Veille CVE

Mardi 22 juillet 2025

6 CVE

Critique 2 Élevée 2 Moyenne 0 Faible 0 Non évaluée 2 Tri : plus récentes
  1. CVE-2025-54309 9.8 Critique Exploitée

    CrushFTP · Crushftp crushftp

    CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

  2. CVE-2025-6558 8.8 Élevée Exploitée

    Google Chrome · Debian debian linux · Apple safari · Apple ipados

    Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

  3. CVE-2025-2776 9.8 Critique Exploitée

    SysAid On-Prem · Sysaid sysaid

    SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.

  4. CVE-2025-2775 7.5 Élevée Exploitée

    SysAid On-Prem · Sysaid sysaid

    SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.

  5. CVE-2025-49706 – Non évaluée Exploitée Rançongiciel

    Microsoft SharePoint

    Microsoft SharePoint Improper Authentication Vulnerability — Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706.

  6. CVE-2025-49704 – Non évaluée Exploitée Rançongiciel

    Microsoft SharePoint

    Microsoft SharePoint Code Injection Vulnerability — Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.