Security Radar

CVE-2022-41080 Severity under analysis Ransomware added on 01/10/2023

Microsoft Exchange Server Privilege Escalation Vulnerability

Microsoft · Exchange Server

Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution.

CVE-2022-44698 Severity under analysis Ransomware added on 12/13/2022

Microsoft Defender SmartScreen Security Feature Bypass Vulnerability

Microsoft · Defender · CWE-755

Microsoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.

CVE-2022-42475 Severity under analysis Ransomware added on 12/13/2022

Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability

Fortinet · FortiOS · CWE-197

Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.

CVE-2022-26501 Severity under analysis Ransomware added on 12/13/2022

Veeam Backup & Replication Remote Code Execution Vulnerability

Veeam · Backup & Replication · CWE-306

The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.

CVE-2022-26500 Severity under analysis Ransomware added on 12/13/2022

Veeam Backup & Replication Remote Code Execution Vulnerability

Veeam · Backup & Replication · CWE-22

The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.

CVE-2022-41091 Severity under analysis Ransomware added on 11/08/2022

Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability

Microsoft · Windows · CWE-863

Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.

CVE-2022-41073 Severity under analysis Ransomware added on 11/08/2022

Microsoft Windows Print Spooler Privilege Escalation Vulnerability

Microsoft · Windows · CWE-787

Microsoft Windows Print Spooler contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.

CVE-2020-3433 Severity under analysis Ransomware added on 10/24/2022

Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability

Cisco · AnyConnect Secure · CWE-427

Cisco AnyConnect Secure Mobility Client for Windows interprocess communication (IPC) channel allows for insufficient validation of resources that are loaded by the application at run time. An attacker with valid credentials on Windows could execute code on the affected machine with SYSTEM privileges.

CVE-2020-3153 Severity under analysis Ransomware added on 10/24/2022

Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability

Cisco · AnyConnect Secure · CWE-427

Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks.

CVE-2018-19323 Severity under analysis Ransomware added on 10/24/2022

GIGABYTE Multiple Products Privilege Escalation Vulnerability

GIGABYTE · Multiple Products

The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.

CVE-2018-19322 Severity under analysis Ransomware added on 10/24/2022

GIGABYTE Multiple Products Code Execution Vulnerability

GIGABYTE · Multiple Products · CWE-749

The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.

CVE-2018-19321 Severity under analysis Ransomware added on 10/24/2022

GIGABYTE Multiple Products Privilege Escalation Vulnerability

GIGABYTE · Multiple Products

The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.

CVE-2018-19320 Severity under analysis Ransomware added on 10/24/2022

GIGABYTE Multiple Products Unspecified Vulnerability

GIGABYTE · Multiple Products

The GDrv low-level driver in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.

CVE-2022-41352 Severity under analysis Ransomware added on 10/20/2022

Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability

Synacor · Zimbra Collaboration Suite (ZCS) · CWE-22

Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts.

CVE-2022-40684 Severity under analysis Ransomware added on 10/11/2022

Fortinet Multiple Products Authentication Bypass Vulnerability

Fortinet · Multiple Products · CWE-288

Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

CVE-2022-41082 Severity under analysis Ransomware added on 09/30/2022

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft · Exchange Server · CWE-502

Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution.

CVE-2022-41040 Severity under analysis Ransomware added on 09/30/2022

Microsoft Exchange Server Server-Side Request Forgery Vulnerability

Microsoft · Exchange Server · CWE-918

Microsoft Exchange Server allows for server-side request forgery. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution.

CVE-2022-37969 Severity under analysis Ransomware added on 09/14/2022

Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability

Microsoft · Windows · CWE-20, CWE-787

Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.

CVE-2022-27593 Severity under analysis Ransomware added on 09/08/2022

QNAP Photo Station Externally Controlled Reference Vulnerability

QNAP · Photo Station · CWE-610

Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign.

CVE-2018-6530 Severity under analysis Ransomware added on 09/08/2022

D-Link Multiple Routers OS Command Injection Vulnerability

D-Link · Multiple Routers · CWE-78

Multiple D-Link routers contain an unspecified vulnerability that allows for execution of OS commands.

CVE-2018-13374 Severity under analysis Ransomware added on 09/08/2022

Fortinet FortiOS and FortiADC Improper Access Control Vulnerability

Fortinet · FortiOS and FortiADC · CWE-732

Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server.

CVE-2022-26352 Severity under analysis Ransomware added on 08/25/2022

dotCMS Unrestricted Upload of File Vulnerability

dotCMS · dotCMS · CWE-22, CWE-138

dotCMS ContentResource API contains an unrestricted upload of file with a dangerous type vulnerability that allows for directory traversal, in which the file is saved outside of the intended storage location. Exploitation allows for remote code execution.

CVE-2022-2294 Severity under analysis Ransomware added on 08/25/2022

WebRTC Heap Buffer Overflow Vulnerability

WebRTC · WebRTC · CWE-122

WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows an attacker to perform shellcode execution. This vulnerability impacts web browsers using WebRTC including but not limited to Google Chrome.

CVE-2022-37042 Severity under analysis Ransomware added on 08/11/2022

Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability

Synacor · Zimbra Collaboration Suite (ZCS) · CWE-23

Synacor Zimbra Collaboration Suite (ZCS) contains an authentication bypass vulnerability in MailboxImportServlet. This vulnerability was chained with CVE-2022-27925 which allows for unauthenticated remote code execution.