Radar de Seguridad

CVE-2022-37969 Severidad en análisis Ransomware en el catálogo el 14/09/2022

Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability

Microsoft · Windows · CWE-20, CWE-787

Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. EN

CVE-2022-3075 Severidad en análisis en el catálogo el 08/09/2022

Google Chromium Mojo Insufficient Data Validation Vulnerability

Google · Chromium Mojo · CWE-20

Google Chromium Mojo contains an insufficient data validation vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. EN

CVE-2018-2628 Severidad en análisis en el catálogo el 08/09/2022

Oracle WebLogic Server Unspecified Vulnerability

Oracle · WebLogic Server · CWE-502

Oracle WebLogic Server contains an unspecified vulnerability which can allow an unauthenticated attacker with T3 network access to compromise the server. EN

CVE-2018-13374 Severidad en análisis Ransomware en el catálogo el 08/09/2022

Fortinet FortiOS and FortiADC Improper Access Control Vulnerability

Fortinet · FortiOS and FortiADC · CWE-732

Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server. EN

CVE-2022-24706 Severidad en análisis en el catálogo el 25/08/2022

Apache CouchDB Insecure Default Initialization of Resource Vulnerability

Apache · CouchDB · CWE-1188

Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow an attacker to escalate to administrative privileges. EN

CVE-2022-24112 Severidad en análisis en el catálogo el 25/08/2022

Apache APISIX Authentication Bypass Vulnerability

Apache · APISIX · CWE-290

Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution. EN

CVE-2022-0028 Severidad en análisis en el catálogo el 22/08/2022

Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability

Palo Alto Networks · PAN-OS · CWE-940

A Palo Alto Networks PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. EN

CVE-2022-2856 Severidad en análisis en el catálogo el 18/08/2022

Google Chromium Intents Insufficient Input Validation Vulnerability

Google · Chromium Intents · CWE-20

Google Chromium Intents contains an insufficient validation of untrusted input vulnerability that allows a remote attacker to browse to a malicious website via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. EN

CVE-2022-26923 Severidad en análisis en el catálogo el 18/08/2022

Microsoft Active Directory Domain Services Privilege Escalation Vulnerability

Microsoft · Active Directory · CWE-295

An authenticated user could manipulate attributes on computer accounts they own or manage, and acquire a certificate from Active Directory Certificate Services that would allow for privilege escalation to SYSTEM. EN

CVE-2022-22536 Severidad en análisis en el catálogo el 18/08/2022

SAP Multiple Products HTTP Request Smuggling Vulnerability

SAP · Multiple Products · CWE-444

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches. EN

CVE-2022-21971 Severidad en análisis en el catálogo el 18/08/2022

Microsoft Windows Runtime Remote Code Execution Vulnerability

Microsoft · Windows · CWE-824

Microsoft Windows Runtime contains an unspecified vulnerability that allows for remote code execution. EN

CVE-2017-15944 Severidad en análisis en el catálogo el 18/08/2022

Palo Alto Networks PAN-OS Remote Code Execution Vulnerability

Palo Alto Networks · PAN-OS

Palo Alto Networks PAN-OS contains multiple, unspecified vulnerabilities which can allow for remote code execution when chained. EN

CVE-2022-34713 Severidad en análisis en el catálogo el 09/08/2022

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

Microsoft · Windows

A remote code execution vulnerability exists when Microsoft Windows MSDT is called using the URL protocol from a calling application. EN

CVE-2022-26138 Severidad en análisis en el catálogo el 29/07/2022

Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability

Atlassian · Confluence · CWE-798

Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group. EN

CVE-2022-22047 Severidad en análisis en el catálogo el 12/07/2022

Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability

Microsoft · Windows · CWE-426

Microsoft Windows CSRSS contains an unspecified vulnerability that allows for privilege escalation to SYSTEM privileges. EN

CVE-2022-26925 Severidad en análisis en el catálogo el 01/07/2022

Microsoft Windows LSA Spoofing Vulnerability

Microsoft · Windows · CWE-306

Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM. EN

CVE-2021-30533 Severidad en análisis en el catálogo el 27/06/2022

Google Chromium PopupBlocker Security Bypass Vulnerability

Google · Chromium PopupBlocker · CWE-863

Google Chromium PopupBlocker contains an insufficient policy enforcement vulnerability that allows a remote attacker to bypass navigation restrictions via a crafted iframe. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. EN

CVE-2022-30190 Severidad en análisis Ransomware en el catálogo el 14/06/2022

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

Microsoft · Windows · CWE-610

A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application. EN

CVE-2021-38163 Severidad en análisis en el catálogo el 09/06/2022

SAP NetWeaver Unrestricted File Upload Vulnerability

SAP · NetWeaver · CWE-23

SAP NetWeaver contains a vulnerability that allows unrestricted file upload. EN

CVE-2016-2388 Severidad en análisis en el catálogo el 09/06/2022

SAP NetWeaver Information Disclosure Vulnerability

SAP · NetWeaver · CWE-200

The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request. EN

CVE-2016-2386 Severidad en análisis en el catálogo el 09/06/2022

SAP NetWeaver SQL Injection Vulnerability

SAP · NetWeaver · CWE-89

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. EN

CVE-2019-5825 Severidad en análisis en el catálogo el 08/06/2022

Google Chromium V8 Out-of-Bounds Write Vulnerability

Google · Chromium V8 · CWE-787

Google Chromium V8 Engine contains an out-of-bounds write vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. EN

CVE-2019-15271 Severidad en análisis en el catálogo el 08/06/2022

Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability

Cisco · RV Series Routers · CWE-502

A deserialization of untrusted data vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an attacker to execute code with root privileges. EN

CVE-2018-6065 Severidad en análisis en el catálogo el 08/06/2022

Google Chromium V8 Integer Overflow Vulnerability

Google · Chromium V8 · CWE-190, CWE-787

Google Chromium V8 Engine contains an integer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. EN