Radar de Segurança

CVE-2017-10271 Severidade em análise Ransomware no catálogo em 10/02/2022

Oracle Corporation WebLogic Server Remote Code Execution Vulnerability

Oracle · WebLogic Server

Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution. EN

CVE-2017-0145 Severidade em análise Ransomware no catálogo em 10/02/2022

Microsoft SMBv1 Remote Code Execution Vulnerability

Microsoft · SMBv1 · CWE-20

The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets. EN

CVE-2017-0144 Severidade em análise Ransomware no catálogo em 10/02/2022

Microsoft SMBv1 Remote Code Execution Vulnerability

Microsoft · SMBv1 · CWE-20

The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets. EN

CVE-2022-21882 Severidade em análise Ransomware no catálogo em 04/02/2022

Microsoft Win32k Privilege Escalation Vulnerability

Microsoft · Win32k · CWE-787

Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation. EN

CVE-2021-20038 Severidade em análise Ransomware no catálogo em 28/01/2022

SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability

SonicWall · SMA 100 Appliances · CWE-121

SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution. EN

CVE-2020-0787 Severidade em análise Ransomware no catálogo em 28/01/2022

Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability

Microsoft · Windows · CWE-269, CWE-59

Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges. EN

CVE-2018-8453 Severidade em análise Ransomware no catálogo em 21/01/2022

Microsoft Win32k Privilege Escalation Vulnerability

Microsoft · Win32k · CWE-404

Microsoft Windows Win32k contains a vulnerability that allows an attacker to escalate privileges. EN

CVE-2021-21975 Severidade em análise Ransomware no catálogo em 18/01/2022

VMware Server Side Request Forgery in vRealize Operations Manager API

VMware · vRealize Operations Manager API · CWE-918

Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials. EN

CVE-2019-2725 Severidade em análise Ransomware no catálogo em 10/01/2022

Oracle WebLogic Server, Injection

Oracle · WebLogic Server · CWE-74

Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). EN

CVE-2019-1579 Severidade em análise Ransomware no catálogo em 10/01/2022

Palo Alto Networks PAN-OS Remote Code Execution Vulnerability

Palo Alto Networks · PAN-OS · CWE-134

Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled. EN

CVE-2019-1458 Severidade em análise Ransomware no catálogo em 10/01/2022

Microsoft Win32k Privilege Escalation Vulnerability

Microsoft · Win32k

A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP. EN

CVE-2018-13383 Severidade em análise Ransomware no catálogo em 10/01/2022

Fortinet FortiOS and FortiProxy Out-of-bounds Write

Fortinet · FortiOS and FortiProxy · CWE-787

A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users. EN

CVE-2018-13382 Severidade em análise Ransomware no catálogo em 10/01/2022

Fortinet FortiOS and FortiProxy Improper Authorization

Fortinet · FortiOS and FortiProxy · CWE-285

An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password. EN

CVE-2021-43890 Severidade em análise Ransomware no catálogo em 15/12/2021

Microsoft Windows AppX Installer Spoofing Vulnerability

Microsoft · Windows

Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability. EN

CVE-2021-44228 Severidade em análise Ransomware no catálogo em 10/12/2021

Apache Log4j2 Remote Code Execution Vulnerability

Apache · Log4j2 · CWE-20, CWE-400, CWE-502

Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution. EN

CVE-2017-12149 Severidade em análise Ransomware no catálogo em 10/12/2021

Red Hat JBoss Application Server Remote Code Execution Vulnerability

Red Hat · JBoss Application Server · CWE-502

The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data. EN

CVE-2021-40438 Severidade em análise Ransomware no catálogo em 01/12/2021

Apache HTTP Server-Side Request Forgery (SSRF)

Apache · Apache · CWE-918

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier. EN

CVE-2021-42321 Severidade em análise Ransomware no catálogo em 17/11/2021

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft · Exchange · CWE-184, CWE-502

An authenticated attacker could leverage improper validation in cmdlet arguments within Microsoft Exchange and perform remote code execution. EN

CVE-2021-40449 Severidade em análise Ransomware no catálogo em 17/11/2021

Microsoft Windows Win32k Privilege Escalation Vulnerability

Microsoft · Windows · CWE-416

Unspecified vulnerability allows for an authenticated user to escalate privileges. EN

CVE-2021-42258 Severidade em análise Ransomware no catálogo em 03/11/2021

BQE BillQuick Web Suite SQL Injection Vulnerability

BQE · BillQuick Web Suite · CWE-89

BQE BillQuick Web Suite contains an SQL injection vulnerability when accessing the username parameter that may allow for unauthenticated, remote code execution. EN

CVE-2021-42013 Severidade em análise Ransomware no catálogo em 03/11/2021

Apache HTTP Server Path Traversal Vulnerability

Apache · HTTP Server · CWE-22

Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts are enabled. This CVE ID resolves an incomplete patch for CVE-2021-41773. EN

CVE-2021-41773 Severidade em análise Ransomware no catálogo em 03/11/2021

Apache HTTP Server Path Traversal Vulnerability

Apache · HTTP Server · CWE-22

Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default �require all denied� or if CGI scripts are enabled. The original patch issued under this CVE ID is insufficient, please review remediation information under CVE-2021-42013. EN

CVE-2021-40539 Severidade em análise Ransomware no catálogo em 03/11/2021

Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability

Zoho · ManageEngine · CWE-55

Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution. EN

CVE-2021-40444 Severidade em análise Ransomware no catálogo em 03/11/2021

Microsoft MSHTML Remote Code Execution Vulnerability

Microsoft · MSHTML · CWE-22

Microsoft MSHTML contains a unspecified vulnerability that allows for remote code execution. EN