Veille CVE

Lundi 6 octobre 2025

7 CVE

Critique 2 Élevée 4 Moyenne 0 Faible 0 Non évaluée 1 Tri : plus récentes
  1. CVE-2025-61882 9.8 Critique Exploitée Rançongiciel

    Oracle Corporation Oracle Concurrent Processing · Oracle concurrent processing

    Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

  2. CVE-2021-22555 7.8 Élevée Exploitée

    Linux Kernel · Netapp c400 firmware · Netapp c250 firmware · Netapp h410c firmware

    A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space

  3. CVE-2013-3918 8.8 Élevée Exploitée

    Microsoft windows 7 · Microsoft windows 8 · Microsoft windows 8.1 · Microsoft windows rt

    The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted web page that is accessed by Internet Explorer, as exploited in the wild in November 2013, aka "InformationCardSigninHelper Vulnerability."

  4. CVE-2011-3402 8.8 Élevée Exploitée

    Microsoft windows 7 · Microsoft windows server 2003 · Microsoft windows server 2008 · Microsoft windows vista

    Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page, as exploited in the wild in November 2011 by Duqu, aka "TrueType Font Parsing Vulnerability."

  5. CVE-2010-3962 8.1 Élevée Exploitée

    Microsoft internet explorer

    Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute, aka an "invalid flag reference" issue or "Uninitialized Memory Corruption Vulnerability," as exploited in the wild in November 2010.

  6. CVE-2010-3765 9.8 Critique Exploitée

    Mozilla firefox · Mozilla thunderbird · Mozilla seamonkey

    Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when JavaScript is enabled, allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption, as exploited in the wild in October 2010 by the Belmoo malware.

  7. CVE-2021-43226 – Non évaluée Exploitée Rançongiciel

    Microsoft Windows

    Microsoft Windows Privilege Escalation Vulnerability — Microsoft Windows Common Log File System Driver contains a privilege escalation vulnerability that could allow a local, privileged attacker to bypass certain security mechanisms.