Security Radar

CVE-2021-1675 Severity under analysis Ransomware added on 11/03/2021

Microsoft Windows Print Spooler Remote Code Execution Vulnerability

Microsoft · Windows · CWE-285

Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution.

CVE-2021-1647 Severity under analysis added on 11/03/2021

Microsoft Defender Remote Code Execution Vulnerability

Microsoft · Defender · CWE-122, CWE-1285

Microsoft Defender contains an unspecified vulnerability that allows for remote code execution.

CVE-2021-1498 Severity under analysis added on 11/03/2021

Cisco HyperFlex HX Data Platform Command Injection Vulnerability

Cisco · HyperFlex HX · CWE-78

Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the tomcat8 user.

CVE-2021-1497 Severity under analysis added on 11/03/2021

Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability

Cisco · HyperFlex HX · CWE-78

Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the root user.

CVE-2020-9859 Severity under analysis added on 11/03/2021

Apple Multiple Products Code Execution Vulnerability

Apple · Multiple Products · CWE-415

Apple iOS, iPadOS, macOS, watchOS, and tvOS contain an unspecified vulnerability that may allow an application to execute code with kernel privileges.

CVE-2020-9819 Severity under analysis added on 11/03/2021

Apple iOS, iPadOS, and watchOS Memory Corruption Vulnerability

Apple · iOS, iPadOS, and watchOS · CWE-787

Apple iOS, iPadOS, and watchOS Mail contains a memory corruption vulnerability that may allow heap corruption when processing a maliciously crafted mail message.

CVE-2020-9818 Severity under analysis added on 11/03/2021

Apple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability

Apple · iOS, iPadOS, and watchOS · CWE-787

Apple iOS, iPadOS, and watchOS Mail contains an out-of-bounds write vulnerability which may allow memory modification or application termination when processing a maliciously crafted mail message.

CVE-2020-8657 Severity under analysis added on 11/03/2021

EyesOfNetwork Use of Hard-Coded Credentials Vulnerability

EyesOfNetwork · EyesOfNetwork · CWE-798

EyesOfNetwork contains a use of hard-coded credentials vulnerability, as it uses the same API key by default. Exploitation allows an attacker to calculate or guess the admin access token.

CVE-2020-8655 Severity under analysis added on 11/03/2021

EyesOfNetwork Improper Privilege Management Vulnerability

EyesOfNetwork · EyesOfNetwork · CWE-269

EyesOfNetwork contains an improper privilege management vulnerability that may allow a user to run commands as root via a crafted Nmap Scripting Engine (NSE) script to nmap7.

CVE-2020-8644 Severity under analysis added on 11/03/2021

PlaySMS Server-Side Template Injection Vulnerability

PlaySMS · PlaySMS · CWE-94

PlaySMS contains a server-side template injection vulnerability that allows for remote code execution.

CVE-2020-8599 Severity under analysis added on 11/03/2021

Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability

Trend Micro · Apex One and OfficeScan

Trend Micro Apex One and OfficeScan server contain a vulnerable EXE file that could allow a remote attacker to write data to a path on affected installations and bypass root login.

CVE-2020-8515 Severity under analysis added on 11/03/2021

Multiple DrayTek Vigor Routers Web Management Page Vulnerability

DrayTek · Multiple Vigor Routers · CWE-78

DrayTek Vigor3900, Vigor2960, and Vigor300B routers contain an unspecified vulnerability that allows for remote code execution.

CVE-2020-8468 Severity under analysis added on 11/03/2021

Trend Micro Multiple Products Content Validation Escape Vulnerability

Trend Micro · Apex One, OfficeScan and Worry-Free Business Security Agents · CWE-74

Trend Micro Apex One, OfficeScan, and Worry-Free Business Security agents contain a content validation escape vulnerability that could allow an attacker to manipulate certain agent client components.

CVE-2020-8467 Severity under analysis added on 11/03/2021

Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability

Trend Micro · Apex One and OfficeScan

Trend Micro Apex One and OfficeScan contain an unspecified vulnerability within a migration tool component that allows for remote code execution.

CVE-2020-8260 Severity under analysis added on 11/03/2021

Ivanti Pulse Connect Secure Code Execution Vulnerability

Ivanti · Pulse Connect Secure · CWE-434

Pulse Connect Secure contains an unspecified vulnerability that allows an authenticated attacker to perform code execution using uncontrolled gzip extraction.

CVE-2020-8243 Severity under analysis added on 11/03/2021

Ivanti Pulse Connect Secure Code Execution Vulnerability

Ivanti · Pulse Connect Secure · CWE-94

Ivanti Pulse Connect Secure contains an unspecified vulnerability in the admin web interface that could allow an authenticated attacker to upload a custom template to perform code execution.

CVE-2020-8196 Severity under analysis added on 11/03/2021

Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability

Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance · CWE-284

Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.

CVE-2020-8195 Severity under analysis added on 11/03/2021

Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability

Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance · CWE-20

Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.

CVE-2020-8193 Severity under analysis added on 11/03/2021

Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability

Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance · CWE-284

Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an authorization bypass vulnerability that may allow unauthenticated access to certain URL endpoints. The attacker must have access to the NetScaler IP (NSIP) in order to perform exploitation.

CVE-2020-7961 Severity under analysis added on 11/03/2021

Liferay Portal Deserialization of Untrusted Data Vulnerability

Liferay · Liferay Portal · CWE-502

Liferay Portal contains a deserialization of untrusted data vulnerability that allows remote attackers to execute code via JSON web services.

CVE-2020-6820 Severity under analysis added on 11/03/2021

Mozilla Firefox And Thunderbird Use-After-Free Vulnerability

Mozilla · Firefox and Thunderbird · CWE-362

Mozilla Firefox and Thunderbird contain a race condition vulnerability when handling a ReadableStream under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts.

CVE-2020-6819 Severity under analysis added on 11/03/2021

Mozilla Firefox And Thunderbird Use-After-Free Vulnerability

Mozilla · Firefox and Thunderbird · CWE-362, CWE-416

Mozilla Firefox and Thunderbird contain a race condition vulnerability when running the nsDocShell destructor under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts.

CVE-2020-6418 Severity under analysis added on 11/03/2021

Google Chromium V8 Type Confusion Vulnerability

Google · Chromium V8 · CWE-843

Google Chromium V8 Engine contains a type confusion vulnerability allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

CVE-2020-6287 Severity under analysis added on 11/03/2021

SAP NetWeaver Missing Authentication for Critical Function Vulnerability

SAP · NetWeaver · CWE-306

SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users.