Veille CVE

Semaine du 19 juin au 25 juin 2023

11 CVE

Critique 3 Élevée 3 Moyenne 1 Faible 1 Non évaluée 3 Tri : plus récentes
  1. CVE-2023-32435 8.8 Élevée Exploitée

    Apple macOS · Apple iOS and iPadOS · Apple Safari · Apple ipados

    A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.7 and iPadOS 15.7.7. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.

  2. CVE-2023-27992 9.8 Critique Exploitée

    Zyxel NAS326 firmware · Zyxel NAS540 firmware · Zyxel NAS542 firmware

    The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.

  3. CVE-2023-20867 3.9 Faible Exploitée

    VMware Tools · Debian debian linux · Fedoraproject fedora

    A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.

  4. CVE-2023-32439 – Non évaluée Exploitée

    Apple Multiple Products

    Apple Multiple Products WebKit Type Confusion Vulnerability — Apple iOS, iPadOS, macOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

  5. CVE-2023-32434 – Non évaluée Exploitée

    Apple Multiple Products

    Apple Multiple Products Integer Overflow Vulnerability — Apple iOS. iPadOS, macOS, and watchOS contain an integer overflow vulnerability that could allow an application to execute code with kernel privileges.

  6. CVE-2023-20887 9.8 Critique Exploitée

    Aria Operations for Networks (Formerly vRealize Network Insight) · Vmware aria operations for networks

    Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.

  7. CVE-2020-35730 6.1 Moyenne Exploitée

    Roundcube webmail · Fedoraproject fedora · Debian debian linux

    An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.

  8. CVE-2020-12641 9.8 Critique Exploitée

    Roundcube webmail · Opensuse backports sle · Opensuse leap

    rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.

  9. CVE-2016-9079 7.5 Élevée Exploitée

    Mozilla Firefox · Mozilla Firefox ESR · Mozilla Thunderbird · Debian debian linux

    A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.

  10. CVE-2016-0165 7.8 Élevée Exploitée

    Microsoft windows 10 1507 · Microsoft windows 10 1511 · Microsoft windows 7 · Microsoft windows 8.1

    The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0143 and CVE-2016-0167.

  11. CVE-2021-44026 – Non évaluée Exploitée

    Roundcube Roundcube Webmail

    Roundcube Webmail SQL Injection Vulnerability — Roundcube Webmail is vulnerable to SQL injection via search or search_params.