CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-22398
https://notcve.org/view.php?id=CVE-2024-22398
14 Mar 2024 — An improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in SonicWall Email Security Appliance could allow a remote attacker with administrative privileges to conduct a directory traversal attack and delete arbitrary files from the appliance file system. Una vulnerabilidad de limitación inadecuada de un nombre de ruta a un directorio restringido (Path Traversal) en SonicWall Email Security Appliance podría permitir que un atacante remoto con privilegios administrativos l... • https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0006 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-23: Relative Path Traversal •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-0655
https://notcve.org/view.php?id=CVE-2023-0655
14 Feb 2023 — SonicWall Email Security contains a vulnerability that could permit a remote unauthenticated attacker access to an error page that includes sensitive information about users email addresses. • https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0002 • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-2324
https://notcve.org/view.php?id=CVE-2022-2324
29 Jul 2022 — Improperly Implemented Security Check vulnerability in the SonicWall Hosted Email Security leads to bypass of Capture ATP security service in the appliance. This vulnerability impacts 10.0.17.7319 and earlier versions Una vulnerabilidad de Comprobación de Seguridad Implementada Inapropiadamente en SonicWall Hosted Email Security conlleva a una omisión del servicio de seguridad Capture ATP en el dispositivo. Esta vulnerabilidad afecta a versiones 10.0.17.7319 y anteriores • https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0014 • CWE-290: Authentication Bypass by Spoofing CWE-358: Improperly Implemented Security Check for Standard •
CVSS: 5.9EPSS: 65%CPEs: 213EXPL: 10CVE-2021-45105 – Apache Log4j2 does not always protect from infinite recursion in lookup evaluation
https://notcve.org/view.php?id=CVE-2021-45105
18 Dec 2021 — Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1. Apache Log4j2 versiones 2.0-alpha1 hasta 2.16.0 (excluyendo las versiones 2.12.3 y 2.3.1) no protegían de la recursión no controlada de las búsquedas autorreferenciales.... • https://github.com/thedevappsecguy/Log4J-Mitigation-CVE-2021-44228--CVE-2021-45046--CVE-2021-45105--CVE-2021-44832 • CWE-20: Improper Input Validation CWE-674: Uncontrolled Recursion •
CVSS: 9.0EPSS: 94%CPEs: 96EXPL: 13CVE-2021-45046 – Apache Log4j2 Deserialization of Untrusted Data Vulnerability
https://notcve.org/view.php?id=CVE-2021-45046
14 Dec 2021 — It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some... • https://packetstorm.news/files/id/179987 • CWE-400: Uncontrolled Resource Consumption CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') •
CVSS: 10.0EPSS: 94%CPEs: 398EXPL: 413CVE-2021-44228 – Apache Log4j2 Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-44228
10 Dec 2021 — Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.... • https://packetstorm.news/files/id/171626 • CWE-20: Improper Input Validation CWE-400: Uncontrolled Resource Consumption CWE-502: Deserialization of Untrusted Data CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-20025
https://notcve.org/view.php?id=CVE-2021-20025
13 May 2021 — SonicWall Email Security Virtual Appliance version 10.0.9 and earlier versions contain a default username and a password that is used at initial setup. An attacker could exploit this transitional/temporary user account from the trusted domain to access the Virtual Appliance remotely only when the device is freshly installed and not connected to Mysonicwall. SonicWall Email Security Virtual Appliance versión 10.0.9 y versiones anteriores, contienen un nombre de usuario y una contraseña predeterminada que es ... • https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0012 • CWE-798: Use of Hard-coded Credentials •
CVSS: 9.8EPSS: 58%CPEs: 3EXPL: 0CVE-2021-20023 – SonicWall Email Security Path Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2021-20023
20 Apr 2021 — SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host. SonicWall Email Security versión 10.0.9.x, contiene una vulnerabilidad que permite a un atacante autenticado posteriormente leer un archivo arbitrario en el host remoto SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWa... • https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0010 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 31%CPEs: 2EXPL: 0CVE-2021-20022 – SonicWall Email Security Unrestricted Upload of File Vulnerability
https://notcve.org/view.php?id=CVE-2021-20022
09 Apr 2021 — SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host. SonicWall Email Security versión 10.0.9.x, contiene una vulnerabilidad que permite a un atacante autenticado posteriormente cargar un archivo arbitrario en el host remoto SonicWall Email Security contains an unrestricted upload of file with dangerous type vulnerability that allows a post-authenticated attacker to upload a file to the remote host. This v... • https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0008 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 80%CPEs: 2EXPL: 1CVE-2021-20021 – SonicWall Email Security Improper Privilege Management Vulnerability
https://notcve.org/view.php?id=CVE-2021-20021
09 Apr 2021 — A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. Una vulnerabilidad en SonicWall Email Security versión 10.0.9.x, permite a un atacante crear una cuenta administrativa mediante el envío de una petición HTTP diseñada en el host remoto SonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a... • https://github.com/SUPRAAA-1337/CVE-2021-20021 • CWE-269: Improper Privilege Management •