Veille CVE
Semaine du 21 février au 27 février 2022
6 CVE
-
Synacor zimbra collaboration suite
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
-
Microsoft Corporation Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, and Microsoft Office 2016. · Microsoft office
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0243.
-
Microsoft Corporation Internet Explorer · Microsoft internet explorer
A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0226.
-
Microsoft windows 7 · Microsoft windows 8 · Microsoft windows 8.1 · Microsoft windows rt
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object, as exploited in the wild in October 2014 with a crafted PowerPoint document.
-
Zabbix Frontend
Zabbix Frontend Improper Access Control Vulnerability — Malicious actors can pass step checks and potentially change the configuration of Zabbix Frontend.
-
Zabbix Frontend
Zabbix Frontend Authentication Bypass Vulnerability — Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML.