Veille CVE

Janvier 2025

14 CVE

Critique 5 Élevée 3 Moyenne 1 Faible 1 Non évaluée 4 Tri : plus récentes
  1. CVE-2025-24085 10.0 Critique Exploitée

    Apple iOS and iPadOS · Apple iPadOS · Apple macOS · Apple tvOS

    A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3, watchOS 11.3. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2.

  2. CVE-2025-23006 – Non évaluée Exploitée Rançongiciel

    SonicWall SMA1000 Appliances

    SonicWall SMA1000 Appliances Deserialization Vulnerability — SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbitrary OS commands.

  3. CVE-2020-11023 6.1 Moyenne Exploitée

    jQuery · Jquery jquery · Debian debian linux · Fedoraproject fedora

    In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

  4. CVE-2024-50603 9.8 Critique Exploitée

    Aviatrix Controller

    An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.

  5. CVE-2025-21335 7.8 Élevée Exploitée

    Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 version 22H2 · Microsoft Windows 11 version 22H3

    Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

  6. CVE-2025-21334 7.8 Élevée Exploitée

    Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 version 22H2 · Microsoft Windows 11 version 22H3

    Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

  7. CVE-2025-21333 7.8 Élevée Exploitée

    Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 version 22H2 · Microsoft Windows 11 version 22H3

    Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

  8. CVE-2024-55591 9.8 Critique Exploitée Rançongiciel

    Fortinet FortiOS · Fortinet FortiProxy

    An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.

  9. CVE-2024-12686 – Non évaluée Exploitée

    BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS)

    BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability — BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user.

  10. CVE-2023-48365 – Non évaluée Exploitée Rançongiciel

    Qlik Sense

    Qlik Sense HTTP Tunneling Vulnerability — Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.

  11. CVE-2025-0282 – Non évaluée Exploitée Rançongiciel

    Ivanti Connect Secure, Policy Secure, and ZTA Gateways

    Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability — Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.

  12. CVE-2024-55550 2.7 Faible Exploitée Rançongiciel

    Mitel micollab

    Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access level, and the disclosure is limited to non-sensitive system information. This vulnerability does not allow file modification or privilege escalation.

  13. CVE-2024-41713 9.1 Critique Exploitée Rançongiciel

    mitel micollab

    A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.

  14. CVE-2020-2883 9.8 Critique Exploitée

    Oracle Corporation WebLogic Server · Oracle weblogic server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).