Radar de Seguridad

CVE-2018-2380 Severidad en análisis Ransomware en el catálogo el 03/11/2021

SAP Customer Relationship Management (CRM) Path Traversal Vulnerability

SAP · Customer Relationship Management (CRM) · CWE-22

SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users. EN

CVE-2018-20062 Severidad en análisis en el catálogo el 03/11/2021

ThinkPHP "noneCms" Remote Code Execution Vulnerability

ThinkPHP · noneCms · CWE-20

ThinkPHP "noneCms" contains an unspecified vulnerability that allows for remote code execution through crafted use of the filter parameter. EN

CVE-2018-18325 Severidad en análisis en el catálogo el 03/11/2021

DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability

DotNetNuke (DNN) · DotNetNuke (DNN) · CWE-326

DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters. This CVE ID resolves an incomplete patch for CVE-2018-15811. EN

CVE-2018-15961 Severidad en análisis en el catálogo el 03/11/2021

Adobe ColdFusion Unrestricted File Upload Vulnerability

Adobe · ColdFusion · CWE-434

Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution. EN

CVE-2018-15811 Severidad en análisis en el catálogo el 03/11/2021

DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability

DotNetNuke (DNN) · DotNetNuke (DNN) · CWE-326

DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters. EN

CVE-2018-14558 Severidad en análisis en el catálogo el 03/11/2021

Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability

Tenda · AC7, AC9, and AC10 Routers · CWE-78

Tenda AC7, AC9, and AC10 devices contain a command injection vulnerability due to the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input. Successful exploitation allows an attacker to execute OS commands via a crafted goform/setUsbUnload request. EN

CVE-2018-13379 Severidad en análisis Ransomware en el catálogo el 03/11/2021

Fortinet FortiOS SSL VPN Path Traversal Vulnerability

Fortinet · FortiOS · CWE-22

Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests. EN

CVE-2018-11776 Severidad en análisis en el catálogo el 03/11/2021

Apache Struts Remote Code Execution Vulnerability

Apache · Struts · CWE-20

Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace. Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace. EN

CVE-2018-0802 Severidad en análisis Ransomware en el catálogo el 03/11/2021

Microsoft Office Memory Corruption Vulnerability

Microsoft · Office · CWE-787

Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0798. EN

CVE-2018-0798 Severidad en análisis en el catálogo el 03/11/2021

Microsoft Office Memory Corruption Vulnerability

Microsoft · Office · CWE-787

Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0802. EN

CVE-2018-0296 Severidad en análisis en el catálogo el 03/11/2021

Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability

Cisco · Adaptive Security Appliance (ASA) · CWE-20

Cisco Adaptive Security Appliance (ASA) contains an improper input validation vulnerability with HTTP URLs. Exploitation could allow an attacker to cause a denial-of-service (DoS) condition or information disclosure. EN

CVE-2018-0171 Severidad en análisis en el catálogo el 03/11/2021

Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability

Cisco · IOS and IOS XE · CWE-20

Cisco IOS and IOS XE Software improperly validates packet data, allowing an unauthenticated, remote attacker to trigger a reload of an affected device, cause a denial-of-service (DoS) condition, or perform code execution on the affected device. EN

CVE-2017-9822 Severidad en análisis Ransomware en el catálogo el 03/11/2021

DotNetNuke (DNN) Remote Code Execution Vulnerability

DotNetNuke (DNN) · DotNetNuke (DNN) · CWE-20

DotNetNuke (DNN) contains a vulnerability that may allow for remote code execution via cookie deserialization. EN

CVE-2017-9805 Severidad en análisis en el catálogo el 03/11/2021

Apache Struts Deserialization of Untrusted Data Vulnerability

Apache · Struts · CWE-502

Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads. EN

CVE-2017-9248 Severidad en análisis en el catálogo el 03/11/2021

Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability

Progress · ASP.NET AJAX and Sitefinity · CWE-522

Progress Telerik UI for ASP.NET AJAX and Sitefinity have a cryptographic weakness in Telerik.Web.UI.dll that can be exploited to disclose encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or the MachineKey), perform cross-site-scripting (XSS) attacks, compromise the ASP.NET ViewState, and/or upload and download files. EN

CVE-2017-8759 Severidad en análisis en el catálogo el 03/11/2021

Microsoft .NET Framework Remote Code Execution Vulnerability

Microsoft · .NET Framework · CWE-20

Microsoft .NET Framework contains a remote code execution vulnerability when processing untrusted input that could allow an attacker to take control of an affected system. EN

CVE-2017-7269 Severidad en análisis en el catálogo el 03/11/2021

Microsoft Windows Server Buffer Overflow Vulnerability

Microsoft · Internet Information Services (IIS) · CWE-119

Microsoft Windows Server 2003 R2 contains a buffer overflow vulnerability in Internet Information Services (IIS) 6.0 which allows remote attackers to execute code via a long header beginning with "If: EN

CVE-2017-6327 Severidad en análisis en el catálogo el 03/11/2021

Symantec Messaging Gateway Remote Code Execution Vulnerability

Symantec · Symantec Messaging Gateway · CWE-20

Symantec Messaging Gateway contains an unspecified vulnerability which can allow for remote code execution. With the ability to perform remote code execution, an attacker may also desire to perform privilege escalating actions. EN

CVE-2017-5638 Severidad en análisis Ransomware en el catálogo el 03/11/2021

Apache Struts Remote Code Execution Vulnerability

Apache · Struts · CWE-20

Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution. EN

CVE-2017-16651 Severidad en análisis en el catálogo el 03/11/2021

Roundcube Webmail File Disclosure Vulnerability

Roundcube · Roundcube Webmail · CWE-552

Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default. EN

CVE-2017-11882 Severidad en análisis Ransomware en el catálogo el 03/11/2021

Microsoft Office Memory Corruption Vulnerability

Microsoft · Office · CWE-119

Microsoft Office contains a memory corruption vulnerability that allows remote code execution in the context of the current user. EN

CVE-2017-11774 Severidad en análisis en el catálogo el 03/11/2021

Microsoft Office Outlook Security Feature Bypass Vulnerability

Microsoft · Office · CWE-119

Microsoft Office Outlook contains a security feature bypass vulnerability due to improperly handling objects in memory. Successful exploitation allows an attacker to execute commands. EN

CVE-2017-0199 Severidad en análisis Ransomware en el catálogo el 03/11/2021

Microsoft Office and WordPad Remote Code Execution Vulnerability

Microsoft · Office and WordPad

Microsoft Office and WordPad contain an unspecified vulnerability due to the way the applications parse specially crafted files. Successful exploitation allows for remote code execution. EN

CVE-2017-0143 Severidad en análisis Ransomware en el catálogo el 03/11/2021

Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability

Microsoft · Windows · CWE-20

Microsoft Windows Server Message Block 1.0 (SMBv1) contains an unspecified vulnerability that allows for remote code execution. EN