Veille CVE

Semaine du 17 mars au 23 mars 2025

5 CVE

Critique 0 Élevée 1 Moyenne 0 Faible 0 Non évaluée 4 Tri : plus récentes
  1. CVE-2017-12637 7.5 Élevée Exploitée

    Sap netweaver application server java

    Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.

  2. CVE-2025-1316 – Non évaluée Exploitée

    Edimax IC-7100 IP Camera

    Edimax IC-7100 IP Camera OS Command Injection Vulnerability — Edimax IC-7100 IP camera contains an OS command injection vulnerability due to improper input sanitization that allows an attacker to achieve remote code execution via specially crafted requests. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

  3. CVE-2024-48248 – Non évaluée Exploitée

    NAKIVO Backup and Replication

    NAKIVO Backup and Replication Absolute Path Traversal Vulnerability — NAKIVO Backup and Replication contains an absolute path traversal vulnerability that enables an attacker to read arbitrary files.

  4. CVE-2025-30066 – Non évaluée Exploitée

    tj-actions changed-files GitHub Action

    tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability — tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys.

  5. CVE-2025-24472 – Non évaluée Exploitée Rançongiciel

    Fortinet FortiOS and FortiProxy

    Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability — Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.