Veille CVE
Semaine du 2 octobre au 8 octobre 2023
7 CVE
-
Apple iOS and iPadOS · Apple ipados · Apple iphone os
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.1 and iPadOS 16.7.1. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6.
-
Atlassian Confluence Data Center · Atlassian Confluence Server
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
-
Progress Software Corporation WS_FTP Server · Progress ws ftp server
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.
-
JetBrains TeamCity
JetBrains TeamCity Authentication Bypass Vulnerability — JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server.
-
Microsoft Windows CNG Key Isolation Service
Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability — Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain specific limited SYSTEM privileges.
-
Arm Mali GPU Kernel Driver
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability — Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that allows a local, non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.
-
Google Chromium libvpx
Google Chromium libvpx Heap Buffer Overflow Vulnerability — Google Chromium libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using libvpx, including but not limited to Google Chrome.