Veille CVE

Décembre 2022

9 CVE

Critique 0 Élevée 1 Moyenne 1 Faible 0 Non évaluée 7 Tri : plus récentes
  1. CVE-2018-18809 6.5 Moyenne Exploitée

    TIBCO Software Inc. TIBCO JasperReports Library · TIBCO Software Inc. TIBCO JasperReports Library Community Edition · TIBCO Software Inc. TIBCO JasperReports Library for ActiveMatrix BPM · TIBCO Software Inc. TIBCO JasperReports Server

    The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: versions up to and including 6.3.4; 6.4.1; 6.4.2; 6.4.21; 7.1.0; 7.2.0, TIBCO JasperReports Library Community Edition: versions up to and including 6.7.0, TIBCO JasperReports Library for ActiveMatrix BPM: versions up to and including 6.4.21, TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.3; 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.

  2. CVE-2018-5430 8.8 Élevée Exploitée

    TIBCO Software Inc. TIBCO JasperReports Server · TIBCO Software Inc. TIBCO JasperReports Server Community Edition · TIBCO Software Inc. TIBCO JasperReports Server for ActiveMatrix BPM · TIBCO Software Inc. TIBCO Jaspersoft for AWS with Multi-Tenancy

    The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3;6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.

  3. CVE-2022-42856 – Non évaluée Exploitée

    Apple iOS

    Apple iOS Type Confusion Vulnerability — Apple iOS contains a type confusion vulnerability when processing maliciously crafted web content leading to code execution.

  4. CVE-2022-44698 – Non évaluée Exploitée Rançongiciel

    Microsoft Defender

    Microsoft Defender SmartScreen Security Feature Bypass Vulnerability — Microsoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.

  5. CVE-2022-42475 – Non évaluée Exploitée Rançongiciel

    Fortinet FortiOS

    Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability — Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.

  6. CVE-2022-27518 – Non évaluée Exploitée

    Citrix Application Delivery Controller (ADC) and Gateway

    Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability — Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator.

  7. CVE-2022-26501 – Non évaluée Exploitée Rançongiciel

    Veeam Backup & Replication

    Veeam Backup & Replication Remote Code Execution Vulnerability — The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.

  8. CVE-2022-26500 – Non évaluée Exploitée Rançongiciel

    Veeam Backup & Replication

    Veeam Backup & Replication Remote Code Execution Vulnerability — The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.

  9. CVE-2022-4262 – Non évaluée Exploitée

    Google Chromium V8

    Google Chromium V8 Type Confusion Vulnerability — Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.