Veille CVE
Juin 2022
48 CVE
-
Mitel mivoice connect
The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.
-
polkit · Polkit project polkit · Redhat enterprise linux server update services for sap solutions · Redhat enterprise linux
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
-
Apple iOS and iPadOS · Apple ipados · Apple iphone os
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 15.2 and iPadOS 15.2. An application may be able to execute arbitrary code with kernel privileges.
-
Google Chrome · Fedoraproject fedora
Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted iframe.
-
Apple iOS · Apple tvOS · Apple ipados · Apple iphone os
A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8. An application may be able to execute arbitrary code with kernel privileges.
-
Apple iOS · Apple macOS · Apple tvOS · Apple watchOS
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges.
-
Apple iOS · Apple macOS · Apple tvOS · Apple watchOS
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1. A malicious application may be able to execute arbitrary code with system privileges.
-
iOS, macOS, tvOS, watchOS · Apple iphone os · Apple mac os x · Apple tvos
A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5.
-
Microsoft Windows 10 Version 1809 · Microsoft Windows Server 2019 · Microsoft Windows Server 2019 (Server Core installation) · Microsoft Windows 10 Version 21H1
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.
-
SAP NetWeaver
SAP NetWeaver Unrestricted File Upload Vulnerability — SAP NetWeaver contains a vulnerability that allows unrestricted file upload.
-
SAP NetWeaver
SAP NetWeaver Information Disclosure Vulnerability — The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request.
-
SAP NetWeaver
SAP NetWeaver SQL Injection Vulnerability — SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
-
QNAP NAS devices · Qnap qts
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.
-
Adobe Acrobat and Reader 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier versions · Adobe acrobat dc · Adobe acrobat reader dc
Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Double Free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
-
QNAP Photo Station
QNAP Photo Station Path Traversal Vulnerability — QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.
-
QNAP Photo Station
QNAP Photo Station Path Traversal Vulnerability — QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.
-
QNAP Photo Station
QNAP Photo Station Improper Access Control Vulnerability — QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing remote attackers to gain unauthorized access to the system.
-
Google Chromium V8
Google Chromium V8 Out-of-Bounds Write Vulnerability — Google Chromium V8 Engine contains an out-of-bounds write vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
-
Cisco RV Series Routers
Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability — A deserialization of untrusted data vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an attacker to execute code with root privileges.
-
Google Chromium V8
Google Chromium V8 Integer Overflow Vulnerability — Google Chromium V8 Engine contains an integer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
-
Google Chromium V8
Google Chromium V8 Out-of-Bounds Write Vulnerability — Google Chromium V8 Engine contains out-of-bounds write vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
-
Google Chromium V8
Google Chromium V8 Remote Code Execution Vulnerability — Google Chromium V8 Engine contains an unspecified vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
-
NETGEAR Multiple Devices
NETGEAR Multiple Devices Buffer Overflow Vulnerability — Multiple NETGEAR devices contain a buffer overflow vulnerability that allows for authentication bypass and remote code execution.
-
Google Chromium V8
Google Chromium V8 Type Confusion Vulnerability — Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
-
Google Chromium V8
Google Chromium V8 Memory Corruption Vulnerability — Google Chromium V8 Engine contains a memory corruption vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
-
Google Chromium V8
Google Chromium V8 Out-of-Bounds Memory Vulnerability — Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to perform read/write operations, leading to code execution, via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
-
Google Chromium V8
Google Chromium V8 Out-of-Bounds Read Vulnerability — Google Chromium V8 Engine contains an out-of-bounds read vulnerability that allows a remote attacker to cause a denial of service or possibly have another unspecified impact via crafted JavaScript code. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
-
Microsoft Office
Microsoft Office Buffer Overflow Vulnerability — Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via crafted PNG data in an Office document.
-
Adobe Flash Player
Adobe Flash Player Integer Overflow Vulnerability — Adobe Flash Player contains an integer overflow vulnerability that allows remote attackers to execute code via malformed arguments.
-
Microsoft Internet Explorer
Microsoft Internet Explorer Use-After-Free Vulnerability — Microsoft Internet Explorer contains a use-after-free vulnerability that allows remote attackers to execute code via a crafted web site.
-
Microsoft XML Core Services
Microsoft XML Core Services Memory Corruption Vulnerability — Microsoft XML Core Services contains a memory corruption vulnerability which could allow for remote code execution.
-
Adobe Flash Player
Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability — Adobe Flash Player contains a XSS vulnerability that allows remote attackers to inject web script or HTML.
-
Adobe Flash Player
Adobe Flash Player Memory Corruption Vulnerability — Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
-
Microsoft Windows
Microsoft Windows Authenticode Signature Verification Remote Code Execution Vulnerability — The Authenticode Signature Verification function in Microsoft Windows (WinVerifyTrust) does not properly validate the digest of a signed portable executable (PE) file, which allows user-assisted remote attackers to execute code.
-
Adobe Reader and Acrobat
Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability — The Universal 3D (U3D) component in Adobe Reader and Acrobat contains a memory corruption vulnerability which could allow remote attackers to execute code or cause denial-of-service (DoS).
-
Adobe Flash Player
Adobe Flash Player Unspecified Vulnerability — Adobe Flash Player contains an unspecified vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
-
Adobe Acrobat and Reader
Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability — Adobe Acrobat and Reader contain a stack-based buffer overflow vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
-
Microsoft PowerPoint
Microsoft PowerPoint Buffer Overflow Vulnerability — Microsoft PowerPoint contains a buffer overflow vulnerability that alllows for remote code execution.
-
Adobe Flash Player
Adobe Flash Player Memory Corruption Vulnerability — Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
-
Adobe Acrobat and Reader
Adobe Acrobat and Reader Use-After-Free Vulnerability — Use-after-free vulnerability in Adobe Acrobat and Reader allows remote attackers to execute code via a crafted PDF file.
-
Adobe Acrobat and Reader
Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability — Adobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution.
-
Adobe Acrobat and Reader, Flash Player
Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability — Adobe Acrobat and Reader and Adobe Flash Player allows remote attackers to execute code or cause denial-of-service (DoS).
-
Microsoft Office
Microsoft Office Buffer Overflow Vulnerability — Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via a Word document with a crafted tag containing an invalid length field.
-
Microsoft Office
Microsoft Office Object Record Corruption Vulnerability — Microsoft Office contains an object record corruption vulnerability that allows remote attackers to execute code via a crafted Excel file with a malformed record object.
-
Adobe Acrobat and Reader
Adobe Acrobat and Reader Unspecified Vulnerability — Adobe Acrobat and Reader contains an unespecified vulnerability described as a design flaw which could allow a specially crafted file to be printed silently an arbitrary number of times.
-
Adobe Acrobat and Reader
Adobe Acrobat and Reader Buffer Overflow Vulnerability — Adobe Acrobat and Reader contain a buffer overflow vulnerability that allows remote attackers to execute code via a PDF file with long arguments to unspecified JavaScript methods.
-
Microsoft Word
Microsoft Word Malformed Object Pointer Vulnerability — Microsoft Word and Microsoft Works Suites contain a malformed object pointer which allows attackers to execute code.
-
Atlassian Confluence Data Center · Atlassian Confluence Server
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.