Vulnerabilidades exploradas (CISA KEV)

CVE-2020-5847 Crítica · 9.8 KEV Urgente · 83 Exploit público 16/03/2020

Unraid Remote Code Execution Vulnerability

Unraid through 6.8.0 allows Remote Code Execution.

CVE-2020-5849 Alta · 7.5 KEV Urgente · 79 Exploit público CWE-697 16/03/2020

Unraid Authentication Bypass Vulnerability

Unraid 6.8.0 allows authentication bypass.

CVE-2020-0787 Alta · 7.8 KEV Urgente · 84 Exploit público Ransomware CWE-59 12/03/2020

Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability

An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows Background Intelligent Transfer Service Elevation of Privilege Vulnerability'.

CVE-2020-0796 Crítica · 10.0 KEV Urgente · 93 Exploit público Ransomware CWE-119 12/03/2020

Microsoft SMBv3 Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.

CVE-2020-10181 Crítica · 9.8 KEV Alta · 63 CWE-352 11/03/2020

Sumavision EMR Cross-Site Request Forgery (CSRF) Vulnerability

goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a device, as demonstrated by a setString=new_user<*1*>administrator<*1*>123456 request.

CVE-2020-6207 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-306 10/03/2020

SAP Solution Manager Missing Authentication for Critical Function Vulnerability

SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution Manager.

CVE-2020-0069 Alta · 7.8 KEV Alta · 58 Exploit público CWE-787 10/03/2020

Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability

In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754

CVE-2020-0041 Alta · 7.8 KEV Alta · 60 Exploit público CWE-20 10/03/2020

Android Kernel Out-of-Bounds Write Vulnerability

In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-145988638References: Upstream kernel

CVE-2016-11021 Alta · 7.2 KEV Alta · 68 Exploit público CWE-78 08/03/2020

D-Link DCS-930L Devices OS Command Injection Vulnerability

setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter.

CVE-2020-10221 Alta · 8.8 KEV Alta · 68 Exploit público CWE-78 08/03/2020

rConfig OS Command Injection Vulnerability

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter.

CVE-2020-10189 Crítica · 9.8 KEV Urgente · 93 Exploit público CWE-502 06/03/2020

Zoho ManageEngine Desktop Central File Upload Vulnerability

Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.

CVE-2019-20500 Alta · 7.8 KEV Alta · 64 Exploit público CWE-78 05/03/2020

D-Link DWL-2600AP Access Point Command Injection Vulnerability

D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.

CVE-2020-9054 Crítica · 9.8 KEV Urgente · 70 Exploit público CWE-78 04/03/2020

Zyxel Multiple NAS Devices OS Command Injection Vulnerability

Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device. Although the web server does not run as the root user, ZyXEL devices include a setuid utility that can be leveraged to run any command with root privileges. As such, it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges. By sending a specially-crafted HTTP POST or GET request to a vulnerable ZyXEL device, a remote, unauthenticated attacker may be able to execute arbitrary code on the device. This may happen by directly connecting to a device if it is directly exposed to an attacker. However, there are ways to trigger such crafted requests even if an attacker does not have direct connectivity to a vulnerable devices. For example, simply visiting a website can result in the compromise of any ZyXEL device that is reachable from the client system. Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 NAS520 before firmware V5.21(AASZ.3)C0 NAS540 before firmware V5.21(AATB.4)C0 NAS542 before firmware V5.21(ABAG.4)C0 ZyXEL has made firmware updates available for NAS326, NAS520, NAS540, and NAS542 devices. Affected models that are end-of-support: NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2

CVE-2019-17026 Alta · 8.8 KEV Urgente · 70 Exploit público CWE-843 02/03/2020

Mozilla Firefox And Thunderbird Type Confusion Vulnerability

Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1.

CVE-2020-6418 Alta · 8.8 KEV Urgente · 76 Exploit público CWE-843 27/02/2020

Google Chromium V8 Type Confusion Vulnerability

Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2020-3837 Alta · 7.8 KEV Alta · 64 Exploit público CWE-787 27/02/2020

Apple Multiple Products Memory Corruption Vulnerability

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges.

CVE-2020-1938 Crítica · 9.8 KEV Urgente · 83 Exploit público 24/02/2020

Apache Tomcat: Falha de Gerenciamento Impróprio de Privilégios no Conector AJP

Ao usar o Apache JServ Protocol (AJP), é preciso ter cuidado ao confiar em conexões recebidas para o Apache Tomcat. O Tomcat trata conexões AJP como tendo confiança maior do que, por exemplo, uma conexão HTTP semelhante. Se tais conexões estiverem disponíveis para um atacante, elas podem ser exploradas de formas que podem ser surpreendentes. Nas versões do Apache Tomcat de 9.0.0.M1 até 9.0.0.30, de 8.5.0 até 8.5.50 e de 7.0.0 até 7.0.99, o Tomcat era distribuído com um conector AJP habilitado por padrão, que escutava em todos os endereços IP configurados. Esperava-se (e recomendava-se no guia de segurança) que esse conector fosse desabilitado caso não fosse necessário. Este relatório de vulnerabilidade identificou um mecanismo que permitia: - retornar arquivos arbitrários de qualquer ponto da aplicação web - processar qualquer arquivo da aplicação web como JSP. Além disso, se a aplicação web permitisse upload de arquivos e armazenasse esses arquivos dentro da própria aplicação web (ou se o atacante conseguisse controlar o conteúdo da aplicação web por algum outro meio), então isso, junto com a capacidade de processar um arquivo como JSP, tornava possível a execução remota de código. É importante notar que a mitigação só é necessária se uma porta AJP estiver acessível a usuários não confiáveis. Usuários que desejem adotar uma abordagem de defesa em profundidade e bloquear o vetor que permite retornar arquivos arbitrários e a execução como JSP podem atualizar para o Apache Tomcat 9.0.31, 8.5.51 ou 7.0.100 ou posterior. Foram feitas várias alterações na configuração padrão do conector AJP na versão 9.0.31 para reforçar a configuração padrão. É provável que usuários que atualizarem para 9.0.31, 8.5.51 ou 7.0.100 ou posterior precisem fazer pequenas alterações em suas configurações.

CVE-2020-3153 Média · 6.5 KEV Urgente · 81 Exploit público Ransomware CWE-427 19/02/2020

Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability

A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. An exploit could allow the attacker to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.

CVE-2020-7796 Crítica · 9.8 KEV Alta · 67 Exploit público CWE-918 18/02/2020

Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability

Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.

CVE-2020-0688 Alta · 8.8 KEV Urgente · 96 Exploit público Ransomware CWE-287 11/02/2020

Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.

CVE-2020-0683 Alta · 7.8 KEV Alta · 69 Exploit público CWE-59 11/02/2020

Microsoft Windows Installer Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0686.

CVE-2020-0674 Alta · 7.5 KEV Urgente · 80 Exploit público CWE-416 11/02/2020

Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0673, CVE-2020-0710, CVE-2020-0711, CVE-2020-0712, CVE-2020-0713, CVE-2020-0767.

CVE-2020-0618 Alta · 8.8 KEV Urgente · 86 Exploit público Ransomware CWE-502 11/02/2020

Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.

CVE-2019-19356 Alta · 7.5 KEV Alta · 62 Exploit público CWE-78 07/02/2020

Netis WF2419 Devices Remote Code Execution Vulnerability

Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page. The vulnerability has been found in firmware version V1.2.31805 and V2.2.36123. After one is connected to this page, it is possible to execute system commands as root through the tracert diagnostic tool because of lack of user input sanitizing.

CVE-2019-18988 Alta · 7.0 KEV Alta · 61 Exploit público CWE-521 07/02/2020

TeamViewer Desktop Bypass Remote Login Vulnerability

TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' installations. It used a shared AES key for all installations since at least as far back as v7.0.43148, and used it for at least OptionsPasswordAES in the current version of the product. If an attacker were to know this key, they could decrypt protect information stored in the registry or configuration files of TeamViewer. With versions before v9.x , this allowed for attackers to decrypt the Unattended Access password to the system (which allows for remote login to the system as well as headless file browsing). The latest version still uses the same key for OptionPasswordAES but appears to have changed how the Unattended Access password is stored. While in most cases an attacker requires an existing session on a system, if the registry/configuration keys were stored off of the machine (such as in a file share or online), an attacker could then decrypt the required password to login to the system.