Veille CVE

Avril 2023

17 CVE

Critique 2 Élevée 8 Moyenne 1 Faible 1 Non évaluée 5 Tri : plus récentes
  1. CVE-2023-27350 9.8 Critique Exploitée Rançongiciel

    PaperCut NG · Papercut papercut mf · Papercut papercut ng

    This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.

  2. CVE-2023-2136 9.6 Critique Exploitée

    Google Chrome · Debian debian linux · Fedoraproject fedora

    Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

  3. CVE-2023-28432 7.5 Élevée Exploitée

    minio · Minio minio

    Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.

  4. CVE-2017-6742 – Non évaluée Exploitée

    Cisco IOS and IOS XE Software

    Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability — The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.

  5. CVE-2023-2033 8.8 Élevée Exploitée

    Google Chrome · Debian debian linux · Fedoraproject fedora · Couchbase couchbase server

    Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

  6. CVE-2019-8526 7.8 Élevée Exploitée

    Apple macOS · Apple mac os x

    A use after free issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.4. An application may be able to gain elevated privileges.

  7. CVE-2023-29492 – Non évaluée Exploitée

    Novi Survey Novi Survey

    Novi Survey Insecure Deserialization Vulnerability — Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context of the service account.

  8. CVE-2023-20963 – Non évaluée Exploitée

    Android Framework

    Android Framework Privilege Escalation Vulnerability — Android Framework contains an unspecified vulnerability that allows for privilege escalation after updating an app to a higher Target SDK with no additional execution privileges needed.

  9. CVE-2023-28252 7.8 Élevée Exploitée Rançongiciel

    Microsoft Windows 10 Version 1809 · Microsoft Windows Server 2019 · Microsoft Windows Server 2019 (Server Core installation) · Microsoft Windows Server 2022

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

  10. CVE-2023-28205 8.8 Élevée Exploitée

    Apple iOS and iPadOS · Apple Safari · Apple macOS · Apple ipados

    A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

  11. CVE-2023-28206 – Non évaluée Exploitée

    Apple iOS, iPadOS, and macOS

    Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability — Apple iOS, iPadOS, and macOS IOSurfaceAccelerator contain an out-of-bounds write vulnerability that allows an app to execute code with kernel privileges.

  12. CVE-2023-26083 3.3 Faible Exploitée

    Arm 5th gen gpu architecture kernel driver · Arm bifrost gpu kernel driver · Arm midgard gpu kernel driver · Arm valhall gpu kernel driver

    Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver all versions from r0p0 - r42p0, Valhall GPU Kernel Driver all versions from r19p0 - r42p0, and Avalon GPU Kernel Driver all versions from r41p0 - r42p0 allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata.

  13. CVE-2021-27878 8.8 Élevée Exploitée Rançongiciel

    Veritas backup exec

    An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. The attacker could use one of these commands to execute an arbitrary command on the system using system privileges.

  14. CVE-2021-27876 8.1 Élevée Exploitée Rançongiciel

    Veritas backup exec

    An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. By using crafted input parameters in one of these commands, an attacker can access an arbitrary file on the system using System privileges.

  15. CVE-2019-1388 7.8 Élevée Exploitée Rançongiciel

    Microsoft Windows · Microsoft Windows Server · Microsoft Windows 10 Version 1903 for 32-bit Systems · Microsoft Windows 10 Version 1903 for x64-based Systems

    An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Windows Certificate Dialog Elevation of Privilege Vulnerability'.

  16. CVE-2021-27877 – Non évaluée Exploitée Rançongiciel

    Veritas Backup Exec Agent

    Veritas Backup Exec Agent Improper Authentication Vulnerability — Veritas Backup Exec (BE) Agent contains an improper authentication vulnerability that could allow an attacker unauthorized access to the BE Agent via SHA authentication scheme.

  17. CVE-2022-27926 6.1 Moyenne Exploitée

    Synacor zimbra collaboration suite

    A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.