Veille CVE
Juillet 2023
16 CVE
-
Ivanti EPMM · Ivanti endpoint manager mobile
A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to write arbitrary files onto the appliance.
-
Synacor Zimbra Collaboration Suite (ZCS)
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability — Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability impacting the confidentiality and integrity of data.
-
Apple tvOS · Apple iOS and iPadOS · Apple macOS · Apple watchOS
This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to modify sensitive kernel state. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1.
-
Ivanti Endpoint Manager Mobile · ivanti endpoint_manager_mobile
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.
-
Adobe ColdFusion
Adobe ColdFusion Improper Access Control Vulnerability — Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.
-
Adobe ColdFusion
Adobe ColdFusion Improper Access Control Vulnerability — Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.
-
Citrix NetScaler ADC · Citrix NetScaler Gateway · Citrix netscaler application delivery controller
Unauthenticated remote code execution
-
Microsoft Windows 10 Version 1507 · Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2
Windows Search Remote Code Execution Vulnerability
-
Apple Multiple Products
Apple Multiple Products WebKit Code Execution Vulnerability — Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
-
SolarView Compact
SolarView Compact Command Injection Vulnerability — SolarView Compact contains a command injection vulnerability due to improper validation of input values on the send test mail console of the product's web server.
-
Microsoft Windows
Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability — Microsoft Windows Error Reporting Service contains an unspecified vulnerability that allows for privilege escalation.
-
Microsoft Outlook
Microsoft Outlook Security Feature Bypass Vulnerability — Microsoft Outlook contains a security feature bypass vulnerability that allows an attacker to bypass the Microsoft Outlook Security Notice prompt.
-
Microsoft Windows
Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability — Microsoft Windows Defender SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the Open File - Security Warning prompt.
-
Microsoft Windows
Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability — Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for privilege escalation.
-
Netwrix Auditor
Netwrix Auditor Insecure Object Deserialization Vulnerability — Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\SYSTEM user. Successful exploitation requires that the attacker is able to reach port 9004/TCP, which is commonly blocked by standard enterprise firewalling.
-
Arm bifrost gpu kernel driver · Arm midgard gpu kernel driver · Arm valhall gpu kernel driver
. The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information disclosure or root privilege escalation. This affects Bifrost r16p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r28p0 through r30p0.