Checkpoint vulnerabilities
147 vulnerabilities
Known vulnerabilities in Checkpoint products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 81 products.
Products
50 of 81- Firewall 140 vulnerabilities
- Endpoint Security14 vulnerabilities
- Zonealarm14 vulnerabilities
- Vpn 113 vulnerabilities
- Quantum Security Gateway12 vulnerabilities
- Quantum Security Management8 vulnerabilities
- Security Gateway8 vulnerabilities
- Gaia Os6 vulnerabilities
- Connectra Ngx4 vulnerabilities
- Identity Agent4 vulnerabilities
- Provider 14 vulnerabilities
- Remote Access Clients4 vulnerabilities
- Check Point Mobile Access3 vulnerabilities
- Endpoint Security Clients3 vulnerabilities
- Harmony Endpoint3 vulnerabilities
- Mobile Access3 vulnerabilities
- Multi Domain Security Management3 vulnerabilities
- Remote Access Vpn3 vulnerabilities
- Smartconsole3 vulnerabilities
- Capsule Docs Standalone Client2 vulnerabilities
- Check Point Smartconsole2 vulnerabilities
- Gaia Embedded2 vulnerabilities
- Gaia Portal2 vulnerabilities
- Spark Firewalls2 vulnerabilities
- Ssl Network Extender2 vulnerabilities
- Vpn 1 Firewall 12 vulnerabilities
- Vpn 1 Secureclient2 vulnerabilities
- Zonealarm Extreme Security2 vulnerabilities
- Zonealarm Extreme Security Nextgen2 vulnerabilities
- Capsule Docs1 vulnerabilities
- Capsule Workspace1 vulnerabilities
- Check Point Harmony SASE1 vulnerabilities
- Check Point Integrity Client1 vulnerabilities
- Check Point Management Log Server1 vulnerabilities
- Check Point Quantum Gateway, Spark Gateway And Cloudguard Network1 vulnerabilities
- Check Point Vpn1 vulnerabilities
- Check Point Vpn 1 Pro1 vulnerabilities
- Cloudguard Network Security1 vulnerabilities
- Clusterxl, Multi Domain Security Management, Quantum Appliances, Quantum Maestro, Quantum Scalable Chassis, Quantum Security Gateways, Quantum Security Management1 vulnerabilities
- Endpoint Connect1 vulnerabilities
- Endpoint Security Mi Server R731 vulnerabilities
- Endpoint Security Server Package1 vulnerabilities
- Endpoint Security Vpn1 vulnerabilities
- Express1 vulnerabilities
- Firewall 1 Pki Web Service1 vulnerabilities
- Harmony Browse1 vulnerabilities
- Harmony Endpoint Security Client For Windows1 vulnerabilities
- Harmony Sase1 vulnerabilities
- Hramony SASE1 vulnerabilities
- Ica Management Portal1 vulnerabilities
CVE-2018-8790check point software technologies ltd.zonealarm+1
EPSS score0.39%
Check Point ZoneAlarm version 15.3.064.17729 and below expose a WCF service that can allow a local low privileged user to execute arbitrary code as SYSTEM.CVE-2003-0757checkpointfirewall-1EPSS score2.85%
Check Point FireWall-1 4.0 and 4.1 before SP5 allows remote attackers to obtain the IP addresses of internal interfaces via certain SecuRemote requests to TCP ports 256 or 264, which leaks the IP addresses in a reply packet.CVE-2013-7350checkpointsecurity_gatewayEPSS score1.37%
Multiple unspecified vulnerabilities in Check Point Security Gateway 80 R71.x before R71.45 (730159141) and R75.20.x before R75.20.4 and 600 and 1100 appliances R75.20.x before R75.20.42 have unknown impact and attack vectors related to "important security fixes."CVE-2013-7311checkpointgaia_os+1EPSS score0.61%
The OSPF implementation in Check Point Gaia OS R75.X and R76 and IPSO OS 6.2 R75.X and R76 does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet, a related issue to CVE-2013-0149.CVE-2013-7304checkpointendpoint_security_mi_server_r73EPSS score0.60%
Check Point Endpoint Security MI Server through R73 3.0.0 HFA2.5 does not configure X.509 certificate validation for client devices, which allows man-in-the-middle attackers to spoof SSL servers by presenting an arbitrary certificate during a session established by a client.CVE-2013-5635checkpointendpoint_securityEPSS score0.21%
Media Encryption EPM Explorer in Check Point Endpoint Security through E80.50 does not properly maintain the state of password failures, which makes it easier for physically proximate attackers to bypass the device-locking protection mechanism by entering password guesses within multiple Unlock.exe processes that are running simultaneously.CVE-2013-5636checkpointendpoint_securityEPSS score0.20%
Unlock.exe in Media Encryption EPM Explorer in Check Point Endpoint Security through E80.50 does not associate password failures with a device ID, which makes it easier for physically proximate attackers to bypass the device-locking protection mechanism by overwriting DVREM.EPM with a copy of itself after each few password guesses.CVE-2021-30357checkpointssl_network_extenderEPSS score22.79%
SSL Network Extender Client for Linux before build 800008302 reveals part of the contents of the configuration file supplied, which allows partially disclosing files to which the user did not have access.CVE-2021-30359checkpointharmony_browse+1EPSS score3.93%
The Harmony Browse and the SandBlast Agent for Browsers installers must have admin privileges to execute some steps during the installation. Because the MS Installer allows regular users to repair their installation, an attacker running an installer before 90.08.7405 can start the installation repair and place a specially crafted binary in the repair folder, which runs with the admin privileges.CVE-2021-30358checkpointmobile_access_portal_agentEPSS score27.47%
Mobile Access Portal Native Applications who's path is defined by the administrator with environment variables may run applications from other locations by the Mobile Access Portal Agent.CVE-2021-30360checkpointendpoint_securityEPSS score0.57%
Users have access to the directory where the installation repair occurs. Since the MS Installer allows regular users to run the repair, an attacker can initiate the installation repair and place a specially crafted EXE in the repair folder which runs with the Check Point Remote Access Client privileges.CVE-2021-30361checkpointgaia_os+1EPSS score4.47%
The Check Point Gaia Portal's GUI Clients allowed authenticated administrators with permission for the GUI Clients settings to inject a command that would run on the Gaia OS.CVE-2021-30356checkpointidentity_agentEPSS score1.00%
A denial of service vulnerability was reported in Check Point Identity Agent before R81.018.0000, which could allow low privileged users to overwrite protected system files.CVE-2021-3449alpineopenssl+103EPSS score63.54%
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).CVE-2007-2174checkpointzonealarmEPSS score0.41%
The IOCTL handling in srescan.sys in the ZoneAlarm Spyware Removal Engine (SRE) in Check Point ZoneAlarm before 5.0.156.0 allows local users to execute arbitrary code via certain IOCTL lrp parameter addresses.CVE-2007-2689checkpointweb_intelligenceEPSS score1.96%
Check Point Web Intelligence does not properly handle certain full-width and half-width Unicode character encodings, which might allow remote attackers to evade detection of HTTP traffic.CVE-2007-2730checkpointzonealarm+2EPSS score0.32%
Check Point ZoneAlarm Pro before 6.5.737.000 does not properly test for equivalence of process identifiers for certain Microsoft Windows API functions in the NT kernel 5.0 and greater, which allows local users to call these functions, and bypass firewall rules or gain privileges, via a modified identifier that is one, two, or three greater than the canonical identifier.CVE-2007-0471checkpointconnectra_ngxEPSS score2.71%
sre/params.php in the Integrity Clientless Security (ICS) component in Check Point Connectra NGX R62 3.x and earlier before Security Hotfix 5, and possibly VPN-1 NGX R62, allows remote attackers to bypass security requirements via a crafted Report parameter, which returns a valid ICSCookie authentication token.CVE-2007-4216checkpointzonealarmEPSS score0.37%
vsdatant.sys 6.5.737.0 in Check Point Zone Labs ZoneAlarm before 7.0.362 allows local users to gain privileges via a crafted Interrupt Request Packet (Irp) in a METHOD_NEITHER (1) IOCTL 0x8400000F or (2) IOCTL 0x84000013 request, which can be used to overwrite arbitrary memory locations.CVE-2007-3489checkpointvpn-1_utm_edgeEPSS score3.31%
Cross-site request forgery (CSRF) vulnerability in pop/WizU.html in the management interface in Check Point VPN-1 Edge X Embedded NGX 7.0.33x on the Check Point VPN-1 UTM Edge allows remote attackers to perform privileged actions as administrators, as demonstrated by a request with the swuuser and swupass parameters, which adds an administrator account. NOTE: the CSRF attack has no timing window because there is no logout capability in the management interface.