SG
Product
Secure Global Desktop
On CISA KEVExploited in the wildRansomware-linked
32
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 11High 5Medium 12Low 0
Watch
Add Secure Global Desktop to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-40438 RansomwareIn wildKEV | 9.0 | Sep 16 | mod_proxy SSRF Affected: 5.6 |
| CVE-2021-2248 | 10.0 | Apr 22 | Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Server) Affected: 5.6 |
| CVE-2021-2177 | 10.0 | Apr 22 | Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Gateway) Affected: 5.6 |
| CVE-2021-2447 | 9.9 | Jul 21 | Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Server) Affected: 5.6 |
| CVE-2019-3822 | 9.8 | Feb 6 | libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow Affected: 5.4 |
| CVE-2017-3167 | 9.8 | Jun 20 | In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to… Affected: 5.3 |
| CVE-2016-3613 | 9.8 | Jul 21 | Unspecified vulnerability in the Oracle Secure Global Desktop component in Oracle Virtualization 4.63, 4.71, and 5.2 allows remote attackers to affect confidentiality, integrity,… Affected: 4.63; 4.71; 5.2 |
| CVE-2021-2446 | 9.6 | Jul 21 | Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Client) Affected: 5.6 |
| CVE-2021-2221 | 9.6 | Apr 22 | Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Client) Affected: 5.6 |
| CVE-2016-5580 | 9.6 | Oct 25 | Unspecified vulnerability in the Secure Global Desktop component in Oracle Virtualization 4.7 and 5.2 allows remote authenticated users to affect confidentiality and availability… Affected: 4.7; 5.2 |
| CVE-2017-9788 | 9.1 | Jul 13 | In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between… Affected: 5.3 |
| CVE-2019-0227 | 7.5 | May 1 | A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006 Affected: 5.4; 5.5 |
| CVE-2018-16890 | 7.5 | Feb 6 | libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read Affected: 5.4 |
| CVE-2019-3823 | 7.5 | Feb 6 | libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP Affected: 5.4 |
| CVE-2017-7668 | 7.5 | Jun 20 | The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input… Affected: 5.3 |
| CVE-2021-3450 | 7.4 | Mar 25 | CA certificate check bypass with X509_V_FLAG_X509_STRICT Affected: 5.6 |
| CVE-2019-17091 | 6.1 | Oct 2 | faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS… Affected: 5.4; 5.5 |
| CVE-2019-10092 | 6.1 | Sep 26 | In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page Affected: 5.4; 5.5 |
| CVE-2018-19439 | 6.1 | Dec 13 | XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4) Affected: 4.4 |
| CVE-2018-8032 | 6.1 | Aug 2 | Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services Affected: 5.4; 5.5 |
| CVE-2021-3449 | 5.9 | Mar 25 | NULL pointer deref in signature_algorithms processing Affected: 5.6 |
| CVE-2018-0735 | 5.9 | Oct 29 | Timing attack against ECDSA signature generation Affected: 5.4 |
| CVE-2018-11763 | 5.9 | Sep 25 | In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout… Affected: 5.4 |
| CVE-2018-1304 | 5.9 | Feb 28 | The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49… Affected: 5.3; 5.4 |
| CVE-2021-35649 | 5.4 | Oct 20 | Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Server) Affected: 5.6 |
| CVE-2021-33037 | 5.3 | Jul 12 | Incorrect Transfer-Encoding handling with HTTP/1.0 Affected: 5.6 |
| CVE-2021-35650 | 4.6 | Oct 20 | Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Client) Affected: 5.6 |
| CVE-2018-11784 | 4.3 | Oct 4 | When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g Affected: 5.4 |
| CVE-2016-0501 | – | Jan 21 | Unspecified vulnerability in the Oracle Secure Global Desktop component in Oracle Virtualization 5.2 allows remote attackers to affect availability via vectors related to SGD Core Affected: 5.2 |
| CVE-2014-0226 | – | Jul 20 | Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly… Affected: 4.63; 4.71; 5.0; 5.1 |
| CVE-2014-0098 | – | Mar 18 | The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation… Affected: 4.63; 4.71; 5.0; 5.1 |
| CVE-2013-2064 | – | Jun 15 | Integer overflow in X.org libxcb 1.9 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the read_packet… Affected: 4.71; 5.2 |
Showing 32