Veille CVE

Juin 2024

9 CVE

Critique 2 Élevée 4 Moyenne 1 Faible 0 Non évaluée 2 Tri : plus récentes
  1. CVE-2022-2586 7.8 Élevée Exploitée

    The Linux Kernel Organization linux · linux_kernel · Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem · Siemens simatic s7-1500 tm mfp firmware

    It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.

  2. CVE-2022-24816 10.0 Critique Exploitée

    geosolutions-it jai-ext · geosolutionsgroup jai-ext

    JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.

  3. CVE-2020-13965 6.1 Moyenne Exploitée

    roundcube webmail · Debian debian linux · Fedoraproject fedora

    An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.

  4. CVE-2024-32896 7.8 Élevée Exploitée

    google android

    there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

  5. CVE-2024-4358 9.8 Critique Exploitée

    Progress Software Corporation Telerik Report Server · progress_software telerik_report_server · Telerik report server 2024

    In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.

  6. CVE-2024-26169 7.8 Élevée Exploitée Rançongiciel

    Microsoft Windows 10 Version 1809 · Microsoft Windows Server 2019 · Microsoft Windows Server 2019 (Server Core installation) · Microsoft Windows Server 2022

    Windows Error Reporting Service Elevation of Privilege Vulnerability

  7. CVE-2024-4610 7.8 Élevée Exploitée

    Arm Ltd Bifrost GPU Kernel Driver · Arm Ltd Valhall GPU Kernel Driver · arm bifrost_gpu_kernel_driver · arm valhall_gpu_kernel_driver

    Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r34p0 through r40p0; Valhall GPU Kernel Driver: from r34p0 through r40p0.

  8. CVE-2024-4577 – Non évaluée Exploitée Rançongiciel

    PHP Group PHP

    PHP-CGI OS Command Injection Vulnerability — PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.

  9. CVE-2017-3506 – Non évaluée Exploitée

    Oracle WebLogic Server

    Oracle WebLogic Server OS Command Injection Vulnerability — Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document.