Radar de Seguridad

CVE-2020-2555 Severidad en análisis en el catálogo el 03/11/2021

Oracle Multiple Products Remote Code Execution Vulnerability

Oracle · Multiple Products · CWE-502

Multiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with network access via T3 or HTTP to takeover the affected system. Impacted Oracle products: Oracle Coherence in Fusion Middleware, Oracle Utilities Framework, Oracle Retail Assortment Planning, Oracle Commerce, Oracle Communications Diameter Signaling Router (DSR). EN

CVE-2020-25506 Severidad en análisis en el catálogo el 03/11/2021

D-Link DNS-320 Device Command Injection Vulnerability

D-Link · DNS-320 Device · CWE-78

D-Link DNS-320 device contains a command injection vulnerability in the sytem_mgr.cgi component that may allow for remote code execution. EN

CVE-2020-25213 Severidad en análisis en el catálogo el 03/11/2021

WordPress File Manager Plugin Remote Code Execution Vulnerability

WordPress · File Manager Plugin · CWE-434

WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site. EN

CVE-2020-24557 Severidad en análisis en el catálogo el 03/11/2021

Trend Micro Multiple Products Improper Access Control Vulnerability

Trend Micro · Apex One, OfficeScan, and Worry-Free Business Security

Trend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows contain an improper access control vulnerability that may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function, and attain privilege escalation. EN

CVE-2020-17530 Severidad en análisis en el catálogo el 03/11/2021

Apache Struts Remote Code Execution Vulnerability

Apache · Struts · CWE-917

Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead to remote code execution. EN

CVE-2020-17496 Severidad en análisis en el catálogo el 03/11/2021

vBulletin PHP Module Remote Code Execution Vulnerability

vBulletin · vBulletin · CWE-74

The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. This CVE ID resolves an incomplete patch for CVE-2019-16759. EN

CVE-2020-17144 Severidad en análisis en el catálogo el 03/11/2021

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft · Exchange Server · CWE-502

Microsoft Exchange Server improperly validates cmdlet arguments which allow an attacker to perform remote code execution. EN

CVE-2020-17087 Severidad en análisis en el catálogo el 03/11/2021

Microsoft Windows Kernel Privilege Escalation Vulnerability

Microsoft · Windows · CWE-131

Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation. EN

CVE-2020-16846 Severidad en análisis en el catálogo el 03/11/2021

SaltStack Salt Shell Injection Vulnerability

SaltStack · Salt · CWE-78

SaltStack Salt allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt API using the SSH client. This vulnerability affects any users running the Salt API. EN

CVE-2020-16017 Severidad en análisis en el catálogo el 03/11/2021

Google Chrome Use-After-Free Vulnerability

Google · Chrome · CWE-416

Google Chrome contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. EN

CVE-2020-16013 Severidad en análisis en el catálogo el 03/11/2021

Google Chromium V8 Incorrect Implementation Vulnerabililty

Google · Chromium V8 · CWE-787

Google Chromium V8 Engine contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. EN

CVE-2020-16010 Severidad en análisis en el catálogo el 03/11/2021

Google Chrome for Android UI Heap Buffer Overflow Vulnerability

Google · Chrome for Android UI · CWE-787

Google Chrome for Android UI contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. EN

CVE-2020-16009 Severidad en análisis en el catálogo el 03/11/2021

Google Chromium V8 Type Confusion Vulnerability

Google · Chromium V8 · CWE-787, CWE-843

Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. EN

CVE-2020-15999 Severidad en análisis en el catálogo el 03/11/2021

Google Chrome FreeType Heap Buffer Overflow Vulnerability

Google · Chrome FreeType · CWE-787

Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function Load_SBit_Png when processing PNG images embedded into fonts. This vulnerability is part of an exploit chain with CVE-2020-17087 on Windows and CVE-2020-16010 on Android. EN

CVE-2020-15505 Severidad en análisis en el catálogo el 03/11/2021

Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability

Ivanti · MobileIron Multiple Products · CWE-706

Ivanti MobileIron's Core & Connector, Sentry, and Monitor and Reporting Database (RDB) products contain an unspecified vulnerability that allows for remote code execution. EN

CVE-2020-14883 Severidad en análisis en el catálogo el 03/11/2021

Oracle WebLogic Server Unspecified Vulnerability

Oracle · WebLogic Server

Oracle WebLogic Server contains an unspecified vulnerability in the Console component with high impacts to confidentilaity, integrity, and availability. EN

CVE-2020-14882 Severidad en análisis en el catálogo el 03/11/2021

Oracle WebLogic Server Remote Code Execution Vulnerability

Oracle · WebLogic Server

Oracle WebLogic Server contains an unspecified vulnerability, which is assessed to allow for remote code execution, based on this vulnerability being related to CVE-2020-14750. EN

CVE-2020-14871 Severidad en análisis en el catálogo el 03/11/2021

Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability

Oracle · Solaris and Zettabyte File System (ZFS) · CWE-787

Oracle Solaris and Oracle ZFS Storage Appliance Kit contain an unspecified vulnerability causing high impacts to confidentiality, integrity, and availability of affected systems. EN

CVE-2020-14750 Severidad en análisis en el catálogo el 03/11/2021

Oracle WebLogic Server Remote Code Execution Vulnerability

Oracle · WebLogic Server

Oracle WebLogic Server contains an unspecified vulnerability allowing an unauthenticated attacker to perform remote code execution. This vulnerability is related to CVE-2020-14882. EN

CVE-2020-1472 Severidad en análisis Ransomware en el catálogo el 03/11/2021

Microsoft Netlogon Privilege Escalation Vulnerability

Microsoft · Netlogon · CWE-330

Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller. An attacker who successfully exploits the vulnerability could run a specially crafted application on a device on the network. The vulnerability is also known under the moniker of Zerologon. EN

CVE-2020-1464 Severidad en análisis en el catálogo el 03/11/2021

Microsoft Windows Spoofing Vulnerability

Microsoft · Windows · CWE-347

Microsoft Windows contains a spoofing vulnerability when Windows incorrectly validates file signatures, allowing an attacker to bypass security features and load improperly signed files. EN

CVE-2020-1380 Severidad en análisis en el catálogo el 03/11/2021

Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability

Microsoft · Internet Explorer · CWE-787

Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user. EN

CVE-2020-1350 Severidad en análisis en el catálogo el 03/11/2021

Microsoft Windows DNS Server Remote Code Execution Vulnerability

Microsoft · Windows

Microsoft Windows DNS Servers fail to properly handle requests, allowing an attacker to perform remote code execution in the context of the Local System Account. The vulnerability is also known under the moniker of SIGRed. EN

CVE-2020-12812 Severidad en análisis Ransomware en el catálogo el 03/11/2021

Fortinet FortiOS SSL VPN Improper Authentication Vulnerability

Fortinet · FortiOS · CWE-178, CWE-287

Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username. EN