Veille CVE
Janvier 2022
40 CVE
-
Apple iOS and iPadOS · Apple macOS · Apple ipados · Apple iphone os
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, macOS Big Sur 11.6.3, macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..
-
SonicWall SMA100 · Sonicwall sma 200 firmware · Sonicwall sma 210 firmware · Sonicwall sma 410 firmware
A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions.
-
Grandstream UCM6200 Series · Grandstream ucm6200 firmware
The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17.
-
Microsoft Windows · Microsoft Windows Server · Microsoft Windows 10 Version 1909 for 32-bit Systems · Microsoft Windows 10 Version 1909 for x64-based Systems
An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows Background Intelligent Transfer Service Elevation of Privilege Vulnerability'.
-
Intel Corporation Intel Active Mangement Technology, Intel Small Business Technology, Intel Standard Manageability · Hpe proliant ml10 gen9 server firmware · Siemens simatic itp1000 firmware · Siemens simatic ipc847d firmware
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).
-
Gnu bash · Arista eos · Oracle linux · Qnap qts
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.
-
Gnu bash · Arista eos · Oracle linux · Qnap qts
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
-
Microsoft internet explorer
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the CMarkup::IsConnectedToPrimaryMarkup function, as exploited in the wild in April 2014. NOTE: this issue originally emphasized VGX.DLL, but Microsoft clarified that "VGX.DLL does not contain the vulnerable code leveraged in this exploit. Disabling VGX.DLL is an exploit-specific workaround that provides an immediate, effective workaround to help block known attacks."
-
SolarWinds Serv-U
SolarWinds Serv-U Improper Input Validation Vulnerability — SolarWinds Serv-U versions 15.2.5 and earlier contain an improper input validation vulnerability that allows attackers to build and send queries without sanitization.
-
Microsoft Win32k
Microsoft Win32k Privilege Escalation Vulnerability — Microsoft Windows Win32k contains a vulnerability that allows an attacker to escalate privileges.
-
Apache Struts 2
Apache Struts 2 Improper Input Validation Vulnerability — The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution.
-
Apache Struts 1
Apache Struts 1 ActionForm Denial-of-Service Vulnerability — ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS).
-
Aviatrix Aviatrix Controller
Aviatrix Controller Unrestricted Upload of File — Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.
-
Microsoft Exchange Server
Microsoft Exchange Server Information Disclosure — Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target.
-
October CMS October CMS
October CMS Improper Authentication — In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request.
-
Nagios Nagios XI
Nagios XI OS Command Injection — Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
-
Nagios Nagios XI
Nagios XI OS Command Injection — Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
-
Nagios Nagios XI
Nagios XI OS Command Injection — Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
-
F5 BIG-IP Traffic Management Microkernel
F5 BIG-IP Traffic Management Microkernel Buffer Overflow — The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls.
-
VMware vRealize Operations Manager API
VMware Server Side Request Forgery in vRealize Operations Manager API — Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.
-
Npm package System Information Library for Node.JS
System Information Library for Node.JS Command Injection — In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote.
-
Oracle Intelligence Enterprise Edition
Oracle Business Intelligence Enterprise Edition Path Transversal — Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file.
-
Apache Airflow's Experimental API
Apache Airflow's Experimental API Authentication Bypass — The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.
-
Drupal Drupal core
Drupal core Un-restricted Upload of File — Improper sanitization in the extension file names is present in Drupal core.
-
Apache Airflow
Apache Airflow Command Injection — A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.
-
FatPipe WARP · FatPipe IPVPN · FatPipe MPVPN · Fatpipeinc ipvpn firmware
A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. The FatPipe advisory identifier for this vulnerability is FPSA006.
-
Hikvision ds-2cd2026g2-iu\/sl firmware · Hikvision ds-2cd2046g2-iu\/sl firmware · Hikvision ds-2cd2066g2-i\(u\) firmware · Hikvision ds-2cd2066g2-iu\/sl firmware
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.
-
Google Chrome
Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
-
Microsoft Windows · Microsoft Windows Server · Microsoft windows 10 1507 · Microsoft windows 10 1607
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'.
-
Palo Alto Networks GlobalProtect Portal/Gateway Interface · Paloaltonetworks pan-os
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.
-
exim · Exim exim · Canonical ubuntu linux · Debian debian linux
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
-
Fortinet FortiOS, FortiProxy · Fortinet fortiproxy · Fortinet fortios
An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests
-
Synacor zimbra collaboration suite
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.
-
Fortinet FortiOS and FortiProxy · Fortinet fortiproxy · Fortinet fortios
A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.
-
Oracle Corporation Tape Library ACSLS · Oracle agile product lifecycle management · Oracle communications converged application server · Oracle peoplesoft enterprise peopletools
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
-
Elastic Kibana · Redhat openshift container platform
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
-
Primetek primefaces
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
-
Ibm sterling b2b integrator · Ibm sterling integrator · Ibm tivoli common reporting · Ibm watson content analytics
Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.
-
Microsoft Windows 10 Version 1809 · Microsoft Windows Server 2019 · Microsoft Windows Server 2019 (Server Core installation) · Microsoft Windows Server 2022
Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Windows 10 and Windows 11. While the format is different from the original CVE published in 2013, except for clarifications about how to configure the EnableCertPaddingCheck registry value, the information herein remains unchanged from the original text published on December 10, 2013, Microsoft does not plan to enforce the stricter verification behavior as a default functionality on supported releases of Microsoft Windows. This behavior remains available as an opt-in feature via reg key setting, and is available on supported editions of Windows released since December 10, 2013. This includes all currently supported versions of Windows 10 and Windows 11. The supporting code for this reg key was incorporated at the time of release for Windows 10 and Windows 11, so no security update is required; however, the reg key must be set. See the Security Updates table for the list of affected software. Vulnerability Description A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for portable executable (PE) files. An anonymous attacker could exploit the vulnerability by modifying an existing signed executable file to leverage unverified portions of the file in such a way as to add malicious code to the file without invalidating the signature. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Exploitation of this vulnerability requires that a user or application run or install a specially crafted, signed PE file. An attacker could modify an... See more at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2013-3900
-
VMware vCenter Server
VMware vCenter Server Improper Access Control — Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.