CVSS: 6.7EPSS: 0%CPEs: 1EXPL: 6CVE-2022-47529 – RSA NetWitness Platform 12.2 - Incorrect Access Control / Code Execution
https://notcve.org/view.php?id=CVE-2022-47529
24 Mar 2023 — Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts to modify the endpoint agent service configuration: to either disable it completely or run user-supplied code or commands, thereby bypassing tamper-protection features via ACL modification. RSA NetWitness Endpoint EDR Agent version 12.x suffers from incorrect access controls that allow for code execution. It allows local users to stop the Endpoint Windows agent from sen... • https://packetstorm.news/files/id/171476 •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-3725 – Command Injection vulnerability
https://notcve.org/view.php?id=CVE-2019-3725
15 May 2019 — RSA Netwitness Platform versions prior to 11.2.1.1 and RSA Security Analytics versions prior to 10.6.6.1 are vulnerable to a Command Injection vulnerability due to missing input validation in the product. A remote unauthenticated malicious user could exploit this vulnerability to execute arbitrary commands on the server. Las versiones de RSA Netwitness Platform anteriores a la versión 11.2.1.1 y las de RSA Security Analytics anteriores a 10.6.6.1 son vulnerables a la Inyección de comandos debido a la falta ... • http://www.securityfocus.com/bid/108355 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •