Veille CVE

Février 2023

14 CVE

Critique 1 Élevée 1 Moyenne 2 Faible 0 Non évaluée 10 Tri : plus récentes
  1. CVE-2022-36537 7.5 Élevée Exploitée Rançongiciel

    Zkoss zk framework

    ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.

  2. CVE-2022-47986 9.8 Critique Exploitée Rançongiciel

    IBM Aspera Faspex

    IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.

  3. CVE-2022-41223 6.8 Moyenne Exploitée Rançongiciel

    Mitel mivoice connect

    The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.

  4. CVE-2022-40765 6.8 Moyenne Exploitée Rançongiciel

    Mitel mivoice connect

    A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to insufficient restriction of URL parameters.

  5. CVE-2022-46169 – Non évaluée Exploitée

    Cacti Cacti

    Cacti Command Injection Vulnerability — Cacti contains a command injection vulnerability that allows an unauthenticated user to execute code.

  6. CVE-2023-23529 – Non évaluée Exploitée

    Apple Multiple Products

    Apple Multiple Products WebKit Type Confusion Vulnerability — Apple iOS, MacOS, Safari and iPadOS WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

  7. CVE-2023-23376 – Non évaluée Exploitée Rançongiciel

    Microsoft Windows

    Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability — Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.

  8. CVE-2023-21823 – Non évaluée Exploitée

    Microsoft Windows

    Microsoft Windows Graphic Component Privilege Escalation Vulnerability — Microsoft Windows Graphic Component contains an unspecified vulnerability that allows for privilege escalation.

  9. CVE-2023-21715 – Non évaluée Exploitée

    Microsoft Office

    Microsoft Office Publisher Security Feature Bypass Vulnerability — Microsoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system.

  10. CVE-2023-0669 – Non évaluée Exploitée Rançongiciel

    Fortra GoAnywhere MFT

    Fortra GoAnywhere MFT Remote Code Execution Vulnerability — Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.

  11. CVE-2022-24990 – Non évaluée Exploitée Rançongiciel

    TerraMaster TerraMaster OS

    TerraMaster OS Remote Command Execution Vulnerability — TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.

  12. CVE-2015-2291 – Non évaluée Exploitée Rançongiciel

    Intel Ethernet Diagnostics Driver for Windows

    Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability — Intel ethernet diagnostics driver for Windows IQVW32.sys and IQVW64.sys contain an unspecified vulnerability that allows for a denial-of-service (DoS).

  13. CVE-2023-22952 – Non évaluée Exploitée

    SugarCRM Multiple Products

    Multiple SugarCRM Products Remote Code Execution Vulnerability — Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.

  14. CVE-2022-21587 – Non évaluée Exploitée Rançongiciel

    Oracle E-Business Suite

    Oracle E-Business Suite Unspecified Vulnerability — Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.