Veille CVE

Semaine du 30 octobre au 5 novembre 2023

3 CVE

Critique 1 Élevée 0 Moyenne 0 Faible 0 Non évaluée 2 Tri : plus récentes
  1. CVE-2023-46604 9.8 Critique Exploitée Rançongiciel

    Apache Software Foundation Apache ActiveMQ · Apache Software Foundation Apache ActiveMQ Legacy OpenWire Module · Apache activemq · Apache activemq legacy openwire module

    The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

  2. CVE-2023-46748 – Non évaluée Exploitée

    F5 BIG-IP Configuration Utility

    F5 BIG-IP Configuration Utility SQL Injection Vulnerability — F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747.

  3. CVE-2023-46747 – Non évaluée Exploitée Rançongiciel

    F5 BIG-IP Configuration Utility

    F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability — F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748.