Veille CVE

Semaine du 30 septembre au 6 octobre 2024

5 CVE

Critique 4 Élevée 0 Moyenne 0 Faible 0 Non évaluée 1 Tri : plus récentes
  1. CVE-2024-45519 9.8 Critique Exploitée

    Synacor zimbra collaboration suite

    The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.

  2. CVE-2024-29824 – Non évaluée Exploitée

    Ivanti Endpoint Manager (EPM)

    Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability — Ivanti Endpoint Manager (EPM) contains a SQL injection vulnerability in Core server that allows an unauthenticated attacker within the same network to execute arbitrary code.

  3. CVE-2023-25280 9.8 Critique Exploitée

    dlink dir820la1_firmware · Dlink dir-820l firmware

    OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.

  4. CVE-2020-15415 9.8 Critique Exploitée

    draytek vigor3900_firmware · draytek vigor2960_firmware · draytek vigor300b_firmware · Draytek vigor3900 firmware

    On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.

  5. CVE-2019-0344 9.8 Critique Exploitée

    SAP SE SAP Commerce Cloud (virtualjdbc extension) · sap commerce_cloud · Sap commerce cloud

    Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.