Veille CVE

Semaine du 13 février au 19 février 2023

3 CVE sur 45

Critique 3 Élevée 39 Moyenne 2 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2022-47986 9.8 Critique Exploitée Rançongiciel

    IBM Aspera Faspex

    IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.

  2. CVE-2023-24482 9.8 Critique

    Siemens COMOS V10.2 · Siemens COMOS V10.3.3.1 · Siemens COMOS V10.3.3.2 · Siemens COMOS V10.3.3.3

    A vulnerability has been identified in COMOS V10.2 (All versions), COMOS V10.3.3.1 (All versions < V10.3.3.1.45), COMOS V10.3.3.2 (All versions < V10.3.3.2.33), COMOS V10.3.3.3 (All versions < V10.3.3.3.9), COMOS V10.3.3.4 (All versions < V10.3.3.4.6), COMOS V10.4.0.0 (All versions < V10.4.0.0.31), COMOS V10.4.1.0 (All versions < V10.4.1.0.32), COMOS V10.4.2.0 (All versions < V10.4.2.0.25). Cache validation service in COMOS is vulnerable to Structured Exception Handler (SEH) based buffer overflow. This could allow an attacker to execute arbitrary code on the target system or cause denial of service condition.

  3. CVE-2023-25717 9.8 Critique Exploitée

    Ruckuswireless ruckus wireless admin · Ruckuswireless smartzone ap · Commscope ruckus smartzone firmware

    Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.