Checkpoint vulnerabilities, page 2
147 vulnerabilities
Known vulnerabilities in Checkpoint products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 81 products.
CVE-2025-2028checkpointcheck point management log server+1
EPSS score0.21%
Lack of TLS validation when downloading a CSV file including mapping from IPs to countries used ONLY for displaying country flags in logsCVE-2025-9142checkpointhramony saseEPSS score0.08%
A local user can trigger Harmony SASE Windows client to write or delete files outside the intended certificate working directory.CVE-2025-8305checkpointidentity awarenessEPSS score0.12%
An authenticated local user can obtain information that allows claiming security policy rules of another user due to sensitive information being printed in plaintext in Identity Agent for Terminal Services debug files.CVE-2025-8304checkpointidentity_agentEPSS score0.12%
An authenticated local user can obtain information that allows claiming security policy rules of another user due to sensitive information being accessible in the Windows Registry keys for Check Point Identity Agent running on a Terminal Server.CVE-2025-3831checkpointcheck point harmony sase+1EPSS score0.41%
Log files uploaded during troubleshooting by the Harmony SASE agent may have been accessible to unauthorized parties.CVE-2020-6021checkpointendpoint_securityEPSS score0.30%
Check Point Endpoint Security Client for Windows before version E84.20 allows write access to the directory from which the installation repair takes place. Since the MS Installer allows regular users to run the repair, an attacker can initiate the installation repair and place a specially crafted DLL in the repair folder which will run with the Endpoint client’s privileges.CVE-2020-6012checkpointzonealarm_anti-ransomwareEPSS score0.52%
ZoneAlarm Anti-Ransomware before version 1.0.713 copies files for the report from a directory with low privileges. A sophisticated timed attacker can replace those files with malicious or linked content, such as exploiting CVE-2020-0896 on unpatched systems or using symbolic links. This allows an unprivileged user to enable escalation of privilege via local access.CVE-2020-6014checkpointendpoint_securityEPSS score0.39%
Check Point Endpoint Security Client for Windows, with Anti-Bot or Threat Emulation blades installed, before version E83.20, tries to load a non-existent DLL during a query for the Domain Name. An attacker with administrator privileges can leverage this to gain code execution within a Check Point Software Technologies signed binary, where under certain circumstances may cause the client to terminate.CVE-2020-6024checkpointsmartconsoleEPSS score0.27%
Check Point SmartConsole before R80.10 Build 185, R80.20 Build 119, R80.30 before Build 94, R80.40 before Build 415, and R81 before Build 548 were vulnerable to a possible local privilege escalation due to running executables from a directory with write access to all authenticated users.CVE-2020-6015checkpointendpoint_securityEPSS score0.34%
Check Point Endpoint Security for Windows before E84.10 can reach denial of service during clean install of the client which will prevent the storage of service log files in non-standard locations.CVE-2020-6013checkpointzonealarm_extreme_securityEPSS score1.55%
ZoneAlarm Firewall and Antivirus products before version 15.8.109.18436 allow an attacker who already has access to the system to execute code at elevated privileges through a combination of file permission manipulation and exploitation of Windows CVE-2020-00896 on unpatched systems.CVE-2020-6020checkpointica_management_portalEPSS score0.51%
Check Point Security Management's Internal CA web management before Jumbo HFAs R80.10 Take 278, R80.20 Take 160, R80.30 Take 210, and R80.40 Take 38, can be manipulated to run commands as a high privileged user or crash, due to weak input validation on inputs by a trusted management administrator.CVE-2020-6023checkpointzonealarmEPSS score0.34%
Check Point ZoneAlarm before version 15.8.139.18543 allows a local actor to escalate privileges while restoring files in Anti-Ransomware.CVE-2020-6022checkpointzonealarmEPSS score0.31%
Check Point ZoneAlarm before version 15.8.139.18543 allows a local actor to delete arbitrary files while restoring files in Anti-Ransomware.CVE-2014-1672checkpointmanagement_server+1EPSS score0.85%
Check Point R75.47 Security Gateway and Management Server does not properly enforce Anti-Spoofing when the routing table is modified and the "Get - Interfaces with Topology" action is performed, which allows attackers to bypass intended access restrictions.CVE-2014-1673checkpointsession_authentication_agentEPSS score1.64%
Check Point Session Authentication Agent allows remote attackers to obtain sensitive information (user credentials) via unspecified vectors.CVE-2014-7169applemac_os_x+77KEVEPSS score99.94%
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.CVE-2014-6271applemac_os_x+80KEVEPSS score100.00%
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.CVE-2014-8950checkpointsecurity_gatewayEPSS score1.55%
Unspecified vulnerability in Check Point Security Gateway R77 and R77.10, when the (1) URL Filtering or (2) Identity Awareness blade is used, allows remote attackers to cause a denial of service (crash) via vectors involving an HTTPS request.CVE-2014-8951checkpointsecurity_gatewayEPSS score1.55%
Unspecified vulnerability in Check Point Security Gateway R75, R76, R77, and R77.10, when UserCheck is enabled and the (1) Application Control, (2) URL Filtering, (3) DLP, (4) Threat Emulation, (5) Anti-Bot, or (6) Anti-Virus blade is used, allows remote attackers to cause a denial of service (fwk0 process crash, core dump, and restart) via a redirect to the UserCheck page.