Veille CVE

Semaine du 24 octobre au 30 octobre 2022

8 CVE

Critique 1 Élevée 4 Moyenne 1 Faible 0 Non évaluée 2 Tri : plus récentes
  1. CVE-2022-3723 – Non évaluée Exploitée

    Google Chromium V8

    Google Chromium V8 Type Confusion Vulnerability — Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

  2. CVE-2022-42827 7.8 Élevée Exploitée

    Apple iOS and iPadOS · Apple ipados · Apple iphone os

    An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, iOS 16.1 and iPadOS 16. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..

  3. CVE-2020-3433 7.8 Élevée Exploitée Rançongiciel

    Cisco AnyConnect Secure Mobility Client

    A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system.

  4. CVE-2020-3153 6.5 Moyenne Exploitée Rançongiciel

    Cisco AnyConnect Secure Mobility Client

    A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. An exploit could allow the attacker to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.

  5. CVE-2018-19323 9.8 Critique Exploitée Rançongiciel

    Gigabyte aorus graphics engine · Gigabyte gigabyte app center · Gigabyte oc guru ii · Gigabyte xtreme gaming engine

    The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes functionality to read and write Machine Specific Registers (MSRs).

  6. CVE-2018-19322 7.8 Élevée Exploitée Rançongiciel

    Gigabyte aorus graphics engine · Gigabyte app center · Gigabyte oc guru ii · Gigabyte xtreme gaming engine

    The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.

  7. CVE-2018-19321 7.8 Élevée Exploitée Rançongiciel

    Gigabyte aorus graphics engine · Gigabyte app center · Gigabyte oc guru ii · Gigabyte xtreme gaming engine

    The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.

  8. CVE-2018-19320 – Non évaluée Exploitée Rançongiciel

    GIGABYTE Multiple Products

    GIGABYTE Multiple Products Unspecified Vulnerability — The GDrv low-level driver in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.