Semaine du 12 mai au 18 mai 2025

SAP NetWeaver

SAP NetWeaver Deserialization Vulnerability — SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content.

DrayTek Vigor Routers

DrayTek Vigor Routers OS Command Injection Vulnerability — DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component web management interface.

Fortinet Multiple Products

Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability — Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests.

Microsoft Windows

Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability — Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to escalate privileges to administrator.

Microsoft Windows

Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability — Microsoft Windows Common Log File System (CLFS) Driver contains a heap-based buffer overflow vulnerability that allows an authorized attacker to elevate privileges locally.

Microsoft Windows

Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability — Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.

Microsoft Windows

Microsoft Windows DWM Core Library Use-After-Free Vulnerability — Microsoft Windows DWM Core Library contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.

Microsoft Windows

Microsoft Windows Scripting Engine Type Confusion Vulnerability — Microsoft Windows Scripting Engine contains a type confusion vulnerability that allows an unauthorized attacker to execute code over a network via a specially crafted URL.