Semaine du 29 novembre au 5 décembre 2021

Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus

Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability — Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution

Apache Apache

Apache HTTP Server-Side Request Forgery (SSRF) — A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

Zoho ManageEngine ServiceDesk Plus (SDP)

Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability — Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication

Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Qualcomm Multiple Chipsets Improper Input Validation Vulnerability — Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

MikroTik RouterOS

MikroTik Router OS Directory Traversal Vulnerability — MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.