Kaspersky Lab vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2019-8280 UltraVNC revision 1203 has out-of-bounds access vulnerability in VNC client inside RAW decoder, which can potentially result code execution.Critical 9.8 · Mar 8, 2019
• CVE-2019-8277 UltraVNC revision 1211 contains multiple memory leaks (CWE-665) in VNC server code, which allows an attacker to read stack memory and can be abused for informatHigh 7.5 · Mar 8, 2019
• CVE-2019-8276 UltraVNC revision 1211 has a stack buffer overflow vulnerability in VNC server code inside file transfer request handler, which can result in Denial of Service High 7.5 · Mar 8, 2019
• CVE-2019-8275 UltraVNC revision 1211 has multiple improper null termination vulnerabilities in VNC server code, which result in out-of-bound data being accessed by remote useCritical 9.8 · Mar 8, 2019
• CVE-2019-8274 UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer offer handler, which can potentially in result code execCritical 9.8 · Mar 8, 2019
• CVE-2019-8273 UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer request handler, which can potentially result in code exCritical 9.8 · Mar 8, 2019
• CVE-2019-8272 UltraVNC revision 1211 has multiple off-by-one vulnerabilities in VNC server code, which can potentially result in code execution.Critical 9.8 · Mar 8, 2019
• CVE-2019-8271 UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer handler, which can potentially result code execution.Critical 9.8 · Mar 8, 2019
• CVE-2019-8270 UltraVNC revision 1210 has out-of-bounds read vulnerability in VNC client code inside Ultra decoder, which results in a denial of service (DoS) condition.High 7.5 · Mar 8, 2019
• CVE-2019-8269 UltraVNC revision 1206 has stack-based Buffer overflow vulnerability in VNC client code inside FileTransfer module, which leads to a denial of service (DoS) conHigh 7.5 · Mar 8, 2019
• CVE-2019-8268 UltraVNC revision 1206 has multiple off-by-one vulnerabilities in VNC client code connected with improper usage of ClientConnection::ReadString function, which Critical 9.8 · Mar 8, 2019
• CVE-2019-8267 UltraVNC revision 1207 has out-of-bounds read vulnerability in VNC client code inside TextChat module, which results in a denial of service (DoS) condition.High 7.5 · Mar 8, 2019
• CVE-2019-8266 UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of ClientConnection::Copybuffer function in VNC client coCritical 9.8 · Mar 8, 2019
• CVE-2019-8265 UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of SETPIXELS macro in VNC client code, which can potentiaCritical 9.8 · Mar 8, 2019
• CVE-2019-8264 UltraVNC revision 1203 has out-of-bounds access vulnerability in VNC client inside Ultra2 decoder, which can potentially result in code execution.Critical 9.8 · Mar 8, 2019
• CVE-2018-20026 Improper Communication Address Filtering exists in CODESYS V3 products versions prior V3.5.14.0.High 7.5 · Feb 19, 2019
• CVE-2018-20025 Use of Insufficiently Random Values exists in CODESYS V3 products versions prior V3.5.14.0.High 7.5 · Feb 19, 2019
• CVE-2018-15360 An attacker without authentication can login with default credentials for privileged users in Eltex ESP-200 firmware version 1.2.0.High 7.3 · Aug 17, 2018
• CVE-2018-15359 An authenticated attacker with low privileges can use insecure sudo configuration to expand attack surface in Eltex ESP-200 firmware version 1.2.0.High 8.8 · Aug 17, 2018
• CVE-2018-15358 An authenticated attacker with low privileges can activate high privileged user and use it to expand attack surface in Eltex ESP-200 firmware version 1.2.0.High 8.8 · Aug 17, 2018
• CVE-2018-15356 An authenticated attacker can execute arbitrary code using command ejection in Eltex ESP-200 firmware version 1.2.0.High 8.8 · Aug 17, 2018
• CVE-2018-15354 A Buffer Overflow exploited through web interface by remote attacker can cause denial of service in Kraftway 24F2XG Router firmware 3.5.30.1118.High 7.5 · Aug 17, 2018
• CVE-2018-15353 A Buffer Overflow exploited through web interface by remote attacker can cause remote code execution in Kraftway 24F2XG Router firmware 3.5.30.1118.Critical 9.8 · Aug 17, 2018
• CVE-2018-15350 Router Default Credentials in Kraftway 24F2XG Router firmware version 3.5.30.1118 allow remote attackers to get privileged access to the router.Critical 9.8 · Aug 17, 2018
• CVE-2018-15125 Sensitive Information Disclosure in Zipato Zipabox Smart Home Controller allows remote attacker get sensitive information that expands attack surface.High 7.5 · Aug 13, 2018