Veille CVE

Semaine du 18 avril au 24 avril 2022

2 CVE sur 4

Critique 0 Élevée 2 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2022-27925 7.2 Élevée Exploitée Rançongiciel

    Synacor zimbra collaboration suite

    Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.

  2. CVE-2022-27924 7.5 Élevée Exploitée Rançongiciel

    Synacor zimbra collaboration suite

    Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of arbitrary cached entries.