Veille CVE

Semaine du 8 mai au 14 mai 2023

8 CVE

Critique 2 Élevée 3 Moyenne 1 Faible 0 Non évaluée 2 Tri : plus récentes
  1. CVE-2023-25717 9.8 Critique Exploitée

    Ruckuswireless ruckus wireless admin · Ruckuswireless smartzone ap · Commscope ruckus smartzone firmware

    Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.

  2. CVE-2021-3560 7.8 Élevée Exploitée

    polkit · Polkit project polkit · Debian debian linux · Canonical ubuntu linux

    It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

  3. CVE-2016-8735 9.8 Critique Exploitée

    Apache Software Foundation Apache Tomcat · Apache tomcat · Canonical ubuntu linux · Netapp 7-mode transition tool

    Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

  4. CVE-2014-0196 5.5 Moyenne Exploitée

    Linux linux kernel · Debian debian linux · Redhat enterprise linux · Redhat enterprise linux eus

    The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.

  5. CVE-2010-3904 7.8 Élevée Exploitée

    Linux linux kernel · Opensuse opensuse · Suse linux enterprise desktop · Suse linux enterprise real time extension

    The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.

  6. CVE-2016-3427 – Non évaluée Exploitée

    Oracle Java SE and JRockit

    Oracle Java SE and JRockit Unspecified Vulnerability — Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.

  7. CVE-2015-5317 – Non évaluée Exploitée

    Jenkins Jenkins User Interface (UI)

    Jenkins User Interface (UI) Information Disclosure Vulnerability — Jenkins User Interface (UI) contains an information disclosure vulnerability that allows users to see the names of jobs and builds otherwise inaccessible to them on the "Fingerprints" pages.

  8. CVE-2023-29336 7.8 Élevée Exploitée

    Microsoft Windows 10 Version 1507 · Microsoft Windows 10 Version 1607 · Microsoft Windows Server 2016 · Microsoft Windows Server 2016 (Server Core installation)

    Win32k Elevation of Privilege Vulnerability