Security Radar

CVE-2020-17463 Severity under analysis added on 12/10/2021

Fuel CMS SQL Injection Vulnerability

Fuel CMS · Fuel CMS · CWE-89

FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.

CVE-2019-7238 Severity under analysis added on 12/10/2021

Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability

Sonatype · Nexus Repository Manager

Sonatype Nexus Repository Manager before 3.15.0 has an incorrect access control vulnerability. Exploitation allows for remote code execution.

CVE-2019-13272 Severity under analysis added on 12/10/2021

Linux Kernel Improper Privilege Management Vulnerability

Linux · Kernel · CWE-269

Kernel/ptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access.

CVE-2019-10758 Severity under analysis added on 12/10/2021

MongoDB mongo-express Remote Code Execution Vulnerability

MongoDB · mongo-express

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method.

CVE-2019-0193 Severity under analysis added on 12/10/2021

Apache Solr DataImportHandler Code Injection Vulnerability

Apache · Solr · CWE-94

The optional Apache Solr module DataImportHandler contains a code injection vulnerability.

CVE-2017-17562 Severity under analysis added on 12/10/2021

Embedthis GoAhead Remote Code Execution Vulnerability

Embedthis · GoAhead · CWE-20

Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.

CVE-2017-12149 Severity under analysis Ransomware added on 12/10/2021

Red Hat JBoss Application Server Remote Code Execution Vulnerability

Red Hat · JBoss Application Server · CWE-502

The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data.

CVE-2010-1871 Severity under analysis added on 12/10/2021

Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability

Red Hat · JBoss Seam 2 · CWE-20

JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote code execution. This vulnerability can only be exploited when the Java Security Manager is not properly configured.

CVE-2021-44077 Severity under analysis added on 12/01/2021

Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability

Zoho · ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus · CWE-306

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution

CVE-2021-40438 Severity under analysis Ransomware added on 12/01/2021

Apache HTTP Server-Side Request Forgery (SSRF)

Apache · Apache · CWE-918

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

CVE-2021-37415 Severity under analysis added on 12/01/2021

Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability

Zoho · ManageEngine ServiceDesk Plus (SDP) · CWE-306

Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication

CVE-2020-11261 Severity under analysis added on 12/01/2021

Qualcomm Multiple Chipsets Improper Input Validation Vulnerability

Qualcomm · Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, S · CWE-20

Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

CVE-2018-14847 Severity under analysis added on 12/01/2021

MikroTik Router OS Directory Traversal Vulnerability

MikroTik · RouterOS · CWE-22

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.

CVE-2021-42321 Severity under analysis Ransomware added on 11/17/2021

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft · Exchange · CWE-184, CWE-502

An authenticated attacker could leverage improper validation in cmdlet arguments within Microsoft Exchange and perform remote code execution.

CVE-2021-42292 Severity under analysis added on 11/17/2021

Microsoft Excel Security Feature Bypass

Microsoft · Office · CWE-357

A security feature bypass vulnerability in Microsoft Excel would allow a local user to perform arbitrary code execution.

CVE-2021-40449 Severity under analysis Ransomware added on 11/17/2021

Microsoft Windows Win32k Privilege Escalation Vulnerability

Microsoft · Windows · CWE-416

Unspecified vulnerability allows for an authenticated user to escalate privileges.

CVE-2021-22204 Severity under analysis added on 11/17/2021

ExifTool Remote Code Execution Vulnerability

Perl · Exiftool · CWE-95

Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

CVE-2021-42258 Severity under analysis Ransomware added on 11/03/2021

BQE BillQuick Web Suite SQL Injection Vulnerability

BQE · BillQuick Web Suite · CWE-89

BQE BillQuick Web Suite contains an SQL injection vulnerability when accessing the username parameter that may allow for unauthenticated, remote code execution.

CVE-2021-42013 Severity under analysis Ransomware added on 11/03/2021

Apache HTTP Server Path Traversal Vulnerability

Apache · HTTP Server · CWE-22

Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts are enabled. This CVE ID resolves an incomplete patch for CVE-2021-41773.

CVE-2021-41773 Severity under analysis Ransomware added on 11/03/2021

Apache HTTP Server Path Traversal Vulnerability

Apache · HTTP Server · CWE-22

Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default �require all denied� or if CGI scripts are enabled. The original patch issued under this CVE ID is insufficient, please review remediation information under CVE-2021-42013.

CVE-2021-40539 Severity under analysis Ransomware added on 11/03/2021

Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability

Zoho · ManageEngine · CWE-55

Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution.

CVE-2021-40444 Severity under analysis Ransomware added on 11/03/2021

Microsoft MSHTML Remote Code Execution Vulnerability

Microsoft · MSHTML · CWE-22

Microsoft MSHTML contains a unspecified vulnerability that allows for remote code execution.

CVE-2021-38649 Severity under analysis added on 11/03/2021

Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability

Microsoft · Open Management Infrastructure (OMI)

Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.

CVE-2021-38648 Severity under analysis added on 11/03/2021

Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability

Microsoft · Open Management Infrastructure (OMI) · CWE-1390

Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.