Veille CVE

Semaine du 18 avril au 24 avril 2022

3 CVE

Critique 0 Élevée 1 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2022-27926 6.1 Moyenne Exploitée

    Synacor zimbra collaboration suite

    A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.

  2. CVE-2022-27925 7.2 Élevée Exploitée Rançongiciel

    Synacor zimbra collaboration suite

    Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.

  3. CVE-2022-28810 6.8 Moyenne Exploitée

    Zohocorp manageengine adselfservice plus

    Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field.