Mardi 24 mai 2022

Microsoft Windows

Microsoft Windows Kernel Privilege Escalation Vulnerability — A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory.

QNAP Network Attached Storage (NAS)

QNAP NAS File Station Cross-Site Scripting Vulnerability — A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.

QNAP Network Attached Storage (NAS)

QNAP NAS File Station Command Injection Vulnerability — A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.

QNAP Network Attached Storage (NAS)

QNAP NAS File Station Cross-Site Scripting Vulnerability — A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.

Microsoft Windows

Microsoft Windows Search Remote Code Execution Vulnerability — Microsoft Windows allows an attacker to take control of the affected system when Windows Search fails to handle objects in memory.

Artifex Ghostscript

Artifex Ghostscript Type Confusion Vulnerability — Artifex Ghostscript allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile.

Kaseya Virtual System/Server Administrator (VSA)

Kaseya VSA SQL Injection Vulnerability — ConnectWise ManagedITSync integration for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database.

Microsoft Internet Explorer

Microsoft Internet Explorer Privilege Escalation Vulnerability — A privilege escalation vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information.

Microsoft Internet Explorer

Microsoft Internet Explorer Memory Corruption Vulnerability — Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial-of-service (DoS) via a crafted website.

Microsoft SMBv1 server

Microsoft Windows SMBv1 Information Disclosure Vulnerability — The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet.

Microsoft XML Core Services

Microsoft XML Core Services Information Disclosure Vulnerability — Microsoft XML Core Services (MSXML) improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site.

Cisco Adaptive Security Appliance (ASA)

Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability — A vulnerability in the command-line interface (CLI) parser of Cisco ASA software could allow an authenticated, local attacker to create a denial-of-service (DoS) condition or potentially execute code.

Cisco Adaptive Security Appliance (ASA)

Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability — A buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) code of Cisco ASA software could allow an attacker to cause a reload of the affected system or to remotely execute code.

Apple iOS

Apple iOS Webkit Memory Corruption Vulnerability — Apple iOS WebKit contains a memory corruption vulnerability that allows attackers to execute remote code or cause a denial-of-service (DoS) via a crafted web site. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Apple iOS

Apple iOS Memory Corruption Vulnerability — A memory corruption vulnerability in Apple iOS kernel allows attackers to execute code in a privileged context or cause a denial-of-service (DoS) via a crafted application.

Apple iOS

Apple iOS Information Disclosure Vulnerability — The Apple iOS kernel allows attackers to obtain sensitive information from memory via a crafted application.

Microsoft Internet Explorer and Edge

Microsoft Internet Explorer and Edge Information Disclosure Vulnerability — An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer.

Microsoft Internet Explorer

Microsoft Internet Explorer Messaging API Information Disclosure Vulnerability — An information disclosure vulnerability exists when the Microsoft Internet Messaging API improperly handles objects in memory. An attacker who successfully exploited this vulnerability could allow the attacker to test for the presence of files on disk.

Microsoft Internet Explorer

Microsoft Internet Explorer Information Disclosure Vulnerability — An information disclosure vulnerability exists when Internet Explorer does not properly handle JavaScript. The vulnerability could allow an attacker to detect specific files on the user's computer.