Veille CVE

Semaine du 13 mars au 19 mars 2023

5 CVE

Critique 3 Élevée 1 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2023-25280 9.8 Critique Exploitée

    dlink dir820la1_firmware · Dlink dir-820l firmware

    OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.

  2. CVE-2023-28461 9.8 Critique Exploitée Rançongiciel

    arraynetworks arrayos_ag · Arraynetworks arrayos ag

    Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated "a new Array AG release with the fix will be available soon."

  3. CVE-2023-1389 8.8 Élevée Exploitée

    TP-Link Archer AX21 (AX1800) · Tp-link archer ax21 firmware

    TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.

  4. CVE-2023-24880 4.4 Moyenne Exploitée Rançongiciel

    Microsoft Windows 10 Version 1809 · Microsoft Windows Server 2019 · Microsoft Windows Server 2019 (Server Core installation) · Microsoft Windows Server 2022

    Windows SmartScreen Security Feature Bypass Vulnerability

  5. CVE-2023-23397 9.8 Critique Exploitée

    Microsoft Office LTSC 2021 · Microsoft Outlook 2016 · Microsoft 365 Apps for Enterprise · Microsoft Office 2019

    Microsoft Outlook Elevation of Privilege Vulnerability