Veille CVE
Semaine du 13 janvier au 19 janvier 2025
7 CVE
-
Aviatrix Controller
An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.
-
Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 version 22H2 · Microsoft Windows 11 version 22H3
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
-
Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 version 22H2 · Microsoft Windows 11 version 22H3
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
-
Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 version 22H2 · Microsoft Windows 11 version 22H3
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
-
Fortinet FortiOS · Fortinet FortiProxy
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
-
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS)
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability — BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user.
-
Qlik Sense
Qlik Sense HTTP Tunneling Vulnerability — Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.