Veille CVE

Mars 2023

11 CVE

Critique 4 Élevée 6 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2023-26360 8.6 Élevée Exploitée

    Adobe ColdFusion

    Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

  2. CVE-2023-26359 9.8 Critique Exploitée

    Adobe ColdFusion

    Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

  3. CVE-2023-28434 8.8 Élevée Exploitée

    minio · Minio minio

    Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.

  4. CVE-2023-28432 7.5 Élevée Exploitée

    minio · Minio minio

    Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.

  5. CVE-2023-25280 9.8 Critique Exploitée

    dlink dir820la1_firmware · Dlink dir-820l firmware

    OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.

  6. CVE-2023-28461 9.8 Critique Exploitée Rançongiciel

    arraynetworks arrayos_ag · Arraynetworks arrayos ag

    Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated "a new Array AG release with the fix will be available soon."

  7. CVE-2023-1389 8.8 Élevée Exploitée

    TP-Link Archer AX21 (AX1800) · Tp-link archer ax21 firmware

    TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.

  8. CVE-2023-24880 4.4 Moyenne Exploitée Rançongiciel

    Microsoft Windows 10 Version 1809 · Microsoft Windows Server 2019 · Microsoft Windows Server 2019 (Server Core installation) · Microsoft Windows Server 2022

    Windows SmartScreen Security Feature Bypass Vulnerability

  9. CVE-2023-23397 9.8 Critique Exploitée

    Microsoft Office LTSC 2021 · Microsoft Outlook 2016 · Microsoft 365 Apps for Enterprise · Microsoft Office 2019

    Microsoft Outlook Elevation of Privilege Vulnerability

  10. CVE-2023-27532 7.5 Élevée Exploitée Rançongiciel

    Veeam Backup & Replication · Veeam veeam backup \& replication

    Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.

  11. CVE-2022-41328 7.1 Élevée Exploitée

    Fortinet FortiOS

    A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a privileged attacker to read and write files on the underlying Linux system via crafted CLI commands.