Radar de Segurança

CVE-2020-14883 Severidade em análise no catálogo em 03/11/2021

Oracle WebLogic Server Unspecified Vulnerability

Oracle · WebLogic Server

Oracle WebLogic Server contains an unspecified vulnerability in the Console component with high impacts to confidentilaity, integrity, and availability. EN

CVE-2020-14882 Severidade em análise no catálogo em 03/11/2021

Oracle WebLogic Server Remote Code Execution Vulnerability

Oracle · WebLogic Server

Oracle WebLogic Server contains an unspecified vulnerability, which is assessed to allow for remote code execution, based on this vulnerability being related to CVE-2020-14750. EN

CVE-2020-14871 Severidade em análise no catálogo em 03/11/2021

Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability

Oracle · Solaris and Zettabyte File System (ZFS) · CWE-787

Oracle Solaris and Oracle ZFS Storage Appliance Kit contain an unspecified vulnerability causing high impacts to confidentiality, integrity, and availability of affected systems. EN

CVE-2020-14750 Severidade em análise no catálogo em 03/11/2021

Oracle WebLogic Server Remote Code Execution Vulnerability

Oracle · WebLogic Server

Oracle WebLogic Server contains an unspecified vulnerability allowing an unauthenticated attacker to perform remote code execution. This vulnerability is related to CVE-2020-14882. EN

CVE-2020-1472 Severidade em análise Ransomware no catálogo em 03/11/2021

Microsoft Netlogon Privilege Escalation Vulnerability

Microsoft · Netlogon · CWE-330

Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller. An attacker who successfully exploits the vulnerability could run a specially crafted application on a device on the network. The vulnerability is also known under the moniker of Zerologon. EN

CVE-2020-1464 Severidade em análise no catálogo em 03/11/2021

Microsoft Windows Spoofing Vulnerability

Microsoft · Windows · CWE-347

Microsoft Windows contains a spoofing vulnerability when Windows incorrectly validates file signatures, allowing an attacker to bypass security features and load improperly signed files. EN

CVE-2020-1380 Severidade em análise no catálogo em 03/11/2021

Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability

Microsoft · Internet Explorer · CWE-787

Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user. EN

CVE-2020-1350 Severidade em análise no catálogo em 03/11/2021

Microsoft Windows DNS Server Remote Code Execution Vulnerability

Microsoft · Windows

Microsoft Windows DNS Servers fail to properly handle requests, allowing an attacker to perform remote code execution in the context of the Local System Account. The vulnerability is also known under the moniker of SIGRed. EN

CVE-2020-12812 Severidade em análise Ransomware no catálogo em 03/11/2021

Fortinet FortiOS SSL VPN Improper Authentication Vulnerability

Fortinet · FortiOS · CWE-178, CWE-287

Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username. EN

CVE-2020-11738 Severidade em análise no catálogo em 03/11/2021

WordPress Snap Creek Duplicator Plugin File Download Vulnerability

WordPress · Snap Creek Duplicator Plugin · CWE-22

WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro. EN

CVE-2020-1147 Severidade em análise no catálogo em 03/11/2021

Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability

Microsoft · .NET Framework, SharePoint, Visual Studio

Microsoft .NET Framework, Microsoft SharePoint, and Visual Studio contain a remote code execution vulnerability when the software fails to check the source markup of XML file input. Successful exploitation allows an attacker to execute code in the context of the process responsible for deserialization of the XML content. EN

CVE-2020-1054 Severidade em análise no catálogo em 03/11/2021

Microsoft Win32k Privilege Escalation Vulnerability

Microsoft · Win32k · CWE-787

Microsoft Win32k contains a privilege escalation vulnerability when the Windows kernel-mode driver fails to properly handle objects in memory. Successful exploitation allows an attacker to execute code in kernel mode. EN

CVE-2020-1040 Severidade em análise no catálogo em 03/11/2021

Microsoft Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability

Microsoft · Hyper-V RemoteFX · CWE-20

Microsoft Hyper-V RemoteFX vGPU contains an improper input validation vulnerability due to the host server failing to properly validate input from an authenticated user on a guest operating system. Successful exploitation allows for remote code execution on the host operating system. EN

CVE-2020-1020 Severidade em análise no catálogo em 03/11/2021

Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability

Microsoft · Windows · CWE-787

Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities. EN

CVE-2020-0986 Severidade em análise no catálogo em 03/11/2021

Microsoft Windows Kernel Privilege Escalation Vulnerability

Microsoft · Windows · CWE-787

Microsoft Windows kernel contains an unspecified vulnerability when handling objects in memory that allows attackers to escalate privileges and execute code in kernel mode. EN

CVE-2020-0968 Severidade em análise Ransomware no catálogo em 03/11/2021

Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability

Microsoft · Internet Explorer · CWE-787

Microsoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution. EN

CVE-2020-0938 Severidade em análise no catálogo em 03/11/2021

Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability

Microsoft · Windows · CWE-787

Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities. EN

CVE-2020-0878 Severidade em análise Ransomware no catálogo em 03/11/2021

Microsoft Edge and Internet Explorer Memory Corruption Vulnerability

Microsoft · Edge and Internet Explorer · CWE-787

Microsoft Edge and Internet Explorer contain a memory corruption vulnerability that allows attackers to execute code in the context of the current user. EN

CVE-2020-0688 Severidade em análise Ransomware no catálogo em 03/11/2021

Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability

Microsoft · Exchange Server · CWE-287

Microsoft Exchange Server Validation Key fails to properly create unique keys at install time, allowing for remote code execution. EN

CVE-2020-0683 Severidade em análise no catálogo em 03/11/2021

Microsoft Windows Installer Privilege Escalation Vulnerability

Microsoft · Windows

Microsoft Windows Installer contains a privilege escalation vulnerability when MSI packages process symbolic links, which allows attackers to bypass access restrictions to add or remove files. EN

CVE-2020-0674 Severidade em análise no catálogo em 03/11/2021

Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability

Microsoft · Internet Explorer · CWE-416

Microsoft Internet Explorer contains a memory corruption vulnerability due to the way the Scripting Engine handles objects in memory. Successful exploitation could allow remote code execution in the context of the current user. EN

CVE-2020-0646 Severidade em análise no catálogo em 03/11/2021

Microsoft .NET Framework Remote Code Execution Vulnerability

Microsoft · .NET Framework · CWE-91

Microsoft .NET Framework contains an improper input validation vulnerability that allows for remote code execution. EN

CVE-2020-0601 Severidade em análise no catálogo em 03/11/2021

Microsoft Windows CryptoAPI Spoofing Vulnerability

Microsoft · Windows · CWE-295

Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall. EN

CVE-2019-9978 Severidade em análise no catálogo em 03/11/2021

WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability

WordPress · Social Warfare Plugin · CWE-79

WordPress Social Warfare plugin contains a cross-site scripting (XSS) vulnerability that allows for remote code execution. This vulnerability affects Social Warfare and Social Warfare Pro. EN