Veille CVE

Semaine du 5 mai au 11 mai 2025

4 CVE

Critique 2 Élevée 1 Moyenne 0 Faible 0 Non évaluée 1 Tri : plus récentes
  1. CVE-2024-11120 9.8 Critique Exploitée

    GeoVision GV-VS12 · GeoVision GV-VS11 · GeoVision GV-DSP_LPR_V3 · GeoVision GVLX 4 V2

    Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports.

  2. CVE-2024-6047 9.8 Critique Exploitée

    GeoVision GV_DSP_LPR_V2 · GeoVision GV_IPCAMD_GV_BX1500 · GeoVision GV_IPCAMD_GV_CB220 · GeoVision GV_IPCAMD_GV_EBL1100

    Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device.

  3. CVE-2025-27363 8.1 Élevée Exploitée

    FreeType · Freetype freetype · Debian debian linux

    An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.

  4. CVE-2025-3248 – Non évaluée Exploitée Rançongiciel

    Langflow Langflow

    Langflow Missing Authentication Vulnerability — Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests.