Veille CVE

Semaine du 4 novembre au 10 novembre 2024

6 CVE

Critique 1 Élevée 1 Moyenne 0 Faible 0 Non évaluée 4 Tri : plus récentes
  1. CVE-2024-5910 – Non évaluée Exploitée

    Palo Alto Networks Expedition

    Palo Alto Networks Expedition Missing Authentication Vulnerability — Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data.

  2. CVE-2024-51567 – Non évaluée Exploitée Rançongiciel

    CyberPersons CyberPanel

    CyberPanel Incorrect Default Permissions Vulnerability — CyberPanel contains an incorrect default permissions vulnerability that allows a remote, unauthenticated attacker to execute commands as root.

  3. CVE-2024-43093 – Non évaluée Exploitée

    Android Framework

    Android Framework Privilege Escalation Vulnerability — Android Framework contains an unspecified vulnerability that allows for privilege escalation.

  4. CVE-2019-16278 – Non évaluée Exploitée

    Nostromo nhttpd

    Nostromo nhttpd Directory Traversal Vulnerability — Nostromo nhttpd contains a directory traversal vulnerability in the http_verify() function in a non-chrooted nhttpd server allowing for remote code execution.

  5. CVE-2024-8957 7.2 Élevée Exploitée

    PTZOptics PT30X-SDI · PTZOptics PT30X-NDI · ptzoptics pt30x-sdi_firmware · ptzoptics pt30x-ndi_firmware

    PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.

  6. CVE-2024-8956 9.1 Critique Exploitée

    PTZOptics PT30X-SDI · PTZOptics PT30X-NDI · ptzoptics pt30x-sdi_firmware · ptzoptics pt30x-ndi-xx-g2_firmware

    PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.