Veille CVE

Mars 2022

226 CVE

Critique 36 Élevée 75 Moyenne 9 Faible 0 Non évaluée 106 Tri : plus récentes
  1. CVE-2022-26871 – Non évaluée Exploitée

    Trend Micro Apex Central

    Trend Micro Apex Central Arbitrary File Upload Vulnerability — An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.

  2. CVE-2022-1040 – Non évaluée Exploitée

    Sophos Firewall

    Sophos Firewall Authentication Bypass Vulnerability — An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution.

  3. CVE-2021-34484 – Non évaluée Exploitée

    Microsoft Windows

    Microsoft Windows User Profile Service Privilege Escalation Vulnerability — Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.

  4. CVE-2021-28799 – Non évaluée Exploitée Rançongiciel

    QNAP Network Attached Storage (NAS)

    QNAP NAS Improper Authorization Vulnerability — QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.

  5. CVE-2021-21551 – Non évaluée Exploitée

    Dell dbutil Driver

    Dell dbutil Driver Insufficient Access Control Vulnerability — Dell dbutil driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial-of-service (DoS), or information disclosure.

  6. CVE-2018-10562 – Non évaluée Exploitée Rançongiciel

    Dasan Gigabit Passive Optical Network (GPON) Routers

    Dasan GPON Routers Command Injection Vulnerability — Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561, exploitation can allow an attacker to perform remote code execution.

  7. CVE-2018-10561 – Non évaluée Exploitée

    Dasan Gigabit Passive Optical Network (GPON) Routers

    Dasan GPON Routers Authentication Bypass Vulnerability — Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10562, exploitation can allow an attacker to perform remote code execution.

  8. CVE-2018-8440 7.8 Élevée Exploitée Rançongiciel

    Microsoft Windows 7 · Microsoft Windows Server 2012 R2 · Microsoft Windows RT 8.1 · Microsoft Windows Server 2008

    An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

  9. CVE-2018-8405 7.8 Élevée Exploitée Rançongiciel

    Microsoft Windows Server 2012 R2 · Microsoft Windows RT 8.1 · Microsoft Windows Server 2016 · Microsoft Windows 8.1

    An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8400, CVE-2018-8401, CVE-2018-8406.

  10. CVE-2017-0059 4.3 Moyenne Exploitée

    Microsoft Corporation Internet Explorer · Microsoft internet explorer

    Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0008 and CVE-2017-0009.

  11. CVE-2016-7201 8.8 Élevée Exploitée

    Microsoft edge

    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7200, CVE-2016-7202, CVE-2016-7203, CVE-2016-7208, CVE-2016-7240, CVE-2016-7242, and CVE-2016-7243.

  12. CVE-2016-7200 8.8 Élevée Exploitée

    Microsoft edge

    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7201, CVE-2016-7202, CVE-2016-7203, CVE-2016-7208, CVE-2016-7240, CVE-2016-7242, and CVE-2016-7243.

  13. CVE-2016-0189 7.5 Élevée Exploitée Rançongiciel

    Microsoft jscript · Microsoft vbscript · Microsoft internet explorer

    The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0187.

  14. CVE-2016-0040 7.8 Élevée Exploitée

    Microsoft windows 7 · Microsoft windows server 2008 · Microsoft windows vista

    The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a crafted application, aka "Windows Elevation of Privilege Vulnerability."

  15. CVE-2012-0518 4.7 Moyenne Exploitée

    Oracle fusion middleware

    Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to Redirects, a different vulnerability than CVE-2012-3175.

  16. CVE-2012-5076 9.8 Critique Exploitée

    Oracle jre · Suse linux enterprise desktop

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JAX-WS.

  17. CVE-2012-2034 7.5 Élevée Exploitée

    Adobe flash player · Adobe air · Opensuse opensuse · Suse linux enterprise desktop

    Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-2037.

  18. CVE-2011-2005 7.8 Élevée Exploitée

    Microsoft windows server 2003 · Microsoft windows xp

    afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability."

  19. CVE-2022-1096 – Non évaluée Exploitée

    Google Chromium V8

    Google Chromium V8 Type Confusion Vulnerability — Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

  20. CVE-2022-0543 – Non évaluée Exploitée

    Redis Debian-specific Redis Servers

    Debian-specific Redis Server Lua Sandbox Escape Vulnerability — Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

  21. CVE-2021-38646 – Non évaluée Exploitée Rançongiciel

    Microsoft Office

    Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability — Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution.

  22. CVE-2021-34486 – Non évaluée Exploitée

    Microsoft Windows

    Microsoft Windows Event Tracing Privilege Escalation Vulnerability — Microsoft Windows Event Tracing contains an unspecified vulnerability which can allow for privilege escalation.

  23. CVE-2021-26085 – Non évaluée Exploitée Rançongiciel

    Atlassian Confluence Server

    Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability — Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint.

  24. CVE-2021-20028 – Non évaluée Exploitée Rançongiciel

    SonicWall Secure Remote Access (SRA)

    SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability — SonicWall Secure Remote Access (SRA) products contain an improper neutralization of a SQL Command leading to SQL injection.

  25. CVE-2019-7483 – Non évaluée Exploitée

    SonicWall SMA100

    SonicWall SMA100 Directory Traversal Vulnerability — In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server.

  26. CVE-2018-8406 – Non évaluée Exploitée Rançongiciel

    Microsoft DirectX Graphics Kernel (DXGKRNL)

    Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability — An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.

  27. CVE-2017-0213 – Non évaluée Exploitée Rançongiciel

    Microsoft Windows

    Microsoft Windows Privilege Escalation Vulnerability — Microsoft Windows COM Aggregate Marshaler allows for privilege escalation when an attacker runs a specially crafted application.

  28. CVE-2017-0037 – Non évaluée Exploitée

    Microsoft Edge and Internet Explorer

    Microsoft Edge and Internet Explorer Type Confusion Vulnerability — Microsoft Edge and Internet Explorer have a type confusion vulnerability in mshtml.dll, which allows remote code execution.

  29. CVE-2016-0151 – Non évaluée Exploitée Rançongiciel

    Microsoft Client-Server Run-time Subsystem (CSRSS)

    Microsoft Windows CSRSS Security Feature Bypass Vulnerability — The Client-Server Run-time Subsystem (CSRSS) in Microsoft mismanages process tokens, which allows local users to gain privileges via a crafted application.

  30. CVE-2015-2426 – Non évaluée Exploitée

    Microsoft Windows

    Microsoft Windows Adobe Type Manager Library Remote Code Execution Vulnerability — A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted OpenType fonts.

  31. CVE-2015-2419 – Non évaluée Exploitée

    Microsoft Internet Explorer

    Microsoft Internet Explorer Memory Corruption Vulnerability — JScript in Microsoft Internet Explorer allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.

  32. CVE-2015-1770 – Non évaluée Exploitée

    Microsoft Office

    Microsoft Office Uninitialized Memory Use Vulnerability — Microsoft Office allows remote attackers to execute arbitrary code via a crafted Office document.

  33. CVE-2013-3660 – Non évaluée Exploitée

    Microsoft Win32k

    Microsoft Win32k Privilege Escalation Vulnerability — The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft does not properly initialize a pointer for the next object in a certain list, which allows local users to gain privileges.

  34. CVE-2013-2729 – Non évaluée Exploitée

    Adobe Reader and Acrobat

    Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability — Integer overflow vulnerability in Adobe Reader and Acrobat allows attackers to execute remote code.

  35. CVE-2013-2551 – Non évaluée Exploitée Rançongiciel

    Microsoft Internet Explorer

    Microsoft Internet Explorer Use-After-Free Vulnerability — Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute remote code via a crafted web site that triggers access to a deleted object.

  36. CVE-2013-2465 – Non évaluée Exploitée Rançongiciel

    Oracle Java SE

    Oracle Java SE Unspecified Vulnerability — Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to 2D

  37. CVE-2013-1690 – Non évaluée Exploitée

    Mozilla Firefox and Thunderbird

    Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability — Mozilla Firefox and Thunderbird do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial-of-service (DoS) or possibly execute malicious code via a crafted web site.

  38. CVE-2012-2539 – Non évaluée Exploitée

    Microsoft Word

    Microsoft Word Remote Code Execution Vulnerability — Microsoft Word allows attackers to execute remote code or cause a denial-of-service (DoS) via crafted RTF data.

  39. CVE-2010-4398 – Non évaluée Exploitée

    Microsoft Windows

    Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability — Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows allows local users to gain privileges, and bypass the User Account Control (UAC) feature.

  40. CVE-2022-26318 9.8 Critique Exploitée

    Watchguard fireware

    On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.

  41. CVE-2022-21999 7.8 Élevée Exploitée Rançongiciel

    Microsoft Windows 10 Version 1809 · Microsoft Windows Server 2019 · Microsoft Windows Server 2019 (Server Core installation) · Microsoft Windows 10 Version 1909

    Windows Print Spooler Elevation of Privilege Vulnerability

  42. CVE-2021-42237 9.8 Critique Exploitée Rançongiciel

    Sitecore experience platform

    Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.

  43. CVE-2021-22941 9.8 Critique Exploitée Rançongiciel

    Citrix ShareFile storage zones controller · Citrix sharefile storagezones controller

    Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compromise the storage zones controller.

  44. CVE-2020-2506 9.8 Critique Exploitée

    QNAP Systems Inc. Helpdesk · Qnap helpdesk

    The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges, or reading sensitive information. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.

  45. CVE-2020-25223 9.8 Critique Exploitée

    Sophos unified threat management

    A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11

  46. CVE-2020-9377 8.8 Élevée Exploitée

    Dlink dir-610 firmware

    D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

  47. CVE-2020-2021 10.0 Critique Exploitée Rançongiciel

    Palo Alto Networks PAN-OS · Paloaltonetworks pan-os

    When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources. The attacker must have network access to the vulnerable server to exploit this vulnerability. This issue affects PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15, and all versions of PAN-OS 8.0 (EOL). This issue does not affect PAN-OS 7.1. This issue cannot be exploited if SAML is not used for authentication. This issue cannot be exploited if the 'Validate Identity Provider Certificate' option is enabled (checked) in the SAML Identity Provider Server Profile. Resources that can be protected by SAML-based single sign-on (SSO) authentication are: GlobalProtect Gateway, GlobalProtect Portal, GlobalProtect Clientless VPN, Authentication and Captive Portal, PAN-OS next-generation firewalls (PA-Series, VM-Series) and Panorama web interfaces, Prisma Access In the case of GlobalProtect Gateways, GlobalProtect Portal, Clientless VPN, Captive Portal, and Prisma Access, an unauthenticated attacker with network access to the affected servers can gain access to protected resources if allowed by configured authentication and Security policies. There is no impact on the integrity and availability of the gateway, portal or VPN server. An attacker cannot inspect or tamper with sessions of regular users. In the worst case, this is a critical severity vulnerability with a CVSS Base Score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). In the case of PAN-OS and Panorama web interfaces, this issue allows an unauthenticated attacker with network access to the PAN-OS or Panorama web interfaces to log in as an administrator and perform administrative actions. In the worst-case scenario, this is a critical severity vulnerability with a CVSS Base Score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). If the web interfaces are only accessible to a restricted management network, then the issue is lowered to a CVSS Base Score of 9.6 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Palo Alto Networks is not aware of any malicious attempts to exploit this vulnerability.

  48. CVE-2020-5410 7.5 Élevée Exploitée

    Spring by VMware Spring Cloud Config · Vmware spring cloud config

    Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.

  49. CVE-2020-1631 9.8 Critique Exploitée

    Juniper Networks Junos OS · Juniper junos

    A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform local file inclusion (LFI) or path traversal. Using this vulnerability, an attacker may be able to inject commands into the httpd.log, read files with 'world' readable permission file or obtain J-Web session tokens. In the case of command injection, as the HTTP service runs as user 'nobody', the impact of this command injection is limited. (CVSS score 5.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) In the case of reading files with 'world' readable permission, in Junos OS 19.3R1 and above, the unauthenticated attacker would be able to read the configuration file. (CVSS score 5.9, vector CVSS:3.1/ AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) If J-Web is enabled, the attacker could gain the same level of access of anyone actively logged into J-Web. If an administrator is logged in, the attacker could gain administrator access to J-Web. (CVSS score 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) This issue only affects Juniper Networks Junos OS devices with HTTP/HTTPS services enabled. Junos OS devices with HTTP/HTTPS services disabled are not affected. If HTTP/HTTPS services are enabled, the following command will show the httpd processes: user@device> show system processes | match http 5260 - S 0:00.13 /usr/sbin/httpd-gk -N 5797 - I 0:00.10 /usr/sbin/httpd --config /jail/var/etc/httpd.conf To summarize: If HTTP/HTTPS services are disabled, there is no impact from this vulnerability. If HTTP/HTTPS services are enabled and J-Web is not in use, this vulnerability has a CVSS score of 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). If J-Web is enabled, this vulnerability has a CVSS score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Juniper SIRT has received a single report of this vulnerability being exploited in the wild. Out of an abundance of caution, we are notifying customers so they can take appropriate actions. Indicators of Compromise: The /var/log/httpd.log may have indicators that commands have injected or files being accessed. The device administrator can look for these indicators by searching for the string patterns "=*;*&" or "*%3b*&" in /var/log/httpd.log, using the following command: user@device> show log httpd.log | match "=*;*&|=*%3b*&" If this command returns any output, it might be an indication of malicious attempts or simply scanning activities. Rotated logs should also be reviewed, using the following command: user@device> show log httpd.log.0.gz | match "=*;*&|=*%3b*&" user@device> show log httpd.log.1.gz | match "=*;*&|=*%3b*&" Note that a skilled attacker would likely remove these entries from the local log file, thus effectively eliminating any reliable signature that the device had been attacked. This issue affects Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S16; 12.3X48 versions prior to 12.3X48-D101, 12.3X48-D105; 14.1X53 versions prior to 14.1X53-D54; 15.1 versions prior to 15.1R7-S7; 15.1X49 versions prior to 15.1X49-D211, 15.1X49-D220; 16.1 versions prior to 16.1R7-S8; 17.2 versions prior to 17.2R3-S4; 17.3 versions prior to 17.3R3-S8; 17.4 versions prior to 17.4R2-S11, 17.4R3-S2; 18.1 versions prior to 18.1R3-S10; 18.2 versions prior to 18.2R2-S7, 18.2R3-S4; 18.3 versions prior to 18.3R2-S4, 18.3R3-S2; 18.4 versions prior to 18.4R1-S7, 18.4R3-S2 ; 18.4 version 18.4R2 and later versions; 19.1 versions prior to 19.1R1-S5, 19.1R3-S1; 19.1 version 19.1R2 and later versions; 19.2 versions prior to 19.2R2; 19.3 versions prior to 19.3R2-S3, 19.3R3; 19.4 versions prior to 19.4R1-S2, 19.4R2; 20.1 versions prior to 20.1R1-S1, 20.1R2.

  50. CVE-2016-11021 7.2 Élevée Exploitée

    Dlink dcs-930l firmware

    setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter.

  51. CVE-2020-9054 9.8 Critique Exploitée

    ZyXEL NAS326 · ZyXEL NAS520 · ZyXEL NAS540 · ZyXEL NAS542

    Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device. Although the web server does not run as the root user, ZyXEL devices include a setuid utility that can be leveraged to run any command with root privileges. As such, it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges. By sending a specially-crafted HTTP POST or GET request to a vulnerable ZyXEL device, a remote, unauthenticated attacker may be able to execute arbitrary code on the device. This may happen by directly connecting to a device if it is directly exposed to an attacker. However, there are ways to trigger such crafted requests even if an attacker does not have direct connectivity to a vulnerable devices. For example, simply visiting a website can result in the compromise of any ZyXEL device that is reachable from the client system. Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 NAS520 before firmware V5.21(AASZ.3)C0 NAS540 before firmware V5.21(AATB.4)C0 NAS542 before firmware V5.21(ABAG.4)C0 ZyXEL has made firmware updates available for NAS326, NAS520, NAS540, and NAS542 devices. Affected models that are end-of-support: NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2

  52. CVE-2019-15107 9.8 Critique Exploitée Rançongiciel

    Webmin webmin

    An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.

  53. CVE-2019-12991 8.8 Élevée Exploitée

    Citrix netscaler sd-wan · Citrix sd-wan

    Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6).

  54. CVE-2019-2616 7.2 Élevée Exploitée

    Oracle Corporation BI Publisher (formerly XML Publisher) · Oracle business intelligence publisher

    Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher). While the vulnerability is in BI Publisher (formerly XML Publisher), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of BI Publisher (formerly XML Publisher) accessible data as well as unauthorized read access to a subset of BI Publisher (formerly XML Publisher) accessible data. CVSS 3.0 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).

  55. CVE-2019-10068 9.8 Critique Exploitée

    Kentico xperience

    An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Due to a failure to validate security headers, it was possible for a specially crafted request to the staging service to bypass the initial authentication and proceed to deserialize user-controlled .NET object input. This deserialization then led to unauthenticated remote code execution on the server where the Kentico instance was hosted.

  56. CVE-2019-1003030 9.9 Critique Exploitée

    Jenkins project Jenkins Pipeline: Groovy Plugin · Jenkins pipeline\ · Redhat openshift container platform

    A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.

  57. CVE-2018-8414 8.8 Élevée Exploitée

    Microsoft Windows 10 Servers · Microsoft Windows 10 · Microsoft windows 10 1703 · Microsoft windows 10 1709

    A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Execution Vulnerability." This affects Windows 10 Servers, Windows 10.

  58. CVE-2018-0147 9.8 Critique Exploitée

    Cisco Secure Access Control System

    A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a crafted serialized Java object. An exploit could allow the attacker to execute arbitrary commands on the device with root privileges. Cisco Bug IDs: CSCvh25988.

  59. CVE-2017-12615 8.1 Élevée Exploitée Rançongiciel

    Apache Software Foundation Apache Tomcat · Apache tomcat · Netapp 7-mode transition tool · Netapp oncommand balance

    When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

  60. CVE-2017-6316 9.8 Critique Exploitée

    Citrix netscaler sd-wan

    Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as root via a CGISESSID cookie. On CloudBridge (the former name of NetScaler SD-WAN) devices, the cookie name was CAKEPHP rather than CGISESSID.

  61. CVE-2016-1555 9.8 Critique Exploitée

    Netgear wnap320 firmware · Netgear wndap350 firmware · Netgear wndap360 firmware · Netgear wndap210v2 firmware

    (1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands.

  62. CVE-2017-0146 8.8 Élevée Exploitée Rançongiciel

    Microsoft Corporation Windows SMB · Microsoft server message block · Siemens acuson p300 firmware · Siemens acuson p500 firmware

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0148.

  63. CVE-2016-10174 9.8 Critique Exploitée

    Netgear d6100 firmware · Netgear d7000 firmware · Netgear d7800 firmware · Netgear jnr1010v2 firmware

    The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by an unauthenticated attacker to achieve remote code execution.

  64. CVE-2016-7892 8.8 Élevée Exploitée

    Adobe Flash Player 23.0.0.207 and earlier, 11.2.202.644 and earlier · Adobe flash player desktop runtime · Adobe flash player

    Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextField class. Successful exploitation could lead to arbitrary code execution.

  65. CVE-2016-4171 9.8 Critique Exploitée

    Adobe flash player · Redhat enterprise linux desktop · Redhat enterprise linux server · Redhat enterprise linux workstation

    Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016.

  66. CVE-2016-0752 7.5 Élevée Exploitée

    Rubyonrails rails · Opensuse leap · Opensuse opensuse · Suse linux enterprise module for containers

    Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.

  67. CVE-2015-1427 9.8 Critique Exploitée

    Elastic elasticsearch · Redhat fuse

    The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

  68. CVE-2014-3120 8.1 Élevée Exploitée

    Elastic elasticsearch

    The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.

  69. CVE-2012-1823 9.8 Critique Exploitée

    Php php · Fedoraproject fedora · Debian debian linux · Hp hp-ux

    sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

  70. CVE-2009-1151 9.8 Critique Exploitée

    Phpmyadmin phpmyadmin · Debian debian linux

    Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.

  71. CVE-2005-2773 9.8 Critique Exploitée

    Hp openview network node manager

    HP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) node parameter to connectedNodes.ovpl, (2) cdpView.ovpl, (3) freeIPaddrs.ovpl, and (4) ecscmg.ovpl.

  72. CVE-2022-26143 – Non évaluée Exploitée

    Mitel MiCollab, MiVoice Business Express

    MiCollab, MiVoice Business Express Access Control Vulnerability — A vulnerability has been identified in MiCollab and MiVoice Business Express that may allow a malicious actor to gain unauthorized access to sensitive information and services, cause performance degradations or a denial of service condition on the affected system.

  73. CVE-2020-7247 – Non évaluée Exploitée

    OpenBSD OpenSMTPD

    OpenSMTPD Remote Code Execution Vulnerability — smtp_mailaddr in smtp_session.c in OpenSMTPD, as used in OpenBSD and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session.

  74. CVE-2020-1956 – Non évaluée Exploitée

    Apache Kylin

    Apache Kylin OS Command Injection Vulnerability — Apache Kylin contains an OS command injection vulnerability which could permit an attacker to perform remote code execution.

  75. CVE-2019-6340 – Non évaluée Exploitée

    Drupal Core

    Drupal Core Remote Code Execution Vulnerability — In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.

  76. CVE-2019-16920 – Non évaluée Exploitée

    D-Link Multiple Routers

    D-Link Multiple Routers Command Injection Vulnerability — Multiple D-Link routers contain a command injection vulnerability which can allow attackers to achieve full system compromise.

  77. CVE-2019-12989 – Non évaluée Exploitée

    Citrix SD-WAN and NetScaler

    Citrix SD-WAN and NetScaler SQL Injection Vulnerability — Citrix SD-WAN and NetScaler SD-WAN allow SQL Injection.

  78. CVE-2019-11043 – Non évaluée Exploitée Rançongiciel

    PHP FastCGI Process Manager (FPM)

    PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability — In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution.

  79. CVE-2019-0903 – Non évaluée Exploitée

    Microsoft Graphics Device Interface (GDI)

    Microsoft GDI Remote Code Execution Vulnerability — A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory. An attacker who successfully exploited this vulnerability could take control of the affected system.

  80. CVE-2018-8373 – Non évaluée Exploitée

    Microsoft Internet Explorer Scripting Engine

    Microsoft Scripting Engine Memory Corruption Vulnerability — A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer.

  81. CVE-2018-6961 – Non évaluée Exploitée

    VMware SD-WAN Edge

    VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability — VMware SD-WAN Edge by VeloCloud contains a command injection vulnerability in the local web UI component. Successful exploitation of this issue could result in remote code execution.

  82. CVE-2018-14839 – Non évaluée Exploitée

    LG N1A1 NAS

    LG N1A1 NAS Remote Command Execution Vulnerability — LG N1A1 NAS 3718.510 is affected by a remote code execution vulnerability.

  83. CVE-2018-1273 – Non évaluée Exploitée Rançongiciel

    VMware Tanzu Spring Data Commons

    VMware Tanzu Spring Data Commons Property Binder Vulnerability — Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution.

  84. CVE-2018-11138 – Non évaluée Exploitée Rançongiciel

    Quest KACE System Management Appliance

    Quest KACE System Management Appliance Remote Command Execution Vulnerability — The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution.

  85. CVE-2018-0125 – Non évaluée Exploitée

    Cisco VPN Routers

    Cisco VPN Routers Remote Code Execution Vulnerability — A vulnerability in the web interface of the Cisco VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as root and gain full control of an affected system.

  86. CVE-2017-6334 – Non évaluée Exploitée

    NETGEAR DGN2200 Devices

    NETGEAR DGN2200 Devices OS Command Injection Vulnerability — dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands

  87. CVE-2017-3881 – Non évaluée Exploitée

    Cisco IOS and IOS XE

    Cisco IOS and IOS XE Remote Code Execution Vulnerability — A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges.

  88. CVE-2017-12617 – Non évaluée Exploitée

    Apache Tomcat

    Apache Tomcat Remote Code Execution Vulnerability — When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

  89. CVE-2015-4068 – Non évaluée Exploitée

    Arcserve Unified Data Protection (UDP)

    Arcserve Unified Data Protection (UDP) Directory Traversal Vulnerability — Directory traversal vulnerability in Arcserve UDP allows remote attackers to obtain sensitive information or cause a denial of service.

  90. CVE-2015-3035 – Non évaluée Exploitée

    TP-Link Multiple Archer Devices

    TP-Link Multiple Archer Devices Directory Traversal Vulnerability — Directory traversal vulnerability in multiple TP-Link Archer devices allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.

  91. CVE-2015-1187 – Non évaluée Exploitée

    D-Link and TRENDnet Multiple Devices

    D-Link and TRENDnet Multiple Devices Remote Code Execution Vulnerability — The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to perform remote code execution.

  92. CVE-2015-0666 – Non évaluée Exploitée

    Cisco Prime Data Center Network Manager (DCNM)

    Cisco Prime Data Center Network Manager (DCNM) Directory Traversal Vulnerability — Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) allows remote attackers to read arbitrary files.

  93. CVE-2014-6332 – Non évaluée Exploitée

    Microsoft Windows

    Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability — OleAut32.dll in OLE in Microsoft Windows allows remote attackers to remotely execute code via a crafted web site.

  94. CVE-2014-6324 – Non évaluée Exploitée

    Microsoft Kerberos Key Distribution Center (KDC)

    Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability — The Kerberos Key Distribution Center (KDC) in Microsoft allows remote authenticated domain users to obtain domain administrator privileges.

  95. CVE-2014-6287 – Non évaluée Exploitée

    Rejetto HTTP File Server (HFS)

    Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability — The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (HFS or HttpFileServer) allows remote attackers to execute arbitrary programs.

  96. CVE-2014-0130 – Non évaluée Exploitée

    Rails Ruby on Rails

    Ruby on Rails Directory Traversal Vulnerability — Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails allows remote attackers to read arbitrary files via a crafted request.

  97. CVE-2013-5223 – Non évaluée Exploitée

    D-Link DSL-2760U

    D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability — A cross-site scripting (XSS) vulnerability exists in the D-Link DSL-2760U gateway, allowing remote authenticated users to inject arbitrary web script or HTML.

  98. CVE-2013-4810 – Non évaluée Exploitée

    Hewlett Packard (HP) ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management

    HP Multiple Products Remote Code Execution Vulnerability — HP ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet.

  99. CVE-2013-2251 – Non évaluée Exploitée

    Apache Struts

    Apache Struts Improper Input Validation Vulnerability — Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigation Language (OGNL) expressions.

  100. CVE-2010-4345 – Non évaluée Exploitée

    Exim Exim

    Exim Privilege Escalation Vulnerability — Exim allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands.

  101. CVE-2010-4344 – Non évaluée Exploitée

    Exim Exim

    Exim Heap-Based Buffer Overflow Vulnerability — Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session.

  102. CVE-2010-3035 – Non évaluée Exploitée

    Cisco IOS XR

    Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability — Cisco IOS XR, when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).

  103. CVE-2010-2861 – Non évaluée Exploitée Rançongiciel

    Adobe ColdFusion

    Adobe ColdFusion Directory Traversal Vulnerability — A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files.

  104. CVE-2009-2055 – Non évaluée Exploitée

    Cisco IOS XR

    Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability — Cisco IOS XR,when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).

  105. CVE-2009-0927 – Non évaluée Exploitée

    Adobe Reader and Acrobat

    Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability — Stack-based buffer overflow in Adobe Reader and Adobe Acrobat allows remote attackers to execute arbitrary code.

  106. CVE-2019-1129 7.8 Élevée Exploitée Rançongiciel

    Microsoft Windows · Microsoft Windows Server · Microsoft Windows 10 Version 1903 for 32-bit Systems · Microsoft Windows 10 Version 1903 for x64-based Systems

    An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1130.

  107. CVE-2019-1069 7.8 Élevée Exploitée Rançongiciel

    Microsoft Windows 10 Version 1703 · Microsoft Windows 10 Version 1803 · Microsoft Windows Server, version 1803 (Server Core Installation) · Microsoft Windows 10 Version 1809

    An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnerability could gain elevated privileges on a victim system. To exploit the vulnerability, an attacker would require unprivileged code execution on a victim system. The security update addresses the vulnerability by correctly validating file operations.

  108. CVE-2019-1064 7.8 Élevée Exploitée Rançongiciel

    Microsoft Windows 10 Version 1703 · Microsoft Windows 10 Version 1803 · Microsoft Windows Server, version 1803 (Server Core Installation) · Microsoft Windows 10 Version 1809

    An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could then install programs; view, change or delete data. To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system. The security update addresses the vulnerability by correcting how Windows AppX Deployment Service handles hard links.

  109. CVE-2019-0841 7.8 Élevée Exploitée Rançongiciel

    Microsoft Windows · Microsoft Windows Server · Microsoft windows 10 1703 · Microsoft windows 10 1709

    An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836.

  110. CVE-2018-8120 7.0 Élevée Exploitée Rançongiciel

    Microsoft Windows Server 2008 · Microsoft Windows 7 · Microsoft Windows Server 2008 R2

    An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows Server 2008, Windows 7, Windows Server 2008 R2. This CVE ID is unique from CVE-2018-8124, CVE-2018-8164, CVE-2018-8166.

  111. CVE-2017-0101 7.8 Élevée Exploitée Rançongiciel

    Microsoft Corporation Windows · Microsoft windows 7 · Microsoft windows server 2008 · Microsoft windows vista

    The kernel-mode drivers in Transaction Manager in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allow local users to gain privileges via a crafted application, aka "Windows Elevation of Privilege Vulnerability."

  112. CVE-2016-3309 7.8 Élevée Exploitée Rançongiciel

    Microsoft windows 10 1507 · Microsoft windows 10 1511 · Microsoft windows 10 1607 · Microsoft windows 7

    The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-3308, CVE-2016-3310, and CVE-2016-3311.

  113. CVE-2015-2546 8.2 Élevée Exploitée Rançongiciel

    Microsoft windows 10 1507 · Microsoft windows 7 · Microsoft windows 8 · Microsoft windows 8.1

    The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Win32k Memory Corruption Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2511, CVE-2015-2517, and CVE-2015-2518.

  114. CVE-2020-5135 – Non évaluée Exploitée Rançongiciel

    SonicWall SonicOS

    SonicWall SonicOS Buffer Overflow Vulnerability — A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall.

  115. CVE-2019-1405 – Non évaluée Exploitée Rançongiciel

    Microsoft Windows

    Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability — A privilege escalation vulnerability exists when the Windows UPnP service improperly allows COM object creation.

  116. CVE-2019-1322 – Non évaluée Exploitée Rançongiciel

    Microsoft Windows

    Microsoft Windows Privilege Escalation Vulnerability — A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context.

  117. CVE-2019-1315 – Non évaluée Exploitée Rançongiciel

    Microsoft Windows

    Microsoft Windows Error Reporting Manager Privilege Escalation Vulnerability — A privilege escalation vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status.

  118. CVE-2019-1253 – Non évaluée Exploitée Rançongiciel

    Microsoft Windows

    Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability — A privilege escalation vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.

  119. CVE-2019-1132 – Non évaluée Exploitée

    Microsoft Win32k

    Microsoft Win32k Privilege Escalation Vulnerability — A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory.

  120. CVE-2019-0543 – Non évaluée Exploitée Rançongiciel

    Microsoft Windows

    Microsoft Windows Privilege Escalation Vulnerability — A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context.

  121. CVE-2022-26486 9.6 Critique Exploitée

    Mozilla Firefox · Mozilla Firefox ESR · Mozilla Firefox for Android · Mozilla Thunderbird

    An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.

  122. CVE-2021-21973 5.3 Moyenne Exploitée

    VMware vCenter Server · VMware Cloud Foundation

    The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).

  123. CVE-2020-8218 7.2 Élevée Exploitée

    Pulse Connect Secure · Ivanti connect secure · Ivanti policy secure · Pulsesecure pulse policy secure

    A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.

  124. CVE-2019-11581 9.8 Critique Exploitée

    Atlassian Jira Server and Data Center · Atlassian jira server

    There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.

  125. CVE-2017-6077 9.8 Critique Exploitée

    Netgear dgn2200 firmware

    ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ping_IPAddr field of an HTTP POST request.

  126. CVE-2016-6277 8.8 Élevée Exploitée

    Netgear d6220 firmware · Netgear d6400 firmware · Netgear r6250 firmware · Netgear r6400 firmware

    NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000, and possibly other routers allow remote attackers to execute arbitrary commands via shell metacharacters in the path info to cgi-bin/.

  127. CVE-2013-0631 7.5 Élevée Exploitée

    Adobe coldfusion

    Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exploited in the wild in January 2013.

  128. CVE-2013-0625 9.8 Critique Exploitée

    Adobe coldfusion

    Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited in the wild in January 2013.

  129. CVE-2009-3960 6.5 Moyenne Exploitée Rançongiciel

    Adobe blazeds · Adobe coldfusion · Adobe flex data services · Adobe livecycle

    Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.

  130. CVE-2022-26485 – Non évaluée Exploitée

    Mozilla Firefox

    Mozilla Firefox Use-After-Free Vulnerability — Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution.

  131. CVE-2013-0629 – Non évaluée Exploitée

    Adobe ColdFusion

    Adobe ColdFusion Directory Traversal Vulnerability — Adobe Coldfusion contains a directory traversal vulnerability, which could permit an unauthorized user access to restricted directories.

  132. CVE-2022-20708 8.0 Élevée Exploitée

    Cisco Small Business RV Series Router Firmware · Cisco rv340 firmware · Cisco rv340w firmware · Cisco rv345 firmware

    Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.

  133. CVE-2022-20703 8.0 Élevée Exploitée

    Cisco Small Business RV Series Router Firmware · Cisco rv340 firmware · Cisco rv340w firmware · Cisco rv345 firmware

    Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.

  134. CVE-2022-20700 9.8 Critique Exploitée

    Cisco Small Business RV Series Router Firmware · Cisco rv340 firmware · Cisco rv340w firmware · Cisco rv345 firmware

    Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.

  135. CVE-2022-20699 9.8 Critique Exploitée

    Cisco Small Business RV Series Router Firmware · Cisco rv340 firmware · Cisco rv340w firmware · Cisco rv345 firmware

    Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.

  136. CVE-2020-11899 5.4 Moyenne Exploitée

    Treck tcp\/ip · Dell wyse 5050 all-in-one firmware · Dell wyse 7030 firmware · Dell wyse 5030 firmware

    The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.

  137. CVE-2020-1938 9.8 Critique Exploitée

    Apache Tomcat · Apache geode · Fedoraproject fedora · Oracle agile engineering data management

    When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.

  138. CVE-2019-1297 8.8 Élevée Exploitée

    Microsoft Excel · Microsoft Office · Microsoft Office 365 ProPlus

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'.

  139. CVE-2018-8581 7.4 Élevée Exploitée Rançongiciel

    Microsoft Exchange Server

    An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server.

  140. CVE-2018-0180 5.9 Moyenne Exploitée

    Cisco IOS

    Multiple vulnerabilities in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service (DoS) condition. These vulnerabilities affect Cisco devices that are running Cisco IOS Software Release 15.4(2)T, 15.4(3)M, or 15.4(2)CG and later. Cisco Bug IDs: CSCuy32360, CSCuz60599.

  141. CVE-2018-0175 8.0 Élevée Exploitée

    Cisco IOS, IOS XE, and IOS XR · Cisco ios · Cisco ios xe · Cisco ios xr

    Format String vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. Cisco Bug IDs: CSCvd73664.

  142. CVE-2018-0173 8.6 Élevée Exploitée

    Cisco IOS and IOS XE · Cisco ios · Cisco ios xe

    A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a Relay Reply denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validation of encapsulated option 82 information that it receives in DHCPOFFER messages from DHCPv4 servers. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device, which the device would then forward to a DHCPv4 server. When the affected software processes the option 82 information that is encapsulated in the response from the server, an error could occur. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCvg62754.

  143. CVE-2018-0172 8.6 Élevée Exploitée

    Cisco IOS and IOS XE · Cisco ios · Cisco ios xe

    A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validation of option 82 information that it receives in DHCP Version 4 (DHCPv4) packets from DHCP relay agents. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device. A successful exploit could allow the attacker to cause a heap overflow condition on the affected device, which will cause the device to reload and result in a DoS condition. Cisco Bug IDs: CSCvg62730.

  144. CVE-2018-0167 8.8 Élevée Exploitée

    Cisco IOS, IOS XE, and IOS XR · Cisco ios · Cisco ios xe · Cisco ios xr

    Multiple Buffer Overflow vulnerabilities in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. Cisco Bug IDs: CSCuo17183, CSCvd73487.

  145. CVE-2018-0161 6.3 Moyenne Exploitée

    Cisco IOS

    A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst Switches could allow an authenticated, remote attacker to cause a denial of service (DoS) condition, aka a GET MIB Object ID Denial of Service Vulnerability. The vulnerability is due to a condition that could occur when the affected software processes an SNMP read request that contains a request for the ciscoFlashMIB object ID (OID). An attacker could trigger this vulnerability by issuing an SNMP GET request for the ciscoFlashMIB OID on an affected device. A successful exploit could cause the affected device to restart due to a SYS-3-CPUHOG. This vulnerability affects the following Cisco devices if they are running a vulnerable release of Cisco IOS Software and are configured to use SNMP Version 2 (SNMPv2) or SNMP Version 3 (SNMPv3): Cisco Catalyst 2960-L Series Switches, Cisco Catalyst Digital Building Series Switches 8P, Cisco Catalyst Digital Building Series Switches 8U. Cisco Bug IDs: CSCvd89541.

  146. CVE-2018-0159 7.5 Élevée Exploitée

    Cisco IOS and IOS XE · Cisco ios · Cisco ios xe

    A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of specific IKEv1 packets. An attacker could exploit this vulnerability by sending crafted IKEv1 packets to an affected device during an IKE negotiation. A successful exploit could allow the attacker to cause an affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCuj73916.

  147. CVE-2018-0158 8.6 Élevée Exploitée

    Cisco IOS and IOS XE · Cisco ios · Cisco ios xe

    A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due to incorrect processing of certain IKEv2 packets. An attacker could exploit this vulnerability by sending crafted IKEv2 packets to an affected device to be processed. A successful exploit could cause an affected device to continuously consume memory and eventually reload, resulting in a DoS condition. Cisco Bug IDs: CSCvf22394.

  148. CVE-2018-0156 7.5 Élevée Exploitée

    Cisco IOS and IOS XE · Cisco ios · Cisco ios xe

    A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted packet to an affected device on TCP port 4786. Only Smart Install client switches are affected. Cisco devices that are configured as a Smart Install director are not affected by this vulnerability. Cisco Bug IDs: CSCvd40673.

  149. CVE-2018-0155 8.6 Élevée Exploitée

    Cisco IOS and IOS XE · Cisco ios · Cisco ios xe

    A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, causing a denial of service (DoS) condition. The vulnerability is due to insufficient error handling when the BFD header in a BFD packet is incomplete. An attacker could exploit this vulnerability by sending a crafted BFD message to or across an affected switch. A successful exploit could allow the attacker to trigger a reload of the system. This vulnerability affects Catalyst 4500 Supervisor Engine 6-E (K5), Catalyst 4500 Supervisor Engine 6L-E (K10), Catalyst 4500 Supervisor Engine 7-E (K10), Catalyst 4500 Supervisor Engine 7L-E (K10), Catalyst 4500E Supervisor Engine 8-E (K10), Catalyst 4500E Supervisor Engine 8L-E (K10), Catalyst 4500E Supervisor Engine 9-E (K10), Catalyst 4500-X Series Switches (K10), Catalyst 4900M Switch (K5), Catalyst 4948E Ethernet Switch (K5). Cisco Bug IDs: CSCvc40729.

  150. CVE-2018-0154 7.5 Élevée Exploitée

    Cisco IOS

    A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient handling of VPN traffic by the affected device. An attacker could exploit this vulnerability by sending crafted VPN traffic to an affected device. A successful exploit could allow the attacker to cause the affected device to hang or crash, resulting in a DoS condition. Cisco Bug IDs: CSCvd39267.