Veille CVE

Semaine du 4 avril au 10 avril 2022

7 CVE

Critique 3 Élevée 3 Moyenne 1 Faible 0 Non évaluée 0 Tri : plus récentes
  1. CVE-2021-31166 9.8 Critique Exploitée

    Microsoft Windows 10 Version 2004 · Microsoft Windows Server version 2004 · Microsoft Windows 10 Version 20H2 · Microsoft Windows Server version 20H2

    HTTP Protocol Stack Remote Code Execution Vulnerability

  2. CVE-2021-3156 7.8 Élevée Exploitée

    Sudo project sudo · Fedoraproject fedora · Debian debian linux · Netapp active iq unified manager

    Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

  3. CVE-2017-0148 8.1 Élevée Exploitée Rançongiciel

    Microsoft Corporation Windows SMB · Microsoft server message block · Siemens acuson p300 firmware · Siemens acuson p500 firmware

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0146.

  4. CVE-2022-22675 7.8 Élevée Exploitée

    Apple iOS and iPadOS · Apple macOS · Apple watchOS · Apple ipados

    An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.3.1, iOS 15.4.1 and iPadOS 15.4.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..

  5. CVE-2022-22674 5.5 Moyenne Exploitée

    Apple macOS · Apple mac os x

    An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macOS Monterey 12.3.1, Security Update 2022-004 Catalina, macOS Big Sur 11.6.6. A local user may be able to read kernel memory.

  6. CVE-2022-22965 9.8 Critique Exploitée

    Spring Framework · Vmware spring framework · Cisco cx cloud agent · Oracle communications cloud native core automated test suite

    A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

  7. CVE-2021-45382 9.8 Critique Exploitée

    Dlink dir-820l firmware · Dlink dir-820lw firmware · Dlink dir-826l firmware · Dlink dir-830l firmware

    A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file. Note: DIR-810L, DIR-820L, DIR-830L, DIR-826L, DIR-836L, all hardware revisions, have reached their End of Life ("EOL") /End of Service Life ("EOS") Life-Cycle and as such this issue will not be patched.