https://vulnogram.org/ Most recent CVEs assigned by Kaspersky (kaspersky). https://vulnogram.org/seaview/icons/kaspersky.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-2334 https://vulnogram.org/CVE-2026-2334 An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to a lack of server-side validation. This allows the upload of an arbitr… Critical Thu, 20 Aug 2026 18:03:38 GMT https://vulnogram.org/CVE-2025-14601 https://vulnogram.org/CVE-2025-14601 An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering. An attacker can exploit this flaw to disrupt web serve… High Thu, 20 Aug 2026 07:21:26 GMT https://vulnogram.org/CVE-2025-14602 https://vulnogram.org/CVE-2025-14602 The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a remote attacker to accurately guess or brute-force the generated filename within a short time window. An attacker can succ… Medium Thu, 20 Aug 2026 06:39:04 GMT https://vulnogram.org/CVE-2025-14600 https://vulnogram.org/CVE-2025-14600 An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server… Critical Network Exploitable Wed, 19 Aug 2026 17:39:42 GMT https://vulnogram.org/CVE-2025-14603 https://vulnogram.org/CVE-2025-14603 The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive. Apply patch from ve… High Network Exploitable Wed, 19 Aug 2026 17:16:08 GMT https://vulnogram.org/CVE-2026-72530 https://vulnogram.org/CVE-2026-72530 A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute… Critical Known Exploited Wed, 19 Aug 2026 16:56:53 GMT https://vulnogram.org/CVE-2026-72529 https://vulnogram.org/CVE-2026-72529 A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function. Critical Known Exploited Wed, 19 Aug 2026 16:55:14 GMT https://vulnogram.org/CVE-2024-13942 https://vulnogram.org/CVE-2024-13942 Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media (SPI NOR or NAND, EMMC or SD). The code reads the header of the next-stage loader twice. The header contains hashes of the exe… High Wed, 19 Aug 2026 16:40:18 GMT https://vulnogram.org/CVE-2026-8398 https://vulnogram.org/CVE-2026-8398 A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026… Critical Known Exploited Fri, 15 May 2026 07:30:29 GMT https://vulnogram.org/CVE-2025-64984 https://vulnogram.org/CVE-2025-64984 Kaspersky has fixed a security issue in Kaspersky Endpoint Security for Linux (any version with anti-virus databases prior to 18.11.2025), Kaspersky Industrial CyberSecurity for Linux Nodes (any version with anti-virus databases prior to 18.11.2025),… Medium Thu, 20 Nov 2025 06:53:39 GMT https://vulnogram.org/CVE-2025-9060 https://vulnogram.org/CVE-2025-9060 A vulnerability has been found in the MSoft MFlash application that allows execution of arbitrary code on the server. The issue occurs in the integration configuration functionality that is only available to MFlash administrators. The vulnerability i… Critical Fri, 15 Aug 2025 16:25:21 GMT https://vulnogram.org/CVE-2025-7771 https://vulnogram.org/CVE-2025-7771 ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to pat… High Wed, 06 Aug 2025 09:35:00 GMT https://vulnogram.org/CVE-2024-13614 https://vulnogram.org/CVE-2024-13614 Kaspersky has fixed a security issue in Kaspersky Anti-Virus SDK for Windows, Kaspersky Security for Virtualization Light Agent, Kaspersky Endpoint Security for Windows, Kaspersky Small Office Security, Kaspersky for Windows (Standard, Plus, Premium)… Medium Thu, 06 Feb 2025 16:13:08 GMT https://vulnogram.org/CVE-2019-15690 https://vulnogram.org/CVE-2019-15690 LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape() function in libvncclient/cursor.c. An attacker sends cursor shapes with specially crafted dimensions, which can result in remote code e… High Network Exploitable Fri, 24 Jan 2025 17:53:58 GMT https://vulnogram.org/CVE-2024-8653 https://vulnogram.org/CVE-2024-8653 A vulnerability in NetCat CMS allows an attacker to execute JavaScript code in a user's browser when they visit specific paths on the site. This issue affects NetCat CMS v. 6.4.0.24126.2 and possibly others. Apply patch from vendor https://netcat.ru/… Medium Network Exploitable Thu, 19 Sep 2024 16:39:23 GMT https://vulnogram.org/CVE-2024-8652 https://vulnogram.org/CVE-2024-8652 A vulnerability in NetCat CMS allows an attacker to execute JavaScript code in a user's browser when they visit specific path on the site. This issue affects NetCat CMS v. 6.4.0.24126.2 and possibly others. Apply patch from vendor https://netcat.ru/… Medium Network Exploitable Thu, 19 Sep 2024 16:35:55 GMT https://vulnogram.org/CVE-2024-8651 https://vulnogram.org/CVE-2024-8651 A vulnerability in NetCat CMS allows an attacker to send a specially crafted http request that can be used to check whether a user exists in the system, which could be a basis for further attacks. This issue affects NetCat CMS v. 6.4.0.24126.2 and po… Medium Network Exploitable Thu, 19 Sep 2024 16:30:10 GMT https://vulnogram.org/CVE-2024-5866 https://vulnogram.org/CVE-2024-5866 Vulnerability in Delinea Centrify PAS v. 21.3 and possibly others. The application is prone to the path traversal vulnerability allowing listing of arbitrary directory outside the root directory of the web application. Versions 23.1-HF7 and on have t… Medium Tue, 02 Jul 2024 15:58:35 GMT https://vulnogram.org/CVE-2024-5865 https://vulnogram.org/CVE-2024-5865 Vulnerability in Delinea Centrify PAS v. 21.3 and possibly others. The application is prone to the path traversal vulnerability allowing arbitrary files reading outside the web publish directory. Versions 23.1-HF7 and on have the patch. High Tue, 02 Jul 2024 15:55:23 GMT https://vulnogram.org/CVE-2023-3943 https://vulnogram.org/CVE-2023-3943 Stack-based Buffer Overflow vulnerability in ZkTeco-based OEM devices allows, in some cases, the execution of arbitrary code. Due to the lack of protection mechanisms such as stack canaries and PIE, it is possible to successfully execute code even un… Critical Network Exploitable Tue, 21 May 2024 13:32:47 GMT https://vulnogram.org/CVE-2023-3942 https://vulnogram.org/CVE-2023-3942 An 'SQL Injection' vulnerability, due to improper neutralization of special elements used in SQL commands, exists in ZKTeco-based OEM devices. This vulnerability allows an attacker to, in some cases, impersonate another user or perform unauthorized a… High Network Exploitable Tue, 21 May 2024 12:23:49 GMT https://vulnogram.org/CVE-2023-3941 https://vulnogram.org/CVE-2023-3941 Relative Path Traversal vulnerability in ZkTeco-based OEM devices allows an attacker to write any file on the system with root privileges. This issue affects ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibl… Critical Network Exploitable Tue, 21 May 2024 10:20:39 GMT https://vulnogram.org/CVE-2023-3940 https://vulnogram.org/CVE-2023-3940 Relative Path Traversal vulnerability in ZkTeco-based OEM devices allows an attacker to access any file on the system. This issue affects ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others) with the Z… High Network Exploitable Tue, 21 May 2024 10:15:52 GMT https://vulnogram.org/CVE-2023-3939 https://vulnogram.org/CVE-2023-3939 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in ZkTeco-based OEM devices allows OS Command Injection. Since all the found command implementations are executed from the superuser, their impac… Critical Network Exploitable Tue, 21 May 2024 09:45:00 GMT https://vulnogram.org/CVE-2023-3938 https://vulnogram.org/CVE-2023-3938 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ZkTeco-based OEM devices allows an attacker to authenticate under any user from the device database. This issue affects ZkTeco-based OEM devices (Zk… Medium Tue, 21 May 2024 09:32:15 GMT https://vulnogram.org/CVE-2023-23349 https://vulnogram.org/CVE-2023-23349 Kaspersky has fixed a security issue in Kaspersky Password Manager (KPM) for Windows that allowed a local user to recover the auto-filled credentials from a memory dump when the KPM extension for Google Chrome is used. To exploit the issue, an attack… Low Fri, 22 Mar 2024 16:15:55 GMT https://vulnogram.org/CVE-2024-1619 https://vulnogram.org/CVE-2024-1619 Kaspersky has fixed a security issue in the Kaspersky Security 8.0 for Linux Mail Server. The issue was that an attacker could potentially force an administrator to click on a malicious link to perform unauthorized actions. Medium Network Exploitable Thu, 29 Feb 2024 09:22:03 GMT https://vulnogram.org/CVE-2023-47611 https://vulnogram.org/CVE-2023-47611 A CWE-269: Improper Privilege Management vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow a local, low privileged attacker to elevate pr… High Fri, 10 Nov 2023 16:38:54 GMT https://vulnogram.org/CVE-2023-47614 https://vulnogram.org/CVE-2023-47614 A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow a local, low priv… Low Fri, 10 Nov 2023 15:50:24 GMT https://vulnogram.org/CVE-2023-47610 https://vulnogram.org/CVE-2023-47610 A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists in Telit Cinterion EHS5/6/8 that could allow a remote unauthenticated attacker to execute arbitrary code on the targeted system by sending a specially crafted SMS message. High Network Exploitable Thu, 09 Nov 2023 17:05:38 GMT https://vulnogram.org/CVE-2023-47615 https://vulnogram.org/CVE-2023-47615 A CWE-526: Exposure of Sensitive Information Through Environmental Variables vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow a local, l… Low Thu, 09 Nov 2023 12:47:43 GMT https://vulnogram.org/CVE-2023-47616 https://vulnogram.org/CVE-2023-47616 A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow an attacker with… Low Thu, 09 Nov 2023 12:24:33 GMT https://vulnogram.org/CVE-2023-47612 https://vulnogram.org/CVE-2023-47612 A CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow an attacker with physica… Medium Thu, 09 Nov 2023 12:07:54 GMT https://vulnogram.org/CVE-2023-47613 https://vulnogram.org/CVE-2023-47613 A CWE-23: Relative Path Traversal vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow a local, low privileged attacker to escape from virtu… Medium Thu, 09 Nov 2023 06:32:08 GMT https://vulnogram.org/CVE-2022-27535 https://vulnogram.org/CVE-2022-27535 Kaspersky VPN Secure Connection for Windows version up to 21.5 was vulnerable to arbitrary file deletion via abuse of its 'Delete All Service Data And Reports' feature by the local authenticated attacker. Fri, 05 Aug 2022 16:47:46 GMT https://vulnogram.org/CVE-2022-27534 https://vulnogram.org/CVE-2022-27534 Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security with antivirus databases released before 12 March 2022 had a bug in a data parsing module that potentially allowed an attacker to execute arbitrary code. The fix was delivered aut… Fri, 01 Apr 2022 22:17:49 GMT https://vulnogram.org/CVE-2021-27223 https://vulnogram.org/CVE-2021-27223 A denial-of-service issue existed in one of modules that was incorporated in Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security. A local user could cause Windows crash by running a specially crafted binary module. The fix was deli… Fri, 01 Apr 2022 22:17:48 GMT https://vulnogram.org/CVE-2021-35052 https://vulnogram.org/CVE-2021-35052 A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High. Tue, 23 Nov 2021 15:30:38 GMT https://vulnogram.org/CVE-2021-35053 https://vulnogram.org/CVE-2021-35053 Possible system denial of service in case of arbitrary changing Firefox browser parameters. An attacker could change specific Firefox browser parameters file in a certain way and then reboot the system to make the system unbootable. Wed, 03 Nov 2021 19:11:26 GMT https://vulnogram.org/CVE-2020-27185 https://vulnogram.org/CVE-2020-27185 Cleartext transmission of sensitive information via Moxa Service in NPort IA5000A series serial devices. Successfully exploiting the vulnerability could enable attackers to read authentication data, device configuration, and other sensitive data tran… Fri, 14 May 2021 12:06:20 GMT https://vulnogram.org/CVE-2020-27184 https://vulnogram.org/CVE-2020-27184 The NPort IA5000A Series devices use Telnet as one of the network device management services. Telnet does not support the encryption of client-server communications, making it vulnerable to Man-in-the-Middle attacks. Fri, 14 May 2021 12:06:15 GMT https://vulnogram.org/CVE-2020-27150 https://vulnogram.org/CVE-2020-27150 In multiple versions of NPort IA5000A Series, the result of exporting a device’s configuration contains the passwords of all users on the system and other sensitive data in the original form if “Pre-shared key” doesn’t set. Fri, 14 May 2021 11:13:41 GMT https://vulnogram.org/CVE-2020-27149 https://vulnogram.org/CVE-2020-27149 By exploiting a vulnerability in NPort IA5150A/IA5250A Series before version 1.5, a user with “Read Only” privilege level can send requests via the web console to have the device’s configuration changed. Fri, 14 May 2021 11:13:37 GMT https://vulnogram.org/CVE-2020-27020 https://vulnogram.org/CVE-2020-27020 Password generator feature in Kaspersky Password Manager was not completely cryptographically strong and potentially allowed an attacker to predict generated passwords in some cases. An attacker would need to know some additional information (for exa… Fri, 14 May 2021 11:00:04 GMT https://vulnogram.org/CVE-2021-26718 https://vulnogram.org/CVE-2021-26718 KIS for macOS in some use cases was vulnerable to AV bypass that potentially allowed an attacker to disable anti-virus protection. Thu, 01 Apr 2021 18:00:59 GMT https://vulnogram.org/CVE-2020-26200 https://vulnogram.org/CVE-2020-26200 A component of Kaspersky custom boot loader allowed loading of untrusted UEFI modules due to insufficient check of their authenticity. This component is incorporated in Kaspersky Rescue Disk (KRD) and was trusted by the Authentication Agent of Full D… Fri, 26 Feb 2021 13:30:23 GMT https://vulnogram.org/CVE-2020-36200 https://vulnogram.org/CVE-2020-36200 TinyCheck before commits 9fd360d and ea53de8 allowed an authenticated attacker to send an HTTP GET request to the crafted URLs. Thu, 21 Jan 2021 21:23:00 GMT https://vulnogram.org/CVE-2020-36199 https://vulnogram.org/CVE-2020-36199 TinyCheck before commits 9fd360d and ea53de8 was vulnerable to command injection due to insufficient checks of input parameters in several places. Thu, 21 Jan 2021 21:20:28 GMT https://vulnogram.org/CVE-2020-35929 https://vulnogram.org/CVE-2020-35929 In TinyCheck before commits 9fd360d and ea53de8, the installation script of the tool contained hard-coded credentials to the backend part of the tool. This information could be used by an attacker for unauthorized access to remote data. Tue, 19 Jan 2021 16:53:36 GMT https://vulnogram.org/CVE-2020-28950 https://vulnogram.org/CVE-2020-28950 The installer of Kaspersky Anti-Ransomware Tool (KART) prior to KART 4.0 Patch C was vulnerable to a DLL hijacking attack that allowed an attacker to elevate privileges during installation process. Fri, 04 Dec 2020 21:11:56 GMT