Radar de Segurança

CVE-2022-27926 Severidade em análise no catálogo em 03/04/2023

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Synacor · Zimbra Collaboration Suite (ZCS) · CWE-79, CWE-138

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability by allowing an endpoint URL to accept parameters without sanitizing. EN

CVE-2023-0266 Severidade em análise no catálogo em 30/03/2023

Linux Kernel Use-After-Free Vulnerability

Linux · Kernel · CWE-416

Linux kernel contains a use-after-free vulnerability that allows for privilege escalation to gain ring0 access from the system user. EN

CVE-2022-42948 Severidade em análise no catálogo em 30/03/2023

Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability

Fortra · Cobalt Strike · CWE-79, CWE-116

Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution. EN

CVE-2022-39197 Severidade em análise no catálogo em 30/03/2023

Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability

Fortra · Cobalt Strike · CWE-20, CWE-79

Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely. EN

CVE-2022-38181 Severidade em análise no catálogo em 30/03/2023

Arm Mali GPU Kernel Driver Use-After-Free Vulnerability

Arm · Mali Graphics Processing Unit (GPU) · CWE-416

Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information. EN

CVE-2022-3038 Severidade em análise no catálogo em 30/03/2023

Google Chromium Network Service Use-After-Free Vulnerability

Google · Chromium Network Service · CWE-416

Google Chromium Network Service contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. EN

CVE-2022-22706 Severidade em análise no catálogo em 30/03/2023

Arm Mali GPU Kernel Driver Unspecified Vulnerability

Arm · Mali Graphics Processing Unit (GPU) · CWE-119

Arm Mali GPU Kernel Driver contains an unspecified vulnerability that allows a non-privileged user to achieve write access to read-only memory pages. EN

CVE-2021-30900 Severidade em análise no catálogo em 30/03/2023

Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability

Apple · iOS, iPadOS, and macOS · CWE-20, CWE-787

Apple GPU drivers, included in iOS, iPadOS, and macOS, contain an out-of-bounds write vulnerability that may allow a malicious application to execute code with kernel privileges. EN

CVE-2017-7494 Severidade em análise Ransomware no catálogo em 30/03/2023

Samba Remote Code Execution Vulnerability

Samba · Samba · CWE-94

Samba contains a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share and then cause the server to load and execute it. EN

CVE-2013-3163 Severidade em análise no catálogo em 30/03/2023

Microsoft Internet Explorer Memory Corruption Vulnerability

Microsoft · Internet Explorer · CWE-94

Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial of service via a crafted website. EN

CVE-2023-26360 Severidade em análise no catálogo em 15/03/2023

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe · ColdFusion · CWE-284

Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution. EN

CVE-2023-24880 Severidade em análise Ransomware no catálogo em 14/03/2023

Microsoft Windows SmartScreen Security Feature Bypass Vulnerability

Microsoft · Windows · CWE-863

Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file. EN

CVE-2023-23397 Severidade em análise no catálogo em 14/03/2023

Microsoft Office Outlook Privilege Escalation Vulnerability

Microsoft · Office · CWE-294

Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user. EN

CVE-2022-41328 Severidade em análise no catálogo em 14/03/2023

Fortinet FortiOS Path Traversal Vulnerability

Fortinet · FortiOS · CWE-22

Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands. EN

CVE-2021-39144 Severidade em análise no catálogo em 10/03/2023

XStream Remote Code Execution Vulnerability

XStream · XStream · CWE-94, CWE-502

XStream contains a remote code execution vulnerability that allows an attacker to manipulate the processed input stream and replace or inject objects that result in the execution of a local command on the server. This vulnerability can affect multiple products, including but not limited to VMware Cloud Foundation. EN

CVE-2020-5741 Severidade em análise no catálogo em 10/03/2023

Plex Media Server Remote Code Execution Vulnerability

Plex · Media Server · CWE-502

Plex Media Server contains a remote code execution vulnerability that allows an attacker with access to the server administrator's Plex account to upload a malicious file via the Camera Upload feature and have the media server execute it. EN

CVE-2022-35914 Severidade em análise no catálogo em 07/03/2023

Teclib GLPI Remote Code Execution Vulnerability

Teclib · GLPI · CWE-74

Teclib GLPI contains a remote code execution vulnerability in the third-party library, htmlawed. EN

CVE-2022-33891 Severidade em análise no catálogo em 07/03/2023

Apache Spark Command Injection Vulnerability

Apache · Spark · CWE-78

Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled. EN

CVE-2022-28810 Severidade em análise no catálogo em 07/03/2023

Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability

Zoho · ManageEngine · CWE-78, CWE-259

Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset. EN

CVE-2022-36537 Severidade em análise Ransomware no catálogo em 27/02/2023

ZK Framework AuUploader Unspecified Vulnerability

ZK Framework · AuUploader · CWE-441

ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager. EN

CVE-2022-47986 Severidade em análise Ransomware no catálogo em 21/02/2023

IBM Aspera Faspex Code Execution Vulnerability

IBM · Aspera Faspex · CWE-502

IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw. EN

CVE-2022-41223 Severidade em análise Ransomware no catálogo em 21/02/2023

Mitel MiVoice Connect Code Injection Vulnerability

Mitel · MiVoice Connect · CWE-94

The Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application. EN

CVE-2022-40765 Severidade em análise Ransomware no catálogo em 21/02/2023

Mitel MiVoice Connect Command Injection Vulnerability

Mitel · MiVoice Connect · CWE-77

The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system. EN

CVE-2022-46169 Severidade em análise no catálogo em 16/02/2023

Cacti Command Injection Vulnerability

Cacti · Cacti · CWE-74

Cacti contains a command injection vulnerability that allows an unauthenticated user to execute code. EN