Vulnerabilities > Checkpoint > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-07-06 | CVE-2020-6013 | Improper Privilege Management vulnerability in Checkpoint Zonealarm Extreme Security ZoneAlarm Firewall and Antivirus products before version 15.8.109.18436 allow an attacker who already has access to the system to execute code at elevated privileges through a combination of file permission manipulation and exploitation of Windows CVE-2020-00896 on unpatched systems. | 6.5 |
| 2019-12-23 | CVE-2019-8463 | Link Following vulnerability in Checkpoint Endpoint Security Clients A denial of service vulnerability was reported in Check Point Endpoint Security Client for Windows before E82.10, that could allow service log file to be written to non-standard locations. | 5.0 |
| 2019-10-02 | CVE-2019-8462 | Improper Handling of Exceptional Conditions vulnerability in Checkpoint Security Gateway R80.30 In a rare scenario, Check Point R80.30 Security Gateway before JHF Take 50 managed by Check Point R80.30 Management crashes with a unique configuration of enhanced logging. | 5.0 |
| 2019-08-29 | CVE-2019-8461 | Untrusted Search Path vulnerability in Checkpoint products Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH location on a clean image without Endpoint Client installed. | 6.8 |
| 2019-04-22 | CVE-2019-8452 | Link Following vulnerability in Checkpoint Endpoint Security and Zonealarm A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security client for Windows before E80.96 to any file on the system will get its permission changed so that all users can access that linked file. | 4.6 |
| 2019-04-09 | CVE-2019-8456 | Unspecified vulnerability in Checkpoint Ipsec VPN R80.10/R80.20 Check Point IKEv2 IPsec VPN up to R80.30, in some less common conditions, may allow an attacker with knowledge of the internal configuration and setup to successfully connect to a site-to-site VPN server. network checkpoint | 4.3 |
| 2014-01-26 | CVE-2014-1673 | Unspecified vulnerability in Checkpoint Session Authentication Agent Check Point Session Authentication Agent allows remote attackers to obtain sensitive information (user credentials) via unspecified vectors. | 5.0 |
| 2014-01-26 | CVE-2014-1672 | Permissions, Privileges, and Access Controls vulnerability in Checkpoint Management Server and Security Gateway Check Point R75.47 Security Gateway and Management Server does not properly enforce Anti-Spoofing when the routing table is modified and the "Get - Interfaces with Topology" action is performed, which allows attackers to bypass intended access restrictions. | 4.0 |
| 2014-01-23 | CVE-2013-7311 | Unspecified vulnerability in Checkpoint Gaia OS and Ipso OS The OSPF implementation in Check Point Gaia OS R75.X and R76 and IPSO OS 6.2 R75.X and R76 does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet, a related issue to CVE-2013-0149. | 5.4 |
| 2014-01-22 | CVE-2013-7304 | Cryptographic Issues vulnerability in Checkpoint Endpoint Security MI Server R73 3.0.0 Check Point Endpoint Security MI Server through R73 3.0.0 HFA2.5 does not configure X.509 certificate validation for client devices, which allows man-in-the-middle attackers to spoof SSL servers by presenting an arbitrary certificate during a session established by a client. | 4.3 |