Veille CVE
Février 2022
32 CVE
-
Synacor zimbra collaboration suite
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
-
Microsoft Corporation Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, and Microsoft Office 2016. · Microsoft office
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0243.
-
Microsoft Corporation Internet Explorer · Microsoft internet explorer
A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0226.
-
Microsoft windows 7 · Microsoft windows 8 · Microsoft windows 8.1 · Microsoft windows rt
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object, as exploited in the wild in October 2014 with a crafted PowerPoint document.
-
Zabbix Frontend
Zabbix Frontend Improper Access Control Vulnerability — Malicious actors can pass step checks and potentially change the configuration of Zabbix Frontend.
-
Zabbix Frontend
Zabbix Frontend Authentication Bypass Vulnerability — Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML.
-
Google Chrome
Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
-
Microsoft Internet Explorer 11 · Microsoft Internet Explorer 10 · Microsoft internet explorer
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0739, CVE-2019-0753, CVE-2019-0862.
-
Adobe flash player · Redhat enterprise linux desktop · Redhat enterprise linux server · Redhat enterprise linux workstation
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
-
Microsoft Windows 7 · Microsoft Windows Server 2012 R2 · Microsoft Windows RT 8.1 · Microsoft Windows Server 2008
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
-
Phpunit project phpunit · Oracle communications diameter signaling router
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
-
Microsoft office · Microsoft office compatibility pack · Microsoft office web apps · Microsoft office web apps server
Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automation Services on SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps 2010 SP1 and SP2; and Office Web Apps Server 2013 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, as exploited in the wild in March 2014.
-
Microsoft excel viewer · Microsoft lync · Microsoft office · Microsoft office compatibility pack
GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated by an image in a Word document, and exploited in the wild in October and November 2013.
-
Adobe Commerce and Magento Open Source
Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability — Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.
-
RARLAB WinRAR
WinRAR Absolute Path Traversal Vulnerability — WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution
-
Apple iOS, iPadOS, and macOS
Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability — Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
-
Microsoft Windows
Microsoft Windows SAM Local Privilege Escalation Vulnerability — If a Volume Shadow Copy (VSS) shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level.
-
Microsoft SMBv3
Microsoft SMBv3 Remote Code Execution Vulnerability — A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.
-
Jenkins Jenkins Stapler Web Framework
Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability — A code execution vulnerability exists in the Stapler web framework used by Jenkins
-
Apache Struts 1
Apache Struts 1 Improper Input Validation Vulnerability — The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
-
Microsoft Windows
Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability — Windows Shell in multiple versions of Microsoft Windows allows local users or remote attackers to execute arbitrary code via a crafted .LNK file
-
Oracle WebLogic Server
Oracle Corporation WebLogic Server Remote Code Execution Vulnerability — Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution.
-
Microsoft Win32k
Microsoft Win32k Privilege Escalation Vulnerability — Microsoft Win32k contains a privilege escalation vulnerability due to the Windows kernel-mode driver failing to properly handle objects in memory.
-
Microsoft Office
Microsoft Office Remote Code Execution Vulnerability — A remote code execution vulnerability exists in Microsoft Office.
-
Microsoft SMBv1
Microsoft SMBv1 Remote Code Execution Vulnerability — The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.
-
Microsoft SMBv1
Microsoft SMBv1 Remote Code Execution Vulnerability — The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.
-
Apache ActiveMQ
Apache ActiveMQ Improper Input Validation Vulnerability — The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request
-
D-Link DIR-645 Router
D-Link DIR-645 Router Remote Code Execution Vulnerability — D-Link DIR-645 Wired/Wireless Router allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.
-
Microsoft HTTP.sys
Microsoft HTTP.sys Remote Code Execution Vulnerability — Microsoft HTTP protocol stack (HTTP.sys) contains a vulnerability that allows for remote code execution.
-
Apple OS X
Apple OS X Authentication Bypass Vulnerability — The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges.
-
Apple OS X
Apple OS X Heap-Based Buffer Overflow Vulnerability — Heap-based buffer overflow in IOHIDFamily in Apple OS X, which affects, iOS before 8 and Apple TV before 7, allows attackers to execute arbitrary code in a privileged context.
-
Microsoft Windows 10 Version 1809 · Microsoft Windows Server 2019 · Microsoft Windows Server 2019 (Server Core installation) · Microsoft Windows 10 Version 1909
Win32k Elevation of Privilege Vulnerability