Veille CVE

Semaine du 29 juillet au 4 août 2024

4 CVE

Critique 0 Élevée 1 Moyenne 0 Faible 0 Non évaluée 3 Tri : plus récentes
  1. CVE-2024-37085 7.2 Élevée Exploitée Rançongiciel

    vmware esxi · VMware Cloud Foundation · vmware cloud_foundation

    VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.

  2. CVE-2024-5217 – Non évaluée Exploitée

    ServiceNow Utah, Vancouver, and Washington DC Now Platform

    ServiceNow Incomplete List of Disallowed Inputs Vulnerability — ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script. An unauthenticated user could exploit this vulnerability to execute code remotely.

  3. CVE-2024-4879 – Non évaluée Exploitée

    ServiceNow Utah, Vancouver, and Washington DC Now Platform

    ServiceNow Improper Input Validation Vulnerability — ServiceNow Utah, Vancouver, and Washington DC Now Platform releases contain a jelly template injection vulnerability in UI macros. An unauthenticated user could exploit this vulnerability to execute code remotely.

  4. CVE-2023-45249 – Non évaluée Exploitée

    Acronis Cyber Infrastructure (ACI)

    Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability — Acronis Cyber Infrastructure (ACI) allows an unauthenticated user to execute commands remotely due to the use of default passwords.