Filtered by vendor Checkpoint
Subscribe
Total
119 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-23746 | 1 Checkpoint | 1 Ssl Network Extender | 2022-12-06 | N/A | 7.5 HIGH |
| The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender (SNX). If the portal is configured for username/password authentication, it is vulnerable to a brute-force attack on usernames and passwords. | |||||
| CVE-2020-6020 | 1 Checkpoint | 1 Ica Management Portal | 2022-11-16 | 7.4 HIGH | 6.4 MEDIUM |
| Check Point Security Management's Internal CA web management before Jumbo HFAs R80.10 Take 278, R80.20 Take 160, R80.30 Take 210, and R80.40 Take 38, can be manipulated to run commands as a high privileged user or crash, due to weak input validation on inputs by a trusted management administrator. | |||||
| CVE-2022-41604 | 1 Checkpoint | 1 Zonealarm | 2022-09-30 | N/A | 8.8 HIGH |
| Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. This occurs because of weak permissions for the %PROGRAMDATA%\CheckPoint\ZoneAlarm\Data\Updates directory, and a self-protection driver bypass that allows creation of a junction directory. This can be leveraged to perform an arbitrary file move as NT AUTHORITY\SYSTEM. | |||||
| CVE-2022-23745 | 1 Checkpoint | 1 Capsule Workspace | 2022-07-25 | N/A | 7.5 HIGH |
| A potential memory corruption issue was found in Capsule Workspace Android app (running on GrapheneOS). This could result in application crashing but could not be used to gather any sensitive information. | |||||
| CVE-2022-23744 | 1 Checkpoint | 2 Endpoint Security, Harmony Endpoint | 2022-07-15 | 2.1 LOW | 2.3 LOW |
| Check Point Endpoint before version E86.50 failed to protect against specific registry change which allowed to disable endpoint protection by a local administrator. | |||||
| CVE-2021-30361 | 1 Checkpoint | 4 Gaia Os, Gaia Portal, Quantum Security Gateway and 1 more | 2022-05-25 | 6.9 MEDIUM | 6.7 MEDIUM |
| The Check Point Gaia Portal's GUI Clients allowed authenticated administrators with permission for the GUI Clients settings to inject a command that would run on the Gaia OS. | |||||
| CVE-2021-30360 | 1 Checkpoint | 1 Endpoint Security | 2022-01-14 | 7.2 HIGH | 7.8 HIGH |
| Users have access to the directory where the installation repair occurs. Since the MS Installer allows regular users to run the repair, an attacker can initiate the installation repair and place a specially crafted EXE in the repair folder which runs with the Check Point Remote Access Client privileges. | |||||
| CVE-2004-0081 | 23 4d, Apple, Avaya and 20 more | 66 Webstar, Mac Os X, Mac Os X Server and 63 more | 2021-11-08 | 5.0 MEDIUM | N/A |
| OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service (infinite loop), as demonstrated using the Codenomicon TLS Test Tool. | |||||
| CVE-2020-6021 | 1 Checkpoint | 1 Endpoint Security | 2021-11-05 | 4.4 MEDIUM | 7.8 HIGH |
| Check Point Endpoint Security Client for Windows before version E84.20 allows write access to the directory from which the installation repair takes place. Since the MS Installer allows regular users to run the repair, an attacker can initiate the installation repair and place a specially crafted DLL in the repair folder which will run with the Endpoint client’s privileges. | |||||
| CVE-2021-30359 | 2 Checkpoint, Microsoft | 3 Harmony Browse, Sandblast Agent For Browsers, Windows | 2021-10-27 | 7.2 HIGH | 7.8 HIGH |
| The Harmony Browse and the SandBlast Agent for Browsers installers must have admin privileges to execute some steps during the installation. Because the MS Installer allows regular users to repair their installation, an attacker running an installer before 90.08.7405 can start the installation repair and place a specially crafted binary in the repair folder, which runs with the admin privileges. | |||||
| CVE-2021-30358 | 1 Checkpoint | 1 Mobile Access Portal Agent | 2021-10-22 | 6.0 MEDIUM | 7.2 HIGH |
| Mobile Access Portal Native Applications who's path is defined by the administrator with environment variables may run applications from other locations by the Mobile Access Portal Agent. | |||||
| CVE-2021-30357 | 1 Checkpoint | 1 Ssl Network Extender | 2021-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| SSL Network Extender Client for Linux before build 800008302 reveals part of the contents of the configuration file supplied, which allows partially disclosing files to which the user did not have access. | |||||
| CVE-2021-30356 | 1 Checkpoint | 1 Identity Agent | 2021-04-27 | 5.5 MEDIUM | 8.1 HIGH |
| A denial of service vulnerability was reported in Check Point Identity Agent before R81.018.0000, which could allow low privileged users to overwrite protected system files. | |||||
| CVE-2020-6024 | 1 Checkpoint | 1 Smartconsole | 2021-02-02 | 4.6 MEDIUM | 7.8 HIGH |
| Check Point SmartConsole before R80.10 Build 185, R80.20 Build 119, R80.30 before Build 94, R80.40 before Build 415, and R81 before Build 548 were vulnerable to a possible local privilege escalation due to running executables from a directory with write access to all authenticated users. | |||||
| CVE-2020-6014 | 1 Checkpoint | 1 Endpoint Security | 2020-11-19 | 4.4 MEDIUM | 6.5 MEDIUM |
| Check Point Endpoint Security Client for Windows, with Anti-Bot or Threat Emulation blades installed, before version E83.20, tries to load a non-existent DLL during a query for the Domain Name. An attacker with administrator privileges can leverage this to gain code execution within a Check Point Software Technologies signed binary, where under certain circumstances may cause the client to terminate. | |||||
| CVE-2020-6015 | 1 Checkpoint | 1 Endpoint Security | 2020-11-17 | 2.1 LOW | 5.5 MEDIUM |
| Check Point Endpoint Security for Windows before E84.10 can reach denial of service during clean install of the client which will prevent the storage of service log files in non-standard locations. | |||||
| CVE-2020-6023 | 1 Checkpoint | 1 Zonealarm | 2020-10-27 | 4.6 MEDIUM | 7.8 HIGH |
| Check Point ZoneAlarm before version 15.8.139.18543 allows a local actor to escalate privileges while restoring files in Anti-Ransomware. | |||||
| CVE-2020-6022 | 1 Checkpoint | 1 Zonealarm | 2020-10-27 | 3.6 LOW | 5.5 MEDIUM |
| Check Point ZoneAlarm before version 15.8.139.18543 allows a local actor to delete arbitrary files while restoring files in Anti-Ransomware. | |||||
| CVE-2019-8458 | 1 Checkpoint | 3 Capsule Docs, Endpoint Security Clients, Remote Access Clients | 2020-10-22 | 3.5 LOW | 4.4 MEDIUM |
| Check Point Endpoint Security Client for Windows, with Anti-Malware blade installed, before version E81.00, tries to load a non-existent DLL during an update initiated by the UI. An attacker with administrator privileges can leverage this to gain code execution within a Check Point Software Technologies signed binary, where under certain circumstances may cause the client to terminate. | |||||
| CVE-2019-8452 | 1 Checkpoint | 2 Endpoint Security, Zonealarm | 2020-10-22 | 4.6 MEDIUM | 7.8 HIGH |
| A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security client for Windows before E80.96 to any file on the system will get its permission changed so that all users can access that linked file. Doing this on files with limited access gains the local attacker higher privileges to the file. | |||||