Vulnerabilidades exploradas (CISA KEV)

CVE-2019-16928 Crítica · 9.8 KEV Alta · 63 CWE-787 27/09/2019

Exim Out-of-bounds Write Vulnerability

Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.

CVE-2019-16920 Crítica · 9.8 KEV Urgente · 73 Exploit público CWE-78 27/09/2019

D-Link Multiple Routers Command Injection Vulnerability

Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.

CVE-2019-16759 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-94 24/09/2019

vBulletin PHP Module Remote Code Execution Vulnerability

vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.

CVE-2019-1367 Alta · 7.5 KEV Urgente · 72 Exploit público Ransomware CWE-787 23/09/2019

Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1221.

CVE-2019-16057 Crítica · 9.8 KEV Urgente · 77 Exploit público Ransomware CWE-78 16/09/2019

D-Link DNS-320 Remote Code Execution Vulnerability

The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.

CVE-2019-16256 Crítica · 9.8 KEV Alta · 62 12/09/2019

SIMalliance Toolbox Browser Command Injection Vulnerability

Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit (STK) instructions in an SMS message, aka Simjacker.

CVE-2019-1297 Alta · 8.8 KEV Alta · 56 11/09/2019

Microsoft Excel Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'.

CVE-2019-1253 Alta · 7.8 KEV Urgente · 79 Exploit público Ransomware CWE-59 11/09/2019

Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1215, CVE-2019-1278, CVE-2019-1303.

CVE-2019-1214 Alta · 7.8 KEV Alta · 52 CWE-119 11/09/2019

Microsoft Windows Privilege Common Log File System (CLFS) Escalation Vulnerability

An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aka 'Windows Common Log File System Driver Elevation of Privilege Vulnerability'.

CVE-2019-1215 Alta · 7.8 KEV Urgente · 80 Exploit público Ransomware CWE-269 11/09/2019

Microsoft Windows Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1253, CVE-2019-1278, CVE-2019-1303.

CVE-2019-15949 Alta · 8.8 KEV Urgente · 76 Exploit público CWE-78 05/09/2019

Nagios XI Remote Code Execution Vulnerability

Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web interface. The getprofile.sh script, invoked by downloading a system profile (profile.php?cmd=download), is executed as root via a passwordless sudo entry; the script executes check_plugin, which is owned by the nagios user. A user logged into Nagios XI with permissions to modify plugins, or the nagios user on the server, can modify the check_plugin executable and insert malicious commands to execute as root.

CVE-2019-13608 Alta · 7.5 KEV Urgente · 73 Exploit público Ransomware CWE-611 29/08/2019

Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability

Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.

CVE-2019-15752 Alta · 7.8 KEV Urgente · 76 Exploit público CWE-732 28/08/2019

Docker Desktop Community Edition Privilege Escalation Vulnerability

Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user, and then waiting for an admin or service user to authenticate with Docker, restart Docker, or run 'docker login' to force the command.

CVE-2019-15107 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-78 16/08/2019

Webmin Command Injection Vulnerability

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.

CVE-2019-0344 Crítica · 9.8 KEV Alta · 62 CWE-502 14/08/2019

SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability

Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.

CVE-2019-11581 Crítica · 9.8 KEV Urgente · 73 Exploit público CWE-74 09/08/2019

Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability

There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.

CVE-2019-0193 Alta · 7.2 KEV Alta · 66 Exploit público CWE-94 01/08/2019

Injeção de código no DataImportHandler do Apache Solr

No Apache Solr, o DataImportHandler, um módulo opcional, mas popular, para importar dados de bancos de dados e outras fontes, possui um recurso em que toda a configuração DIH pode vir do parâmetro 'dataConfig' de uma requisição. O modo de depuração da tela administrativa do DIH usa esse recurso para facilitar a depuração e o desenvolvimento de uma configuração DIH. Como uma configuração DIH pode conter scripts, esse parâmetro representa um risco de segurança. A partir da versão 8.2.0 do Solr, o uso desse parâmetro exige que a propriedade de sistema Java 'enable.dih.dataConfigParam' esteja definida como true.

CVE-2019-11708 Crítica · 10.0 KEV Urgente · 74 Exploit público CWE-20 23/07/2019

Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability

Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2.

CVE-2019-11707 Alta · 8.8 KEV Urgente · 70 Exploit público CWE-843 23/07/2019

Mozilla Firefox and Thunderbird Type Confusion Vulnerability

A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.

CVE-2019-1579 Alta · 8.1 KEV Urgente · 72 Exploit público Ransomware CWE-134 19/07/2019

Palo Alto Networks PAN-OS Remote Code Execution Vulnerability

Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.

CVE-2019-13272 Alta · 7.8 KEV Urgente · 76 Exploit público 17/07/2019

Linux Kernel Improper Privilege Management Vulnerability

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.

CVE-2019-12991 Alta · 8.8 KEV Alta · 64 Exploit público CWE-78 16/07/2019

Citrix SD-WAN and NetScaler Command Injection Vulnerability

Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6).

CVE-2019-12989 Crítica · 9.8 KEV Urgente · 75 Exploit público CWE-89 16/07/2019

Citrix SD-WAN and NetScaler SQL Injection Vulnerability

Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.

CVE-2019-1132 Alta · 7.8 KEV Alta · 69 Exploit público 15/07/2019

Microsoft Win32k Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'.

CVE-2019-1130 Alta · 7.8 KEV Alta · 63 Ransomware CWE-59 15/07/2019

Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1129.