CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-3613
https://notcve.org/view.php?id=CVE-2021-3613
OpenVPN Connect 3.2.0 through 3.3.0 allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code with the same privilege level as the main OpenVPN process (OpenVPNConnect.exe). OpenVPN Connect versiones 3.2.0 hasta 3.3.0, permite a usuarios locales cargar bibliotecas dinámicas arbitrarias por medio de un archivo de configuración de OpenSSL si está presente, permitiendo a un usuario ejecutar código arbitrario con el mismo nivel de privilegio que el proceso principal de OpenVPN (OpenVPNConnect.exe) • https://openvpn.net/vpn-server-resources/openvpn-connect-for-windows-change-log • CWE-427: Uncontrolled Search Path Element •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-28579 – Adobe Connect improper access control could lead to privilege escalation
https://notcve.org/view.php?id=CVE-2021-28579
Adobe Connect version 11.2.1 (and earlier) is affected by an Improper access control vulnerability that can lead to the elevation of privileges. An attacker with 'Learner' permissions can leverage this scenario to access the list of event participants. Adobe Connect versiones 11.2.1 (y anteriores), está afectada por una vulnerabilidad de control inapropiado de acceso que puede conllevar a una escalada de privilegios. Un atacante con permisos de "Learner" puede aprovechar este escenario para acceder a la lista de participantes en el evento • https://helpx.adobe.com/security/products/connect/apsb21-36.html • CWE-284: Improper Access Control •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15075
https://notcve.org/view.php?id=CVE-2020-15075
OpenVPN Connect installer for macOS version 3.2.6 and older may corrupt system critical files it should not have access via symlinks in /tmp. El instalador de OpenVPN Connect para macOS versión 3.2.6 y anteriores, puede corromper archivos críticos del sistema a los que no debería tener acceso por medio de enlaces simbólicos en /tmp. • https://openvpn.net/vpn-server-resources/openvpn-connect-for-macos-change-log • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-61: UNIX Symbolic Link (Symlink) Following •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-26715
https://notcve.org/view.php?id=CVE-2021-26715
The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery (SSRF) vulnerability. The vulnerability arises due to unsafe usage of the logo_uri parameter in the Dynamic Client Registration request. An unauthenticated attacker can make a HTTP request from the vulnerable server to any address in the internal network and obtain its response (which might, for example, have a JavaScript payload for resultant XSS). The issue can be exploited to bypass network boundaries, obtain sensitive data, or attack other hosts in the internal network. La implementación del servidor OpenID Connect para MITREid Connect versiones hasta 1.3.3, contiene una vulnerabilidad de Server Side Request Forgery (SSRF). • https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/releases https://portswigger.net/research/hidden-oauth-attack-vectors • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-25265
https://notcve.org/view.php?id=CVE-2021-25265
A malicious website could execute code remotely in Sophos Connect Client before version 2.1. Un sitio web malicioso podría ejecutar código remotamente en Sophos Connect Client versiones anteriores a 2.1 • https://community.sophos.com/b/security-blog https://community.sophos.com/b/security-blog/posts/resolved-rce-in-sophos-connect-client-for-windows-cve-2021-25265 •