CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-1150 – Improper validation of update packages
https://notcve.org/view.php?id=CVE-2024-1150
08 Feb 2024 — Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on Unix allows File Manipulation through Snow Update Packages.This issue affects Inventory Agent: through 7.3.1. La verificación incorrecta de la vulnerabilidad de la firma criptográfica en Snow Software Inventory Agent en Unix permite la manipulación de archivos a través de los paquetes de actualización de Snow. Este problema afecta al Inventory Agent: hasta 7.3.1. • https://community.snowsoftware.com/s/feed/0D5Td000004YtMcKAK • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2024-1149 – Improper validation of update packages
https://notcve.org/view.php?id=CVE-2024-1149
08 Feb 2024 — Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on MacOS, Snow Software Inventory Agent on Windows, Snow Software Inventory Agent on Linux allows File Manipulation through Snow Update Packages.This issue affects Inventory Agent: through 6.12.0; Inventory Agent: through 6.14.5; Inventory Agent: through 6.7.2. Verificación incorrecta de la vulnerabilidad de firma criptográfica en Snow Software Inventory Agent en MacOS, Snow Software Inventory Agent en Windows y ... • https://community.snowsoftware.com/s/feed/0D5Td000004YtMcKAK • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 6.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-7169 – Impersonate vendor signed Powershell scripts
https://notcve.org/view.php?id=CVE-2023-7169
08 Feb 2024 — Authentication Bypass by Spoofing vulnerability in Snow Software Snow Inventory Agent on Windows allows Signature Spoof.This issue affects Snow Inventory Agent: through 6.14.5. Customers advised to upgrade to version 7.0 Vulnerabilidad de omisión de autenticación mediante suplantación de identidad en Snow Software Snow Inventory Agent en Windows permite la suplantación de firma. Este problema afecta a Snow Inventory Agent: hasta 6.14.5. Se recomienda a los clientes actualizar a la versión 7.0 • https://community.snowsoftware.com/s/feed/0D5Td000004YtMcKAK • CWE-290: Authentication Bypass by Spoofing •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-3937 – Cross site scripting vulnerabilities in Snow License Manager
https://notcve.org/view.php?id=CVE-2023-3937
11 Aug 2023 — Cross site scripting vulnerability in web portal in Snow Software License Manager from version 9.0.0 up to and including 9.30.1 on Windows allows an authenticated user with high privileges to trigger cross site scripting attack via the web browser • https://community.snowsoftware.com/s/feed/0D56M00009gUexuSAC • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.3EPSS: 0%CPEs: 2EXPL: 0CVE-2023-3864 – SQL injection vulnerability in Snow License Manager
https://notcve.org/view.php?id=CVE-2023-3864
11 Aug 2023 — Blind SQL injection in a service running in Snow Software license manager from version 8.0.0 up to and including 9.30.1 on Windows allows a logged in user with high privileges to inject SQL commands via the web portal. • https://community.snowsoftware.com/s/feed/0D56M00009gUexuSAC • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2023-2679 – Data leakage in Adobe connector for SPE edition of SLM
https://notcve.org/view.php?id=CVE-2023-2679
17 May 2023 — Data leakage in Adobe connector in Snow Software SPE 9.27.0 on Windows allows privileged user to observe other users data. • https://community.snowsoftware.com/s/feed/0D56M00009Ex9dySAB • CWE-269: Improper Privilege Management •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-0883 – Windows Unquoted/Trusted Service Paths
https://notcve.org/view.php?id=CVE-2022-0883
18 May 2022 — SLM has an issue with Windows Unquoted/Trusted Service Paths Security Issue. All installations version 9.x.x prior to 9.20.1 should be patched. SLM presenta un problema de seguridad con las rutas de servicio no Citadas/Confiables de Windows. Todas las instalaciones versiones 9.x.x anteriores a 9.20.1 deben ser parcheadas • https://community.snowsoftware.com/s/feed/0D5690000BsNCO6CQO • CWE-428: Unquoted Search Path or Element •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-4106 – Vulnerability in Snow Inventory Java Scanner
https://notcve.org/view.php?id=CVE-2021-4106
16 Feb 2022 — A vulnerability in Snow Inventory Java Scanner allows an attacker to run malicious code at a higher level of privileges. This issue affects: SNOW Snow Inventory Java Scanner 1.0 Una vulnerabilidad en el escáner Java de Snow Inventory permite a un atacante ejecutar código malicioso a un nivel superior de privilegios. Este problema afecta a: SNOW Snow Inventory Java Scanner versión 1.0 • https://community.snowsoftware.com/s/feed/0D5690000BObYdUCQV • CWE-691: Insufficient Control Flow Management •
CVSS: 10.0EPSS: 94%CPEs: 398EXPL: 413CVE-2021-44228 – Apache Log4j2 Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-44228
10 Dec 2021 — Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.... • https://packetstorm.news/files/id/171626 • CWE-20: Improper Input Validation CWE-400: Uncontrolled Resource Consumption CWE-502: Deserialization of Untrusted Data CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-41562 – Deletion of arbitrary files vulnerability in Snow Agent for Windows
https://notcve.org/view.php?id=CVE-2021-41562
03 Nov 2021 — A vulnerability in Snow Snow Agent for Windows allows a non-admin user to cause arbitrary deletion of files. This issue affects: Snow Snow Agent for Windows version 5.0.0 to 6.7.1 on Windows. Una vulnerabilidad en Snow Snow Agent para Windows permite a un usuario no administrador causar un borrado arbitrario de archivos. Este problema afecta: Snow Snow Agent para Windows versión 5.0.0 hasta 6.7.1 en Windows • https://community.snowsoftware.com/s/group/0F91r000000QUhPCAW/news-updates • CWE-64: Windows Shortcut Following (.LNK) •