Veille CVE

Jeudi 13 août 2026

5 CVE

Critique 1 Élevée 3 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2018-8120 7.0 Élevée Exploitée Rançongiciel

    Microsoft Windows Server 2008 · Microsoft Windows 7 · Microsoft Windows Server 2008 R2

    An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows Server 2008, Windows 7, Windows Server 2008 R2. This CVE ID is unique from CVE-2018-8124, CVE-2018-8164, CVE-2018-8166.

  2. CVE-2018-19943 5.4 Moyenne Exploitée Rançongiciel

    QNAP Systems Inc. QTS · Qnap qts

    If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later

  3. CVE-2018-19322 7.8 Élevée Exploitée Rançongiciel

    Gigabyte aorus graphics engine · Gigabyte app center · Gigabyte oc guru ii · Gigabyte xtreme gaming engine

    The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.

  4. CVE-2018-19321 7.8 Élevée Exploitée Rançongiciel

    Gigabyte aorus graphics engine · Gigabyte app center · Gigabyte oc guru ii · Gigabyte xtreme gaming engine

    The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.

  5. CVE-2017-18362 9.8 Critique Exploitée Rançongiciel

    Connectwise manageditsync

    ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers have actively exploited this in the wild to download and execute ransomware payloads on all endpoints managed by the VSA server. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run arbitrary SQL queries, both read and write, without authentication.