Radar de Seguridad

CVE-2021-38647 Severidad en análisis Ransomware en el catálogo el 03/11/2021

Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

Microsoft · Open Management Infrastructure (OMI) · CWE-1390

Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing remote code execution. EN

CVE-2021-38645 Severidad en análisis en el catálogo el 03/11/2021

Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability

Microsoft · Open Management Infrastructure (OMI)

Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability that allows for privilege escalation. EN

CVE-2021-38003 Severidad en análisis en el catálogo el 03/11/2021

Google Chromium V8 Memory Corruption Vulnerability

Google · Chromium V8 · CWE-122, CWE-755

Google Chromium V8 Engine has a bug in JSON.stringify, where the internal TheHole value can leak to script code, causing memory corruption. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. EN

CVE-2021-38000 Severidad en análisis en el catálogo el 03/11/2021

Google Chromium Intents Improper Input Validation Vulnerability

Google · Chromium Intents · CWE-20

Google Chromium Intents contains an improper input validation vulnerability that allows a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. EN

CVE-2021-37976 Severidad en análisis en el catálogo el 03/11/2021

Google Chromium Information Disclosure Vulnerability

Google · Chromium · CWE-862

Google Chromium contains an information disclosure vulnerability within the core memory component that allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. EN

CVE-2021-37975 Severidad en análisis en el catálogo el 03/11/2021

Google Chromium V8 Use-After-Free Vulnerability

Google · Chromium V8 · CWE-416

Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. EN

CVE-2021-37973 Severidad en análisis en el catálogo el 03/11/2021

Google Chromium Portals Use-After-Free Vulnerability

Google · Chromium Portals · CWE-416

Google Chromium Portals contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects web browsers that utilize Chromium, including Google Chrome and Microsoft Edge. EN

CVE-2021-36955 Severidad en análisis Ransomware en el catálogo el 03/11/2021

Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability

Microsoft · Windows

Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. EN

CVE-2021-36948 Severidad en análisis en el catálogo el 03/11/2021

Microsoft Windows Update Medic Service Privilege Escalation Vulnerability

Microsoft · Windows

Microsoft Windows Update Medic Service contains an unspecified vulnerability that allows for privilege escalation. EN

CVE-2021-36942 Severidad en análisis Ransomware en el catálogo el 03/11/2021

Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability

Microsoft · Windows · CWE-749

Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM. EN

CVE-2021-36742 Severidad en análisis en el catálogo el 03/11/2021

Trend Micro Multiple Products Improper Input Validation Vulnerability

Trend Micro · Apex One, Apex One as a Service, and Worry-Free Business Security · CWE-20

Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows for privilege escalation. EN

CVE-2021-36741 Severidad en análisis en el catálogo el 03/11/2021

Trend Micro Multiple Products Improper Input Validation Vulnerability

Trend Micro · Apex One, Apex One as a Service, and Worry-Free Business Security · CWE-22

Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows a remote attacker to upload files. EN

CVE-2021-35464 Severidad en análisis Ransomware en el catálogo el 03/11/2021

ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability

ForgeRock · Access Management (AM) · CWE-502

ForgeRock Access Management (AM) Core Server allows an attacker who sends a specially crafted HTTP request to one of three endpoints (/ccversion/Version, /ccversion/Masthead, or /ccversion/ButtonFrame) to execute code in the context of the current user (unless ForgeRock AM is running as root user, which the vendor does not recommend). EN

CVE-2021-35395 Severidad en análisis en el catálogo el 03/11/2021

Realtek AP-Router SDK Buffer Overflow Vulnerability

Realtek · AP-Router SDK · CWE-20, CWE-122

Realtek AP-Router SDK HTTP web server boa contains a buffer overflow vulnerability due to unsafe copies of some overly long parameters submitted in the form that lead to denial-of-service (DoS). EN

CVE-2021-35211 Severidad en análisis Ransomware en el catálogo el 03/11/2021

SolarWinds Serv-U Remote Code Execution Vulnerability

SolarWinds · Serv-U · CWE-787

SolarWinds Serv-U contains an unspecified memory escape vulnerability which can allow for remote code execution. EN

CVE-2021-34527 Severidad en análisis Ransomware en el catálogo el 03/11/2021

Microsoft Windows Print Spooler Remote Code Execution Vulnerability

Microsoft · Windows · CWE-269

Microsoft Windows Print Spooler contains an unspecified vulnerability due to the Windows Print Spooler service improperly performing privileged file operations. Successful exploitation allows an attacker to perform remote code execution with SYSTEM privileges. The vulnerability is also known under the moniker of PrintNightmare. EN

CVE-2021-34523 Severidad en análisis Ransomware en el catálogo el 03/11/2021

Microsoft Exchange Server Privilege Escalation Vulnerability

Microsoft · Exchange Server · CWE-287

Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. EN

CVE-2021-34473 Severidad en análisis Ransomware en el catálogo el 03/11/2021

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft · Exchange Server · CWE-918

Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. EN

CVE-2021-34448 Severidad en análisis en el catálogo el 03/11/2021

Microsoft Windows Scripting Engine Memory Corruption Vulnerability

Microsoft · Windows · CWE-787

Microsoft Windows Scripting Engine contains an unspecified vulnerability that allows for memory corruption. EN

CVE-2021-33771 Severidad en análisis en el catálogo el 03/11/2021

Microsoft Windows Kernel Privilege Escalation Vulnerability

Microsoft · Windows · CWE-119

Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation. EN

CVE-2021-33742 Severidad en análisis en el catálogo el 03/11/2021

Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability

Microsoft · Windows · CWE-787, CWE-823

Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for remote code execution. EN

CVE-2021-33739 Severidad en análisis en el catálogo el 03/11/2021

Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability

Microsoft · Windows

Microsoft Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation. EN

CVE-2021-31979 Severidad en análisis en el catálogo el 03/11/2021

Microsoft Windows Kernel Privilege Escalation Vulnerability

Microsoft · Windows · CWE-119

Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation. EN

CVE-2021-31956 Severidad en análisis en el catálogo el 03/11/2021

Microsoft Windows NTFS Privilege Escalation Vulnerability

Microsoft · Windows · CWE-191, CWE-787

Microsoft Windows New Technology File System (NTFS) contains an unspecified vulnerability that allows attackers to escalate privileges via a specially crafted application. EN