Security Radar

CVE-2020-13671 Severity under analysis added on 01/18/2022

Drupal core Un-restricted Upload of File

Drupal · Drupal core · CWE-434

Improper sanitization in the extension file names is present in Drupal core.

CVE-2020-11978 Severity under analysis added on 01/18/2022

Apache Airflow Command Injection

Apache · Airflow · CWE-78

A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.

CVE-2021-36260 Severity under analysis added on 01/10/2022

Hikvision Improper Input Validation

Hikvision · Security cameras web server · CWE-78

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation.

CVE-2021-27860 Severity under analysis added on 01/10/2022

FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit

FatPipe · WARP, IPVPN, and MPVPN software · CWE-434

A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem.

CVE-2021-22017 Severity under analysis added on 01/10/2022

VMware vCenter Server Improper Access Control

VMware · vCenter Server · CWE-23

Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.

CVE-2020-6572 Severity under analysis added on 01/10/2022

Google Chrome Media Use-After-Free Vulnerability

Google · Chrome Media · CWE-416

Google Chrome Media contains a use-after-free vulnerability that allows a remote attacker to execute code via a crafted HTML page.

CVE-2019-9670 Severity under analysis added on 01/10/2022

Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference

Synacor · Zimbra Collaboration Suite (ZCS) · CWE-611

Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component.

CVE-2019-7609 Severity under analysis added on 01/10/2022

Kibana Arbitrary Code Execution

Elastic · Kibana · CWE-94

Kibana contain an arbitrary code execution flaw in the Timelion visualizer.

CVE-2019-2725 Severity under analysis Ransomware added on 01/10/2022

Oracle WebLogic Server, Injection

Oracle · WebLogic Server · CWE-74

Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).

CVE-2019-1579 Severity under analysis Ransomware added on 01/10/2022

Palo Alto Networks PAN-OS Remote Code Execution Vulnerability

Palo Alto Networks · PAN-OS · CWE-134

Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.

CVE-2019-1458 Severity under analysis Ransomware added on 01/10/2022

Microsoft Win32k Privilege Escalation Vulnerability

Microsoft · Win32k

A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP.

CVE-2019-10149 Severity under analysis added on 01/10/2022

Exim Mail Transfer Agent (MTA) Improper Input Validation

Exim · Mail Transfer Agent (MTA) · CWE-78

Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.

CVE-2018-13383 Severity under analysis Ransomware added on 01/10/2022

Fortinet FortiOS and FortiProxy Out-of-bounds Write

Fortinet · FortiOS and FortiProxy · CWE-787

A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.

CVE-2018-13382 Severity under analysis Ransomware added on 01/10/2022

Fortinet FortiOS and FortiProxy Improper Authorization

Fortinet · FortiOS and FortiProxy · CWE-285

An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.

CVE-2017-1000486 Severity under analysis added on 01/10/2022

Primetek Primefaces Remote Code Execution Vulnerability

Primetek · Primefaces Application · CWE-326

Primetek Primefaces is vulnerable to a weak encryption flaw resulting in remote code execution

CVE-2015-7450 Severity under analysis added on 01/10/2022

IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.

IBM · WebSphere Application Server and Server Hypervisor Edition · CWE-94

Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands

CVE-2013-3900 Severity under analysis added on 01/10/2022

Microsoft WinVerifyTrust function Remote Code Execution

Microsoft · WinVerifyTrust function · CWE-20

A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files.

CVE-2021-43890 Severity under analysis Ransomware added on 12/15/2021

Microsoft Windows AppX Installer Spoofing Vulnerability

Microsoft · Windows

Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability.

CVE-2021-4102 Severity under analysis added on 12/15/2021

Google Chromium V8 Use-After-Free Vulnerability

Google · Chromium V8 · CWE-416

Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

CVE-2021-44515 Severity under analysis added on 12/10/2021

Zoho Desktop Central Authentication Bypass Vulnerability

Zoho · Desktop Central

Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.

CVE-2021-44228 Severity under analysis Ransomware added on 12/10/2021

Apache Log4j2 Remote Code Execution Vulnerability

Apache · Log4j2 · CWE-20, CWE-400, CWE-502

Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.

CVE-2021-44168 Severity under analysis added on 12/10/2021

Fortinet FortiOS Arbitrary File Download

Fortinet · FortiOS · CWE-494

Fortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files.

CVE-2021-35394 Severity under analysis added on 12/10/2021

Realtek Jungle SDK Remote Code Execution Vulnerability

Realtek · Jungle Software Development Kit (SDK) · CWE-78, CWE-138

RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution.

CVE-2020-8816 Severity under analysis added on 12/10/2021

Pi-Hole AdminLTE Remote Code Execution Vulnerability

Pi-hole · AdminLTE · CWE-78

Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.