Vendredi 28 janvier 2022

Apple iOS and macOS

Apple Memory Corruption Vulnerability — Apple IOMobileFrameBuffer contains a memory corruption vulnerability which can allow a malicious application to execute arbitrary code with kernel privileges.

SonicWall SMA 100 Appliances

SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability — SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution.

Grandstream UCM6200

Grandstream Networks UCM6200 Series SQL Injection Vulnerability — Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. Exploitation can allow for code execution as root.

Microsoft Windows

Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability — Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges.

Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability

Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability — Intel products contain a vulnerability which can allow attackers to perform privilege escalation.

GNU Bourne-Again Shell (Bash)

GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability — GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code. This CVE correctly remediates the vulnerability in CVE-2014-6271.

GNU Bourne-Again Shell (Bash)

GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability — GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code.

Microsoft Internet Explorer

Microsoft Internet Explorer Memory Corruption Vulnerability — Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code in the context of the current user.