Veille CVE

Semaine du 7 mars au 13 mars 2022

11 CVE

Critique 4 Élevée 3 Moyenne 2 Faible 0 Non évaluée 2 Tri : plus récentes
  1. CVE-2022-26486 9.6 Critique Exploitée

    Mozilla Firefox · Mozilla Firefox ESR · Mozilla Firefox for Android · Mozilla Thunderbird

    An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.

  2. CVE-2021-21973 5.3 Moyenne Exploitée

    VMware vCenter Server · VMware Cloud Foundation

    The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).

  3. CVE-2020-8218 7.2 Élevée Exploitée

    Pulse Connect Secure · Ivanti connect secure · Ivanti policy secure · Pulsesecure pulse policy secure

    A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.

  4. CVE-2019-11581 9.8 Critique Exploitée

    Atlassian Jira Server and Data Center · Atlassian jira server

    There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.

  5. CVE-2017-6077 9.8 Critique Exploitée

    Netgear dgn2200 firmware

    ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ping_IPAddr field of an HTTP POST request.

  6. CVE-2016-6277 8.8 Élevée Exploitée

    Netgear d6220 firmware · Netgear d6400 firmware · Netgear r6250 firmware · Netgear r6400 firmware

    NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000, and possibly other routers allow remote attackers to execute arbitrary commands via shell metacharacters in the path info to cgi-bin/.

  7. CVE-2013-0631 7.5 Élevée Exploitée

    Adobe coldfusion

    Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exploited in the wild in January 2013.

  8. CVE-2013-0625 9.8 Critique Exploitée

    Adobe coldfusion

    Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited in the wild in January 2013.

  9. CVE-2009-3960 6.5 Moyenne Exploitée Rançongiciel

    Adobe blazeds · Adobe coldfusion · Adobe flex data services · Adobe livecycle

    Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.

  10. CVE-2022-26485 – Non évaluée Exploitée

    Mozilla Firefox

    Mozilla Firefox Use-After-Free Vulnerability — Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution.

  11. CVE-2013-0629 – Non évaluée Exploitée

    Adobe ColdFusion

    Adobe ColdFusion Directory Traversal Vulnerability — Adobe Coldfusion contains a directory traversal vulnerability, which could permit an unauthorized user access to restricted directories.