Veille CVE

Semaine du 20 mars au 26 mars 2023

4 CVE sur 7

Critique 1 Élevée 4 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2023-26360 8.6 Élevée Exploitée

    Adobe ColdFusion

    Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

  2. CVE-2023-28663 8.8 Élevée

    Formidable PRO2PDF WordPress Plugin · Formidablepro2pdf formidable pro2pdf

    The Formidable PRO2PDF WordPress Plugin, version < 3.11, is affected by an authenticated SQL injection vulnerability in the ‘fieldmap’ parameter in the fpropdf_export_file action.

  3. CVE-2023-28434 8.8 Élevée Exploitée

    minio · Minio minio

    Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.

  4. CVE-2023-28432 7.5 Élevée Exploitée

    minio · Minio minio

    Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.