CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-40763
https://notcve.org/view.php?id=CVE-2024-40763
05 Dec 2024 — Heap-based buffer overflow vulnerability in the SonicWall SMA100 SSLVPN due to the use of strcpy. This allows remote authenticated attackers to cause Heap-based buffer overflow and potentially lead to code execution. • https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018 • CWE-122: Heap-based Buffer Overflow •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-45317
https://notcve.org/view.php?id=CVE-2024-45317
11 Oct 2024 — A Server-Side Request Forgery (SSRF) vulnerability in SMA1000 appliance firmware versions 12.4.3-02676 and earlier allows a remote, unauthenticated attacker to cause the SMA1000 server-side application to make requests to an unintended IP address. • https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0017 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-45316 – SonicWALL Connect Tunnel Link Following Local Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2024-45316
11 Oct 2024 — The Improper link resolution before file access ('Link Following') vulnerability in SonicWall Connect Tunnel (version 12.4.3.271 and earlier of Windows client) allows users with standard privileges to delete arbitrary folders and files, potentially leading to local privilege escalation attack. This vulnerability allows local attackers to escalate privileges on affected installations of SonicWALL Connect Tunnel. An attacker must first obtain the ability to execute low-privileged code on the target system in ... • https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0017 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-45315 – SonicWALL Connect Tunnel Link Following Denial-of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2024-45315
11 Oct 2024 — The Improper link resolution before file access ('Link Following') vulnerability in SonicWall Connect Tunnel (version 12.4.3.271 and earlier of Windows client) allows users with standard privileges to create arbitrary folders and files, potentially leading to local Denial of Service (DoS) attack. This vulnerability allows local attackers to create a denial-of-service condition on affected installations of SonicWALL Connect Tunnel. An attacker must first obtain the ability to execute low-privileged code on t... • https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0017 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 10.0EPSS: 18%CPEs: 1EXPL: 0CVE-2024-40766 – SonicWall SonicOS Improper Access Control Vulnerability
https://notcve.org/view.php?id=CVE-2024-40766
23 Aug 2024 — An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions. SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the ... • https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015 • CWE-284: Improper Access Control •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-40764
https://notcve.org/view.php?id=CVE-2024-40764
18 Jul 2024 — Heap-based buffer overflow vulnerability in the SonicOS IPSec VPN allows an unauthenticated remote attacker to cause Denial of Service (DoS). Una vulnerabilidad de desbordamiento de búfer basada en montón en SonicOS IPSec VPN permite que un atacante remoto no autenticado provoque una denegación de servicio (DoS). • https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0012 • CWE-122: Heap-based Buffer Overflow •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29014
https://notcve.org/view.php?id=CVE-2024-29014
18 Jul 2024 — Vulnerability in SonicWall SMA100 NetExtender Windows (32 and 64-bit) client 10.2.339 and earlier versions allows an attacker to arbitrary code execution when processing an EPC Client update. Una vulnerabilidad en el cliente SonicWall SMA100 NetExtender Windows (32 y 64 bits) 10.2.339 y versiones anteriores permite a un atacante ejecutar código arbitrario al procesar una actualización del cliente EPC. • https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0011 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.0EPSS: 0%CPEs: 36EXPL: 1CVE-2024-3596 – RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.
https://notcve.org/view.php?id=CVE-2024-3596
09 Jul 2024 — RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature. El protocolo RADIUS según RFC 2865 es susceptible a ataques de falsificación por parte de un atacante local que puede modificar cualquier respuesta válida (acceso-aceptación, acceso-rechazo o acceso-desafío) a cualquier otra respuesta... • https://github.com/alperenugurlu/CVE-2024-3596-Detector • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-328: Use of Weak Hash CWE-354: Improper Validation of Integrity Check Value CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel •
CVSS: 6.8EPSS: 2%CPEs: 1EXPL: 0CVE-2024-29013
https://notcve.org/view.php?id=CVE-2024-29013
20 Jun 2024 — Heap-based buffer overflow vulnerability in the SonicOS SSL-VPN allows an authenticated remote attacker to cause Denial of Service (DoS) via memcpy function. Una vulnerabilidad de desbordamiento de búfer basada en montón en SonicOS SSL-VPN permite que un atacante remoto autenticado provoque una denegación de servicio (DoS) a través de la función memcpy. • https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0009 • CWE-122: Heap-based Buffer Overflow •
CVSS: 7.8EPSS: 2%CPEs: 1EXPL: 0CVE-2024-29012
https://notcve.org/view.php?id=CVE-2024-29012
20 Jun 2024 — Stack-based buffer overflow vulnerability in the SonicOS HTTP server allows an authenticated remote attacker to cause Denial of Service (DoS) via sscanf function. Una vulnerabilidad de desbordamiento de búfer basada en pila en el servidor HTTP de SonicOS permite que un atacante remoto autenticado provoque una denegación de servicio (DoS) a través de la función sscanf. • https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0008 • CWE-121: Stack-based Buffer Overflow •