Radar de Seguridad

CVE-2021-3156 Severidad en análisis en el catálogo el 06/04/2022

Sudo Heap-Based Buffer Overflow Vulnerability

Sudo · Sudo · CWE-122, CWE-193

Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation. EN

CVE-2021-31166 Severidad en análisis en el catálogo el 06/04/2022

Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability

Microsoft · HTTP Protocol Stack · CWE-416

Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution. EN

CVE-2017-0148 Severidad en análisis Ransomware en el catálogo el 06/04/2022

Microsoft SMBv1 Server Remote Code Execution Vulnerability

Microsoft · SMBv1 server · CWE-20

The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets. EN

CVE-2022-22965 Severidad en análisis en el catálogo el 04/04/2022

Spring Framework JDK 9+ Remote Code Execution Vulnerability

VMware · Spring Framework · CWE-94

Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. EN

CVE-2022-22675 Severidad en análisis en el catálogo el 04/04/2022

Apple macOS Out-of-Bounds Write Vulnerability

Apple · macOS · CWE-20, CWE-125

macOS Monterey contains an out-of-bounds write vulnerability that could allow an application to execute arbitrary code with kernel privileges. EN

CVE-2022-22674 Severidad en análisis en el catálogo el 04/04/2022

Apple macOS Out-of-Bounds Read Vulnerability

Apple · macOS · CWE-20, CWE-125

macOS Monterey contains an out-of-bounds read vulnerability that could allow an application to read kernel memory. EN

CVE-2021-45382 Severidad en análisis en el catálogo el 04/04/2022

D-Link Multiple Routers Remote Code Execution Vulnerability

D-Link · Multiple Routers · CWE-78

A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file. EN

CVE-2022-26871 Severidad en análisis en el catálogo el 31/03/2022

Trend Micro Apex Central Arbitrary File Upload Vulnerability

Trend Micro · Apex Central · CWE-184

An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution. EN

CVE-2022-1040 Severidad en análisis en el catálogo el 31/03/2022

Sophos Firewall Authentication Bypass Vulnerability

Sophos · Firewall · CWE-158

An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution. EN

CVE-2021-34484 Severidad en análisis en el catálogo el 31/03/2022

Microsoft Windows User Profile Service Privilege Escalation Vulnerability

Microsoft · Windows · CWE-269

Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation. EN

CVE-2021-28799 Severidad en análisis Ransomware en el catálogo el 31/03/2022

QNAP NAS Improper Authorization Vulnerability

QNAP · Network Attached Storage (NAS) · CWE-285

QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device. EN

CVE-2021-21551 Severidad en análisis en el catálogo el 31/03/2022

Dell dbutil Driver Insufficient Access Control Vulnerability

Dell · dbutil Driver · CWE-782

Dell dbutil driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial-of-service (DoS), or information disclosure. EN

CVE-2018-10562 Severidad en análisis Ransomware en el catálogo el 31/03/2022

Dasan GPON Routers Command Injection Vulnerability

Dasan · Gigabit Passive Optical Network (GPON) Routers · CWE-78

Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561, exploitation can allow an attacker to perform remote code execution. EN

CVE-2018-10561 Severidad en análisis en el catálogo el 31/03/2022

Dasan GPON Routers Authentication Bypass Vulnerability

Dasan · Gigabit Passive Optical Network (GPON) Routers · CWE-287

Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10562, exploitation can allow an attacker to perform remote code execution. EN

CVE-2022-1096 Severidad en análisis en el catálogo el 28/03/2022

Google Chromium V8 Type Confusion Vulnerability

Google · Chromium V8 · CWE-843

Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. EN

CVE-2022-0543 Severidad en análisis en el catálogo el 28/03/2022

Debian-specific Redis Server Lua Sandbox Escape Vulnerability

Redis · Debian-specific Redis Servers · CWE-862

Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution. EN

CVE-2021-38646 Severidad en análisis Ransomware en el catálogo el 28/03/2022

Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability

Microsoft · Office

Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution. EN

CVE-2021-34486 Severidad en análisis en el catálogo el 28/03/2022

Microsoft Windows Event Tracing Privilege Escalation Vulnerability

Microsoft · Windows · CWE-416

Microsoft Windows Event Tracing contains an unspecified vulnerability which can allow for privilege escalation. EN

CVE-2021-26085 Severidad en análisis Ransomware en el catálogo el 28/03/2022

Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability

Atlassian · Confluence Server · CWE-425

Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint. EN

CVE-2021-20028 Severidad en análisis Ransomware en el catálogo el 28/03/2022

SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability

SonicWall · Secure Remote Access (SRA) · CWE-89

SonicWall Secure Remote Access (SRA) products contain an improper neutralization of a SQL Command leading to SQL injection. EN

CVE-2019-7483 Severidad en análisis en el catálogo el 28/03/2022

SonicWall SMA100 Directory Traversal Vulnerability

SonicWall · SMA100 · CWE-22

In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server. EN

CVE-2018-8440 Severidad en análisis Ransomware en el catálogo el 28/03/2022

Microsoft Windows Privilege Escalation Vulnerability

Microsoft · Windows

An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC). EN

CVE-2018-8406 Severidad en análisis Ransomware en el catálogo el 28/03/2022

Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability

Microsoft · DirectX Graphics Kernel (DXGKRNL) · CWE-404

An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory. EN

CVE-2018-8405 Severidad en análisis Ransomware en el catálogo el 28/03/2022

Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability

Microsoft · DirectX Graphics Kernel (DXGKRNL) · CWE-404

An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory. EN