/15/2022

SonicWall SonicOS Buffer Overflow Vulnerability

SonicWall · SonicOS · CWE-120

A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall.

CVE-2019-1405 Severity under analysis Ransomware added on 03/15/2022

Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability

Microsoft · Windows

A privilege escalation vulnerability exists when the Windows UPnP service improperly allows COM object creation.

CVE-2019-1322 Severity under analysis Ransomware added on 03/15/2022

Microsoft Windows Privilege Escalation Vulnerability

Microsoft · Windows

A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context.

CVE-2019-1315 Severity under analysis Ransomware added on 03/15/2022

Microsoft Windows Error Reporting Manager Privilege Escalation Vulnerability

Microsoft · Windows · CWE-59

A privilege escalation vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status.

CVE-2019-1253 Severity under analysis Ransomware added on 03/15/2022

Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability

Microsoft · Windows · CWE-59

A privilege escalation vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.

CVE-2019-1132 Severity under analysis added on 03/15/2022

Microsoft Win32k Privilege Escalation Vulnerability

Microsoft · Win32k

A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory.

CVE-2019-1129 Severity under analysis Ransomware added on 03/15/2022

Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability

Microsoft · Windows · CWE-59

A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.

CVE-2019-1069 Severity under analysis Ransomware added on 03/15/2022

Microsoft Task Scheduler Privilege Escalation Vulnerability

Microsoft · Task Scheduler · CWE-59

A privilege escalation vulnerability exists in the way the Task Scheduler Service validates certain file operations.