Veille CVE

Février 2023

14 CVE

Critique 1 Élevée 4 Moyenne 2 Faible 0 Non évaluée 7 Tri : plus récentes
  1. CVE-2022-36537 7.5 Élevée Exploitée Rançongiciel

    Zkoss zk framework

    ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.

  2. CVE-2022-47986 9.8 Critique Exploitée Rançongiciel

    IBM Aspera Faspex

    IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.

  3. CVE-2022-41223 6.8 Moyenne Exploitée Rançongiciel

    Mitel mivoice connect

    The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.

  4. CVE-2022-40765 6.8 Moyenne Exploitée Rançongiciel

    Mitel mivoice connect

    A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to insufficient restriction of URL parameters.

  5. CVE-2022-46169 – Non évaluée Exploitée

    Cacti Cacti

    Cacti Command Injection Vulnerability — Cacti contains a command injection vulnerability that allows an unauthenticated user to execute code.

  6. CVE-2023-21823 7.8 Élevée Exploitée

    Microsoft Office for Android · Microsoft Office for iOS · Microsoft Office for Universal · Microsoft Windows 10 Version 1507

    Windows Graphics Component Remote Code Execution Vulnerability

  7. CVE-2023-23376 7.8 Élevée Exploitée Rançongiciel

    Microsoft Windows 10 Version 1507 · Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 20H2

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

  8. CVE-2023-23529 – Non évaluée Exploitée

    Apple Multiple Products

    Apple Multiple Products WebKit Type Confusion Vulnerability — Apple iOS, MacOS, Safari and iPadOS WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

  9. CVE-2023-21715 – Non évaluée Exploitée

    Microsoft Office

    Microsoft Office Publisher Security Feature Bypass Vulnerability — Microsoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system.

  10. CVE-2022-24990 7.5 Élevée Exploitée Rançongiciel

    Terra-master terramaster operating system

    TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.

  11. CVE-2023-0669 – Non évaluée Exploitée Rançongiciel

    Fortra GoAnywhere MFT

    Fortra GoAnywhere MFT Remote Code Execution Vulnerability — Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.

  12. CVE-2015-2291 – Non évaluée Exploitée Rançongiciel

    Intel Ethernet Diagnostics Driver for Windows

    Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability — Intel ethernet diagnostics driver for Windows IQVW32.sys and IQVW64.sys contain an unspecified vulnerability that allows for a denial-of-service (DoS).

  13. CVE-2023-22952 – Non évaluée Exploitée

    SugarCRM Multiple Products

    Multiple SugarCRM Products Remote Code Execution Vulnerability — Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.

  14. CVE-2022-21587 – Non évaluée Exploitée Rançongiciel

    Oracle E-Business Suite

    Oracle E-Business Suite Unspecified Vulnerability — Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.