Veille CVE

Mars 2023

25 CVE

Critique 4 Élevée 14 Moyenne 7 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2023-27537 5.9 Moyenne

    https://github.com/curl/curl · Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

    A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.

  2. CVE-2023-27536 5.9 Moyenne

    https://github.com/curl/curl · Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

    An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.

  3. CVE-2023-27534 8.8 Élevée

    https://github.com/curl/curl · Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

    A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user.

  4. CVE-2022-47924 6.5 Moyenne

    Secvisogram csaf-validator-lib · Csaf-validator-lib project csaf-validator-lib

    An high privileged attacker may pass crafted arguments to the validate function of csaf-validator-lib of a locally installed Secvisogram in versions < 0.1.0 wich can result in arbitrary code execution and DoS once the users triggers the validation.

  5. CVE-2023-26360 8.6 Élevée Exploitée

    Adobe ColdFusion

    Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

  6. CVE-2023-26359 9.8 Critique Exploitée

    Adobe ColdFusion

    Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

  7. CVE-2023-28666 5.4 Moyenne

    InPost Gallery WordPress Plugin · Pluginus inpost gallery

    The InPost Gallery WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'imgurl' parameter to the add_inpost_gallery_slide_item action, which can only be triggered by an authenticated user.

  8. CVE-2023-28665 5.4 Moyenne

    Woo Bulk Price Update WordPress Plugin · Technocrackers bulk price update for woocommerce

    The Woo Bulk Price Update WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'page' parameter to the techno_get_products action, which can only be triggered by an authenticated user.

  9. CVE-2023-28663 8.8 Élevée

    Formidable PRO2PDF WordPress Plugin · Formidablepro2pdf formidable pro2pdf

    The Formidable PRO2PDF WordPress Plugin, version < 3.11, is affected by an authenticated SQL injection vulnerability in the ‘fieldmap’ parameter in the fpropdf_export_file action.

  10. CVE-2023-28432 7.5 Élevée Exploitée

    minio · Minio minio

    Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.

  11. CVE-2023-25280 9.8 Critique Exploitée

    dlink dir820la1_firmware · Dlink dir-820l firmware

    OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.

  12. CVE-2023-28461 9.8 Critique Exploitée Rançongiciel

    arraynetworks arrayos_ag · Arraynetworks arrayos ag

    Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated "a new Array AG release with the fix will be available soon."

  13. CVE-2023-1389 8.8 Élevée Exploitée

    TP-Link Archer AX21 (AX1800) · Tp-link archer ax21 firmware

    TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.

  14. CVE-2023-24880 4.4 Moyenne Exploitée Rançongiciel

    Microsoft Windows 10 Version 1809 · Microsoft Windows Server 2019 · Microsoft Windows Server 2019 (Server Core installation) · Microsoft Windows Server 2022

    Windows SmartScreen Security Feature Bypass Vulnerability

  15. CVE-2023-23397 9.8 Critique Exploitée

    Microsoft Office LTSC 2021 · Microsoft Outlook 2016 · Microsoft 365 Apps for Enterprise · Microsoft Office 2019

    Microsoft Outlook Elevation of Privilege Vulnerability

  16. CVE-2023-27463 8.8 Élevée

    Siemens RUGGEDCOM CROSSBOW

    A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3). The audit log form of affected applications is vulnerable to SQL injection. This could allow authenticated remote attackers to execute arbitrary SQL queries on the server database.

  17. CVE-2023-27462 4.3 Moyenne

    Siemens RUGGEDCOM CROSSBOW

    A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3). The client query handler of the affected application fails to check for proper permissions for specific read queries. This could allow authenticated remote attackers to access data they are not authorized for.

  18. CVE-2023-27405 7.8 Élevée

    Siemens Tecnomatix Plant Simulation

    A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20432)

  19. CVE-2023-27404 7.8 Élevée

    Siemens Tecnomatix Plant Simulation

    A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application is vulnerable to stack-based buffer while parsing specially crafted SPP files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-20433)

  20. CVE-2023-27403 7.8 Élevée

    Siemens Tecnomatix Plant Simulation

    A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains a memory corruption vulnerability while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20303, ZDI-CAN-20348)

  21. CVE-2023-27402 7.8 Élevée

    Siemens Tecnomatix Plant Simulation

    A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20334)

  22. CVE-2023-27310 8.8 Élevée

    Siemens RUGGEDCOM CROSSBOW

    A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.2). The client query handler of the affected application fails to check for proper permissions when assigning groups to user accounts. This could allow an authenticated remote attacker to assign administrative groups to otherwise non-privileged user accounts.

  23. CVE-2023-25957 7.5 Élevée

    Siemens Mendix SAML (Mendix 7 compatible) · Siemens Mendix SAML (Mendix 8 compatible) · Siemens Mendix SAML (Mendix 9 latest compatible, New Track) · Siemens Mendix SAML (Mendix 9 latest compatible, Upgrade Track)

    A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAML (Mendix 8 compatible) (All versions >= V2.2.0 < V2.3.0), Mendix SAML (Mendix 9 latest compatible, New Track) (All versions >= V3.1.9 < V3.3.1), Mendix SAML (Mendix 9 latest compatible, Upgrade Track) (All versions >= V3.1.8 < V3.3.0), Mendix SAML (Mendix 9.6 compatible, New Track) (All versions >= V3.1.9 < V3.2.7), Mendix SAML (Mendix 9.6 compatible, Upgrade Track) (All versions >= V3.1.8 < V3.2.6). The affected versions of the module insufficiently verify the SAML assertions. This could allow unauthenticated remote attackers to bypass authentication and get access to the application. For compatibility reasons, fix versions still contain this issue, but only when the recommended, default configuration option `'Use Encryption'` is disabled.

  24. CVE-2022-42476 8.2 Élevée

    Fortinet FortiOS · Fortinet FortiProxy

    A relative path traversal vulnerability [CWE-23] vulnerability in Fortinet FortiOS 7.2.0 through 7.2.3, FortiOS 7.0.0 through 7.0.8, FortiOS 6.4.0 through 6.4.11, FortiOS 6.2.0 through 6.2.12, FortiProxy 7.2.0 through 7.2.1, FortiProxy 7.0.0 through 7.0.7, FortiProxy 2.0.0 through 2.0.11, FortiProxy 1.2 all versions, FortiProxy 01.02 all versions, FortiProxy 1.1 all versions, FortiProxy 01.01 all versions allows privileged VDOM administrators to escalate their privileges to super admin of the box via crafted CLI requests.

  25. CVE-2022-41328 7.1 Élevée Exploitée

    Fortinet FortiOS

    A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a privileged attacker to read and write files on the underlying Linux system via crafted CLI commands.