Veille CVE

Semaine du 8 mai au 14 mai 2023

9 CVE sur 18

Critique 2 Élevée 9 Moyenne 4 Faible 3 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2022-45846 8.8 Élevée

    Nickys Image Map Pro for WordPress - Interactive SVG Image Map Builder · Wpmart interactive svg image map builder

    Cross-Site Request Forgery (CSRF) vulnerability in Nickys Image Map Pro for WordPress - Interactive SVG Image Map Builder plugin < 5.6.9 versions.

  2. CVE-2023-29336 7.8 Élevée Exploitée

    Microsoft Windows 10 Version 1507 · Microsoft Windows 10 Version 1607 · Microsoft Windows Server 2016 · Microsoft Windows Server 2016 (Server Core installation)

    Win32k Elevation of Privilege Vulnerability

  3. CVE-2023-24955 7.2 Élevée Exploitée Rançongiciel

    Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server 2019 · Microsoft SharePoint Server Subscription Edition · Microsoft sharepoint enterprise server

    Microsoft SharePoint Server Remote Code Execution Vulnerability

  4. CVE-2023-30986 7.8 Élevée

    Siemens Solid Edge SE2023

    A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 3), Solid Edge SE2023 (All versions < V223.0 Update 2). Affected applications contain a memory corruption vulnerability while parsing specially crafted STP files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19561)

  5. CVE-2023-30899 8.8 Élevée

    Siemens Siveillance Video 2020 R2 · Siemens Siveillance Video 2020 R3 · Siemens Siveillance Video 2021 R1 · Siemens Siveillance Video 2021 R2

    A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versions < V20.3 HotfixRev12), Siveillance Video 2021 R1 (All versions < V21.1 HotfixRev12), Siveillance Video 2021 R2 (All versions < V21.2 HotfixRev8), Siveillance Video 2022 R1 (All versions < V22.1 HotfixRev7), Siveillance Video 2022 R2 (All versions < V22.2 HotfixRev5), Siveillance Video 2022 R3 (All versions < V22.3 HotfixRev2), Siveillance Video 2023 R1 (All versions < V23.1 HotfixRev1). The Management Server component of affected applications deserializes data without sufficient validations. This could allow an authenticated remote attacker to execute code on the affected system.

  6. CVE-2023-30898 8.8 Élevée

    Siemens Siveillance Video 2020 R2 · Siemens Siveillance Video 2020 R3 · Siemens Siveillance Video 2021 R1 · Siemens Siveillance Video 2021 R2

    A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versions < V20.3 HotfixRev12), Siveillance Video 2021 R1 (All versions < V21.1 HotfixRev12), Siveillance Video 2021 R2 (All versions < V21.2 HotfixRev8), Siveillance Video 2022 R1 (All versions < V22.1 HotfixRev7), Siveillance Video 2022 R2 (All versions < V22.2 HotfixRev5), Siveillance Video 2022 R3 (All versions < V22.3 HotfixRev2), Siveillance Video 2023 R1 (All versions < V23.1 HotfixRev1). The Event Server component of affected applications deserializes data without sufficient validations. This could allow an authenticated remote attacker to execute code on the affected system.

  7. CVE-2023-29106 7.5 Élevée

    Siemens SIMATIC Cloud Connect 7 CC712 · Siemens SIMATIC Cloud Connect 7 CC716 · Siemens 6gk1411-1ac00 firmware · Siemens 6gk1411-5ac00 firmware

    A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The export endpoint is accessible via REST API without authentication. This could allow an unauthenticated remote attacker to download the files available via the endpoint.

  8. CVE-2023-29105 7.5 Élevée

    Siemens SIMATIC Cloud Connect 7 CC712 · Siemens SIMATIC Cloud Connect 7 CC716 · Siemens 6gk1411-1ac00 firmware · Siemens 6gk1411-5ac00 firmware

    A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC712 (All versions < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions < V2.1). The affected device is vulnerable to a denial of service while parsing a random (non-JSON) MQTT payload. This could allow an attacker who can manipulate the communication between the MQTT broker and the affected device to cause a denial of service (DoS).

  9. CVE-2023-29104 7.6 Élevée

    Siemens SIMATIC Cloud Connect 7 CC712 · Siemens SIMATIC Cloud Connect 7 CC716 · Siemens 6gk1411-1ac00 firmware · Siemens 6gk1411-5ac00 firmware

    A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The filename in the upload feature of the web based management of the affected device is susceptible to a path traversal vulnerability. This could allow an authenticated privileged remote attacker to overwrite any file the Linux user `ccuser` has write access to, or to download any file the Linux user `ccuser` has read-only access to.