Veille CVE

Semaine du 13 mars au 19 mars 2023

12 CVE sur 18

Critique 4 Élevée 12 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2023-1389 8.8 Élevée Exploitée

    TP-Link Archer AX21 (AX1800) · Tp-link archer ax21 firmware

    TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.

  2. CVE-2023-27463 8.8 Élevée

    Siemens RUGGEDCOM CROSSBOW

    A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3). The audit log form of affected applications is vulnerable to SQL injection. This could allow authenticated remote attackers to execute arbitrary SQL queries on the server database.

  3. CVE-2023-27406 7.8 Élevée

    Siemens Tecnomatix Plant Simulation

    A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application is vulnerable to stack-based buffer while parsing specially crafted SPP files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-20449)

  4. CVE-2023-27405 7.8 Élevée

    Siemens Tecnomatix Plant Simulation

    A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20432)

  5. CVE-2023-27404 7.8 Élevée

    Siemens Tecnomatix Plant Simulation

    A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application is vulnerable to stack-based buffer while parsing specially crafted SPP files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-20433)

  6. CVE-2023-27403 7.8 Élevée

    Siemens Tecnomatix Plant Simulation

    A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains a memory corruption vulnerability while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20303, ZDI-CAN-20348)

  7. CVE-2023-27402 7.8 Élevée

    Siemens Tecnomatix Plant Simulation

    A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20334)

  8. CVE-2023-27401 7.8 Élevée

    Siemens Tecnomatix Plant Simulation

    A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20308, ZDI-CAN-20345)

  9. CVE-2023-27400 7.8 Élevée

    Siemens Tecnomatix Plant Simulation

    A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20300)

  10. CVE-2023-27310 8.8 Élevée

    Siemens RUGGEDCOM CROSSBOW

    A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.2). The client query handler of the affected application fails to check for proper permissions when assigning groups to user accounts. This could allow an authenticated remote attacker to assign administrative groups to otherwise non-privileged user accounts.

  11. CVE-2023-27309 8.8 Élevée

    Siemens RUGGEDCOM CROSSBOW

    A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.2). The client query handler of the affected application fails to check for proper permissions for specific write queries. This could allow an authenticated remote attacker to perform unauthorized actions.

  12. CVE-2023-25957 7.5 Élevée

    Siemens Mendix SAML (Mendix 7 compatible) · Siemens Mendix SAML (Mendix 8 compatible) · Siemens Mendix SAML (Mendix 9 latest compatible, New Track) · Siemens Mendix SAML (Mendix 9 latest compatible, Upgrade Track)

    A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAML (Mendix 8 compatible) (All versions >= V2.2.0 < V2.3.0), Mendix SAML (Mendix 9 latest compatible, New Track) (All versions >= V3.1.9 < V3.3.1), Mendix SAML (Mendix 9 latest compatible, Upgrade Track) (All versions >= V3.1.8 < V3.3.0), Mendix SAML (Mendix 9.6 compatible, New Track) (All versions >= V3.1.9 < V3.2.7), Mendix SAML (Mendix 9.6 compatible, Upgrade Track) (All versions >= V3.1.8 < V3.2.6). The affected versions of the module insufficiently verify the SAML assertions. This could allow unauthenticated remote attackers to bypass authentication and get access to the application. For compatibility reasons, fix versions still contain this issue, but only when the recommended, default configuration option `'Use Encryption'` is disabled.