Veille CVE

Lundi 20 octobre 2025

5 CVE

Critique 0 Élevée 3 Moyenne 0 Faible 0 Non évaluée 2 Tri : plus récentes
  1. CVE-2025-61884 7.5 Élevée Exploitée Rançongiciel

    Oracle Corporation Oracle Configurator · Oracle configurator

    Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

  2. CVE-2025-33073 8.8 Élevée Exploitée

    Microsoft Windows 10 Version 1507 · Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2

    Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.

  3. CVE-2022-48503 8.8 Élevée Exploitée

    Apple macOS · Apple tvOS · Apple Safari · Apple watchOS

    The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing web content may lead to arbitrary code execution.

  4. CVE-2025-2747 – Non évaluée Exploitée

    Kentico Xperience CMS

    Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability — Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.

  5. CVE-2025-2746 – Non évaluée Exploitée

    Kentico Xperience CMS

    Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability — Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.