Mars 2023

Adobe ColdFusion

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

dlink dir820la1_firmware · Dlink dir-820l firmware

OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.

arraynetworks arrayos_ag · Arraynetworks arrayos ag

Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated "a new Array AG release with the fix will be available soon."

Microsoft Office LTSC 2021 · Microsoft Outlook 2016 · Microsoft 365 Apps for Enterprise · Microsoft Office 2019

Microsoft Outlook Elevation of Privilege Vulnerability

Prestashop dpd france

PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php.