Veille CVE

Avril 2022

4 CVE

Critique 2 Élevée 0 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2022-29499 9.8 Critique Exploitée Rançongiciel

    Mitel mivoice connect

    The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.

  2. CVE-2022-27926 6.1 Moyenne Exploitée

    Synacor zimbra collaboration suite

    A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.

  3. CVE-2022-28810 6.8 Moyenne Exploitée

    Zohocorp manageengine adselfservice plus

    Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field.

  4. CVE-2022-22954 9.8 Critique Exploitée Rançongiciel

    VMware Workspace ONE Access and Identity Manager · Vmware identity manager · Vmware vrealize automation · Vmware workspace one access

    VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.