Veille CVE

Semaine du 9 septembre au 15 septembre 2024

7 CVE

Critique 1 Élevée 2 Moyenne 0 Faible 0 Non évaluée 4 Tri : plus récentes
  1. CVE-2024-8190 7.2 Élevée Exploitée

    Ivanti CSA (Cloud Services Appliance) · ivanti endpoint_manager_cloud_services_appliance · Ivanti cloud services appliance

    An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.

  2. CVE-2024-38226 – Non évaluée Exploitée

    Microsoft Publisher

    Microsoft Publisher Protection Mechanism Failure Vulnerability — Microsoft Publisher contains a protection mechanism failure vulnerability that allows attacker to bypass Office macro policies used to block untrusted or malicious files.

  3. CVE-2024-38217 – Non évaluée Exploitée

    Microsoft Windows

    Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability — Microsoft Windows Mark of the Web (MOTW) contains a protection mechanism failure vulnerability that allows an attacker to bypass MOTW-based defenses. This can result in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging.

  4. CVE-2024-38014 – Non évaluée Exploitée

    Microsoft Windows

    Microsoft Windows Installer Improper Privilege Management Vulnerability — Microsoft Windows Installer contains an improper privilege management vulnerability that could allow an attacker to gain SYSTEM privileges.

  5. CVE-2024-40766 9.8 Critique Exploitée Rançongiciel

    SonicWall SonicOS

    An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.

  6. CVE-2017-1000253 7.8 Élevée Exploitée Rançongiciel

    centos · redhat enterprise_linux · linux_kernel · Centos centos

    Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the "gap" between the stack and the binary.

  7. CVE-2016-3714 – Non évaluée Exploitée

    ImageMagick ImageMagick

    ImageMagick Improper Input Validation Vulnerability — ImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This allows a remote attacker to execute arbitrary code via shell metacharacters in a crafted image.