Veille CVE

Semaine du 16 septembre au 22 septembre 2024

11 CVE

Critique 5 Élevée 3 Moyenne 0 Faible 0 Non évaluée 3 Tri : plus récentes
  1. CVE-2024-8963 9.1 Critique Exploitée

    Ivanti CSA (Cloud Services Appliance) · ivanti endpoint_manager_cloud_services_appliance · Ivanti endpoint manager cloud services appliance

    Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.

  2. CVE-2024-27348 9.8 Critique Exploitée

    Apache Software Foundation Apache HugeGraph-Server · apache hugegraph-server · Apache hugegraph

    RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.

  3. CVE-2020-14644 9.8 Critique Exploitée

    Oracle Corporation WebLogic Server · oracle weblogic_server · Oracle weblogic server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

  4. CVE-2020-0618 8.8 Élevée Exploitée Rançongiciel

    Microsoft SQL Server · Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR) · Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU) · Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)

    A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.

  5. CVE-2022-21445 – Non évaluée Exploitée

    Oracle ADF Faces

    Oracle ADF Faces Deserialization of Untrusted Data Vulnerability — Oracle ADF Faces library, included with Oracle JDeveloper Distribution, contains a deserialization of untrusted data vulnerability leading to unauthenticated remote code execution.

  6. CVE-2014-0502 8.8 Élevée Exploitée

    adobe flash_player · adobe air · adobe air_sdk · Adobe flash player

    Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2014.

  7. CVE-2014-0497 9.8 Critique Exploitée

    adobe flash_player · Adobe flash player · Google chrome · Redhat enterprise linux desktop

    Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.

  8. CVE-2013-0648 – Non évaluée Exploitée

    Adobe Flash Player

    Adobe Flash Player Code Execution Vulnerability — Adobe Flash Player contains an unspecified vulnerability in the ExternalInterface ActionScript functionality that allows a remote attacker to execute arbitrary code via crafted SWF content.

  9. CVE-2013-0643 – Non évaluée Exploitée

    Adobe Flash Player

    Adobe Flash Player Incorrect Default Permissions Vulnerability — Adobe Flash Player contains an incorrect default permissions vulnerability in the Firefox sandbox that allows a remote attacker to execute arbitrary code via crafted SWF content.

  10. CVE-2024-43461 8.8 Élevée Exploitée

    Microsoft Windows 10 Version 1507 · Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2

    Windows MSHTML Platform Spoofing Vulnerability

  11. CVE-2024-6670 9.8 Critique Exploitée Rançongiciel

    Progress Software Corporation WhatsUp Gold · progress whatsupgold · Progress whatsup gold

    In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.