CPR-Zero

Check Point Research Vulnerability Repository

In the following page you can find vulnerabilities that were discovered by Check Point Research.
These bugs are publicly visible only after a 90-day responsible disclosure standard or once a patch has been released.

CVE / CPR-ID

Title

Upload Date

Microsoft Outlook | Logical fault

Microsoft Message Queuing | Out Of Bound Read (kernel level denial of service)

Microsoft Message Queuing | Out Of Bound Read (application level denial of service)

Microsoft Message Queuing | Out Of Bound Write

Audinate Dante Application Library for Windows | DLL Side Loading

Xiaomi Trusted Execution Environment | Classic Buffer Overflow

Sony OMX audio decoder | Classic Buffer Overflow

Unisoc radio modem | Integer Underflow

Qualcomm OMX audio decoder | Classic Buffer Overflow

MediaTek OMX audio decoder | Improper restriction of operations within the bounds of a memory buffer

MediaTek OMX audio decoder | Improper input validation

MediaTek Audio Aurisys HAL | Improper Input Validation

Mediatek Audio DSP | Heap-based Buffer Overflow

Mediatek Audio DSP | Heap-based Buffer Overflow

Mediatek Audio DSP | Heap-based Buffer Overflow

Amazon Kindle e-reader | Improper Privilege Management

Amazon Kindle e-reader | Integer Overflow leading to Heap-based Buffer Overflow

Qualcomm Data Modem | Buffer Overflow

Qualcomm DSP | Improper Authorization

Qualcomm DSP | Integer Underflow

Qualcomm DSP (ComputerVision) | Buffer Overflow

Qualcomm DSP (ComputerVision) | Untrusted Pointer Dereference

Qualcomm DSP (Video) | Improper Input Validation

Qualcomm DSP (Video) | Untrusted Pointer Dereference

Qualcomm HLOS (Secure Key Storage Trustlet) | Buffer Over-Read

Samsung Android devices (Secure Storage Trustlet) | Integer Underflow

LG Android devices (Discretix Digital Content Protection Trustlet) | Buffer Over-Read

LG Android devices | Potential Phishing Flow in OMACP

Samsung Android devices | Potential Phishing Flow in OMACP

Xiaomi Android devices | Man-In-The-Middle attack leads to RCE

Outlook, Office | Use After Free

Outlook, Office | Stack Based Out of Bound Read

Outlook, Office | Use After Free

Outlook, Office | Stack Based Out of Bound Read

Instagram | Integer Overflow leading to Heap-Based Buffer Overflow

Game Networking Sockets | Integer-Overflow leading to an Out-of-Bounds Read

Game Networking Sockets | Stack-Based Buffer Overflow

Game Networking Sockets | Heap-Based Buffer Overflow

Game Networking Sockets | Free of memory not on the heap

Windows 10 x64 1909 (OS Build 18363.719) | Out Of Bound Read

Windows DNS Server | Integer Overflow leading to Heap-Based Buffer Overflow

Windows 8.1 x64 6.3 (Build 9600) | Use After Free

Windows 10 x64 1909 (OS Build 18363.719) | Out Of Bound Read and Write

Windows 10 x64 1909 | Out Of Bounds Write

Windows 10 x64 1909 | Use After Free

LearnPress | SQL Injection

LearnDash | Unauthenticated Second-Order SQL Injection

LifterLMS | Arbitrary File Write

Windows 10 x64 1909 | Out Of Bounds Read and Write

Apache Guacamole | Use-After-Free (Dangling Pointer)

CVE-2020-9497 (v3)

Apache Guacamole | Out-of-Bounds Read

CVE-2020-9497 (v2)

Apache Guacamole | Out-of-Bounds Read

CVE-2020-9497 (v1)

Apache Guacamole | Out-of-Bounds Read

Azure Stack | Azure Stack Spoofing Vulnerability

Azure App Service | Heap Based Buffer-Overflow in DWASInterop.dll

Windows 10 x64 1903 | Null Pointer Dereference

Windows 10 x64 1903 | Null Pointer Dereference

Microsoft Windows | Path Traversal

OpenBSD | Denial of Service

Philips Hue Bridge 2.X | Heap-Based Buffer Overflow

Windows 10 x64 1903 | Out-Of-Bounds Read\Write

Windows 10 x64 1903 | Use After Free

Windows 10 x64 1809 | Out-Of-Bounds Read

Canon DSLR Cameras | Design Error

Windows 10 x64 1809 | Use After Free

Oracle OutsideIn | Use After Free

Oracle OutsideIn | Out-of-Bounds Memory Access

Oracle OutsideIn | Out-of-Bounds Memory Access

Oracle OutsideIn | Out-of-Bounds Memory Access

Oracle OutsideIn | Out-of-Bounds Memory Access

Oracle OutsideIn | Out-of-Bounds Memory Access

Oracle OutsideIn | Access Violation

Apple iOS \ macOS | Untrusted pointer dereference leads to Code Execution

Apple iOS \ macOS | Heap-Based Buffer Oveflow leading to RCE

Apple iOS \ macOS | Persistencey and Privilege Escalation

Apple iOS \ macOS | Info Leak

Canon DSLR Cameras | Stack-Based Buffer Overflow

Canon DSLR Cameras | Stack-Based Buffer Overflow

Canon DSLR Cameras | Heap-Based Buffer Overflow

Canon DSLR Cameras | Stack-Based Buffer Overflow

Canon DSLR Cameras | Buffer Overflow over the Globals

MuPDF | Null Dereference

Acrobat Reader DC | Out-Of-Bounds Read

Acrobat Reader DC | Double Free

MuPDF | Floating Point exception (div by zero)

MuPDF | Stack-Based Buffer Overflow

MuPDF | Arbitrary Read/Write

MuPDF | Stack-Based Buffer Overflow

Microsoft Office Equation Editor (2007 to 2016) | Stack based buffer overflow

Microsoft Edge (Windows.Data.Pdf.dll) | Out-Of-Bounds read

Acrobat Reader DC | Out-Of-Bounds Read

Acrobat Reader DC | Out-Of-Bound Write

Acrobat Reader DC | Out-Of-Bounds Read

Acrobat Reader DC | Out-Of-Bounds Read

Acrobat Reader DC | Out-Of-Bounds Write

Acrobat Reader DC | Out-Of-Bounds Write

Acrobat Reader DC | Out-Of-Bounds Read

Acrobat Reader DC | Out-Of-Bounds Write

Acrobat Reader DC | Out-Of-Bounds Write

Acrobat Reader DC | Out-Of-Bounds Write

Acrobat Reader DC | Out-Of-Bounds Write

Acrobat Reader DC | Out-Of-Bounds Read

Acrobat Reader DC | Out-Of-Bounds Write

Acrobat Reader DC | Out-Of-Bounds Read

Acrobat Reader DC | Out-Of-Bounds Write

Acrobat Reader DC | Out-Of-Bounds Read

Acrobat Reader DC | stack based overflow

Acrobat Reader DC | Out-Of-Bounds Write

Acrobat Reader DC | Out-Of-Bounds Write

Acrobat Reader DC | Out-Of-Bounds Read

Acrobat Reader DC | Out-Of-Bounds Read

Acrobat Reader DC | Out-Of-Bounds Read

Acrobat Reader DC | Out-Of-Bounds Write

Acrobat DC | Out-Of-Bounds Read

Acrobat DC | Out-Of-Bounds Read

Acrobat DC | Out-Of-Bounds Write

Acrobat DC | Out-Of-Bounds Write

Acrobat DC | Out-Of-Bounds Read

Acrobat DC | Out-Of-Bounds Write

Acrobat DC | Out-Of-Bounds Write

Acrobat DC | Out-Of-Bounds Write

Acrobat DC | Out-Of-Bounds Read

Acrobat DC | Out-Of-Bounds Read

Acrobat DC | Out-Of-Bounds Read

Acrobat DC | Out-Of-Bounds Read

Acrobat DC | Out-Of-Bounds Write

Acrobat Reader DC | Out-Of-Bounds Read

Acrobat Reader DC | Out-Of-Bounds Read

Acrobat Reader DC | Out-Of-Bounds Write

Acrobat Reader DC | Out-Of-Bounds Read

Acrobat Reader DC | Out-Of-Bounds Write

Acrobat Reader DC | Out-Of-Bounds Read

Acrobat Reader DC | Out of bound read

Acrobat Reader DC | Out-Of-Bounds Write

Acrobat Reader DC | Out-Of-Bounds Write

Acrobat Reader DC | Out-Of-Bounds Write

Acrobat Reader DC | Out-Of-Bounds Write

Acrobat Reader DC | Out-Of-Bounds Read

Acrobat Reader DC | Read after free

Acrobat Reader DC | Out-Of-Bounds Write

Acrobat Reader DC | Out-Of-Bounds Read

Acrobat Reader DC | Out-Of-Bounds Read

Foxit Quick PDF | Out of Bounds Memory Access

Foxit Quick PDF | Out of Bounds Memory Access

Foxit Quick PDF | Stack Overflow

WinRAR | Protection Mechanism Failure

WinRAR | Absolute Path Traversal

WinRAR | Use After Free

WinRAR | Out-Of-Bound Write

WinRAR | Out-Of-Bound Write

libvpx | Use-After-Free

rdesktop | Globals-Based Buffer Overflow

rdesktop | Integer Underflow leading to Heap-Based Buffer Overflow

rdesktop | Integer Underflow leading to Heap-Based Buffer Overflow

rdesktop | Integer-Underflow leading to Heap-Based Buffer Overflow

rdesktop | Out-Of-Bounds Read

rdesktop | Integer-Overflow leading to Heap-Based Buffer Overflow

rdesktop | Out-Of-Bounds Read

rdesktop | Integer Signedness Error

rdesktop | Heap-Based Buffer Over-Read leading to Information Leak

rdesktop | Heap-Based Buffer Overflow

rdesktop | Out-Of-Bounds Read

rdesktop | Out-Of-Bounds Read leading to information leak

rdesktop | Heap-Based Buffer Overflow

rdesktop | Out-Of-Bounds Read

rdesktop | Integer-Overflow leading to Out-Of-Bounds Write

rdesktop | Integer-Overflow leading to Out-Of-Bounds Write

rdesktop | Heap-Based Buffer Overflow

rdesktop | Out-Of-Bounds Read

rdesktop | Out-Of-Bounds Read leading to information leak

MSTSC.exe | Black List Bypass

MSTSC.exe | Path Traversal

FreeRDP | Out-Of-Bounds Reads

FreeRDP | Out-Of-Bounds Write

FreeRDP | Integer Overflow leading to a Heap-Based Buffer Overflow

FreeRDP | Integer Truncation leading to RCE

FreeRDP | Heap-Based Buffer Overflow

FreeRDP | Heap-Based Buffer Overflow

HP InkJet Printers | Globals Buffer Overflow

HP InkJet Printers | Stack-Based Buffer Overflow leading to RCE

Linux Kernel | Integer Overflow leading to Local Privilege Escalation

Xiaomi Android devices | Man-In-The-Disk attack leads to LPE

Multiple PDF Readers | NTLMv2 hash leakage leads to credential theft

LG Android devices | Man-In-The-Middle attack due to path-traversal vulnerability leads to RCE

LG Android devices | Man-In-The-Disk attack leads to LPE

LG Android devices | Man-In-The-Disk attack leads to LPE

Android devices | Man-In-The-Disk attack leads to DoS

Android devices | Man-In-The-Disk attack leads to DoS

Nexus 5, 5X, 6, 6P, and 7 (2013) devices | LPE

Android devices based on Qualcomm chipset | LPE

Nexus 5X and 6P devices | Use after free due to race conditions leads to LPE

Android devices based on Qualcomm chipset | Race condition flaw leads to LPE

TrendMicro-Premium10 | DOS - lack of usermod-input validation of the IOCTL (I/O Control Code)

Palo Alto Networks PAN-OS | Cross-site scripting

Palo Alto Networks PAN-OS | Local privilege escalation

Cisco FireSIGHT | Bypass malware protection

iOS | Information Disclosure

Windows Deployment Services | Use-After-Free Leads to RCE

Eclipse | XML External Entity attack (XXE)

Eclipse | XML External Entity attack (XXE)

Kodi | Directory Traversal leading to RCE

VLC | Heap out-of-bound read

VLC | Heap out-of-bound read

VLC | Potential heap based buffer leads to RCE

VLC | Heap Out-of-Bound Read leads to DoS

PHP | PHP-7 unserialize Use of Uninitialized Value

PHP | PHP-7 unserialize UAF

PHP | PHP unserialize remote DoS

Vulnerabilities #: 208 | List ordered by CPR-ID [descending]