Security Radar

CVE-2022-21882 Severity under analysis Ransomware added on 02/04/2022

Microsoft Win32k Privilege Escalation Vulnerability

Microsoft · Win32k · CWE-787

Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.

CVE-2022-22587 Severity under analysis added on 01/28/2022

Apple Memory Corruption Vulnerability

Apple · iOS and macOS · CWE-20, CWE-787

Apple IOMobileFrameBuffer contains a memory corruption vulnerability which can allow a malicious application to execute arbitrary code with kernel privileges.

CVE-2021-20038 Severity under analysis Ransomware added on 01/28/2022

SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability

SonicWall · SMA 100 Appliances · CWE-121

SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution.

CVE-2020-5722 Severity under analysis added on 01/28/2022

Grandstream Networks UCM6200 Series SQL Injection Vulnerability

Grandstream · UCM6200 · CWE-89

Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. Exploitation can allow for code execution as root.

CVE-2020-0787 Severity under analysis Ransomware added on 01/28/2022

Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability

Microsoft · Windows · CWE-269, CWE-59

Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges.

CVE-2017-5689 Severity under analysis added on 01/28/2022

Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability

Intel · Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability

Intel products contain a vulnerability which can allow attackers to perform privilege escalation.

CVE-2014-7169 Severity under analysis added on 01/28/2022

GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

GNU · Bourne-Again Shell (Bash) · CWE-78

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code. This CVE correctly remediates the vulnerability in CVE-2014-6271.

CVE-2014-6271 Severity under analysis added on 01/28/2022

GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

GNU · Bourne-Again Shell (Bash) · CWE-78

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code.

CVE-2014-1776 Severity under analysis added on 01/28/2022

Microsoft Internet Explorer Memory Corruption Vulnerability

Microsoft · Internet Explorer · CWE-416

Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code in the context of the current user.

CVE-2021-35247 Severity under analysis added on 01/21/2022

SolarWinds Serv-U Improper Input Validation Vulnerability

SolarWinds · Serv-U · CWE-20

SolarWinds Serv-U versions 15.2.5 and earlier contain an improper input validation vulnerability that allows attackers to build and send queries without sanitization.

CVE-2018-8453 Severity under analysis Ransomware added on 01/21/2022

Microsoft Win32k Privilege Escalation Vulnerability

Microsoft · Win32k · CWE-404

Microsoft Windows Win32k contains a vulnerability that allows an attacker to escalate privileges.

CVE-2012-0391 Severity under analysis added on 01/21/2022

Apache Struts 2 Improper Input Validation Vulnerability

Apache · Struts 2 · CWE-20

The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution.

CVE-2006-1547 Severity under analysis added on 01/21/2022

Apache Struts 1 ActionForm Denial-of-Service Vulnerability

Apache · Struts 1

ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS).

CVE-2021-40870 Severity under analysis added on 01/18/2022

Aviatrix Controller Unrestricted Upload of File

Aviatrix · Aviatrix Controller · CWE-25, CWE-96

Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.

CVE-2021-33766 Severity under analysis added on 01/18/2022

Microsoft Exchange Server Information Disclosure

Microsoft · Exchange Server · CWE-287

Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target.

CVE-2021-32648 Severity under analysis added on 01/18/2022

October CMS Improper Authentication

October CMS · October CMS · CWE-287

In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request.

CVE-2021-25298 Severity under analysis added on 01/18/2022

Nagios XI OS Command Injection

Nagios · Nagios XI · CWE-78, CWE-138

Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.

CVE-2021-25297 Severity under analysis added on 01/18/2022

Nagios XI OS Command Injection

Nagios · Nagios XI · CWE-78, CWE-138

Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.

CVE-2021-25296 Severity under analysis added on 01/18/2022

Nagios XI OS Command Injection

Nagios · Nagios XI · CWE-78, CWE-138

Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.

CVE-2021-22991 Severity under analysis added on 01/18/2022

F5 BIG-IP Traffic Management Microkernel Buffer Overflow

F5 · BIG-IP Traffic Management Microkernel · CWE-119

The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls.

CVE-2021-21975 Severity under analysis Ransomware added on 01/18/2022

VMware Server Side Request Forgery in vRealize Operations Manager API

VMware · vRealize Operations Manager API · CWE-918

Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.

CVE-2021-21315 Severity under analysis added on 01/18/2022

System Information Library for Node.JS Command Injection

Npm package · System Information Library for Node.JS · CWE-78

In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote.

CVE-2020-14864 Severity under analysis added on 01/18/2022

Oracle Business Intelligence Enterprise Edition Path Transversal

Oracle · Intelligence Enterprise Edition · CWE-22

Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file.

CVE-2020-13927 Severity under analysis added on 01/18/2022

Apache Airflow's Experimental API Authentication Bypass

Apache · Airflow's Experimental API · CWE-1188, CWE-306

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.