Veille CVE

Semaine du 16 mai au 22 mai 2022

2 CVE

Critique 2 Élevée 0 Moyenne 0 Faible 0 Non évaluée 0 Tri : plus récentes
  1. CVE-2022-30525 9.8 Critique Exploitée

    Zyxel USG FLEX 100(W) firmware · Zyxel USG FLEX 200 firmware · Zyxel USG FLEX 500 firmware · Zyxel USG FLEX 700 firmware

    A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.

  2. CVE-2022-22947 10.0 Critique Exploitée

    Spring Cloud Gateway · Vmware spring cloud gateway · Oracle commerce guided search · Oracle communications cloud native core binding support function

    In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.