Threat P.E-D.HP.8

URI: P.E-D.HP.8

Description: Vulnerabilities discovered in process Process: one or more software vulnerabilities in process Process become known to attackers. This is a pre-requisite for exploitation of more specific types of vulnerabilities.

Threat Type: Primary Threat

Matching Pattern:

MP-HP

Finds a Process and its Host, and optionally the host manager and the interactive user of the process.

(empty)

P.E-A.HP-iT.8

Vulnerability (A) discovered at Process: software vulnerability found in process Process, which could allow an attack on process availability, and may be known to attackers. Only around 4 percent of vulnerabilities are specific to this type of action (NVD 2015-2019).

P.E-AU.HP-iT.8

Vulnerability (AU) discovered at Process: software vulnerability found in process Process, which could allow an attack bypassing authentication, and may be known to attackers. Around 82 percent of vulnerabilities can be accessed without authentication (NVD 2015-2019).

P.E-C.HP-iT.8

Vulnerability (C) discovered at Process: software vulnerability found in process Process, which could allow an attack on data confidentiality, and may be known to attackers. Less than 1 percent of vulnerabilities are specific to this type of action (NVD 2015-2019).

P.E-I.HP-iT.8

Vulnerability (I) discovered at Process: software vulnerability found in process Process, which could allow an attack on data integrity, and may be known to attackers. Less than 1 percent of vulnerabilities are specific to this type of action (NVD 2015-2019).

P.E-M.SHP-iT.8

Vulnerability (M) discovered at Process: software vulnerability found in process Process, which could allow admin level access to its host device, and may be known to attackers. Around 18 percent of vulnerabilities allow complete control of the vulnerable device (NVD 2015-2019).

P.E-QI.HP-iT.8

Vulnerability (QI) discovered at Process: software vulnerability found in process Process, which could allow injection of queries into a back-end database, and may be known to attackers. Around 3 percent of vulnerabilities relate to query injection, but around 5 percent of all low complexity attacks are of this type (NVD 2015-2019).

P.E-U.SHP-iT.8

Vulnerability (U) discovered at Process: software vulnerability found in process Process, which could allow user level access to its host device with the rights of the process, and may be known to attackers. Around 30 percent of vulnerabilities allow local user access to the vulnerable device (NVD 2015-2019).

P.E-VA.HP-iT.8

Vulnerability (VA) discovered at Process: software vulnerability found in process Process, which could allow an attack from an adjacent network, and may be known to attackers. Under 2 percent of vulnerabilities require low level access from an adjacent network (NVD 2015-2019), and presumably the majority are in the O/S (i.e. the host).

P.E-VL.HP-iT.8

Vulnerability (VL) discovered at Process: software vulnerability found in process Process, which could allow an attack by a local user, and may be known to attackers. Around 14 percent of vulnerabilities require local user access to the vulnerable device (NVD 2015-2019).

P.E-VN.HP-iT.8

Vulnerability (VN) discovered at Process: software vulnerability found in process Process, which could allow an attack from a remote network, and may be known to attackers. Around 84 percent of vulnerabilities can be accessed from a remote network (NVD 2015-2019).

P.E-W.HP-iT.8

Vulnerability (W) discovered at Process: software vulnerability found in process Process, which could allow an attack by self-propagating malware, and may be known to attackers. Statistics not analysed, but should be less likely than user-level access because someone would need to know about the vulnerability and then develop fully automated and self-propagating malware able to attack it.

P.E-XS.HP-iT.8

Vulnerability (XS) discovered at Process: software vulnerability found in process Process, which could allow a cross-site scripting attack on a client, and may be known to attackers. Around 14 percent of vulnerabilities relate to cross site scripting, including 32 percent of vulnerabilities relating to medium complexity exploits (NVD 2015-2019).