Veille CVE
Décembre 2023
11 CVE
-
QNAP Systems Inc. VioStor NVR · Qnap qvr firmware
An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions: QVR Firmware 5.0.0 and later
-
FXC Inc. AE1021PE · FXC Inc. AE1021 · Fxc ae1021 firmware · Fxc ae1021pe firmware
An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
-
unitronics visilogic · Unitronics vision1210 firmware · Unitronics vision1040 firmware · Unitronics vision700 firmware
Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.
-
Qlik Sense
Qlik Sense Path Traversal Vulnerability — Qlik Sense contains a path traversal vulnerability that allows a remote, unauthenticated attacker to create an anonymous session by sending maliciously crafted HTTP requests. This anonymous session could allow the attacker to send further requests to unauthorized endpoints.
-
Qlik Sense
Qlik Sense HTTP Tunneling Vulnerability — Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.
-
Qualcomm Multiple Chipsets
Qualcomm Multiple Chipsets Integer Overflow Vulnerability — Multiple Qualcomm chipsets contain an integer overflow vulnerability due to memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
-
Qualcomm Multiple Chipsets
Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability — Multiple Qualcomm chipsets contain a use of out-of-range pointer offset vulnerability due to memory corruption in Graphics while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.
-
Qualcomm Multiple Chipsets
Qualcomm Multiple Chipsets Use-After-Free Vulnerability — Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services during a remote call from HLOS to DSP.
-
Qualcomm Multiple Chipsets
Qualcomm Multiple Chipsets Use-After-Free Vulnerability — Multiple Qualcomm chipsets contain a use-after-free vulnerability when process shell memory is freed using IOCTL munmap call and process initialization is in progress.
-
Apple Safari · Apple macOS · Apple iOS and iPadOS · Apple ipados
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.
-
Apple Multiple Products
Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability — Apple iOS, iPadOS, macOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.