Veille CVE

Juin 2023

7 CVE

Critique 3 Élevée 3 Moyenne 0 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2023-32435 8.8 Élevée Exploitée

    Apple macOS · Apple iOS and iPadOS · Apple Safari · Apple ipados

    A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.7 and iPadOS 15.7.7. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.

  2. CVE-2023-2533 8.8 Élevée Exploitée

    PaperCut NG/MF · Papercut papercut mf · Papercut papercut ng

    A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code. This could be exploited if the target is an admin with a current login session. Exploiting this would typically involve the possibility of deceiving an admin into clicking a specially crafted malicious link, potentially leading to unauthorized changes.

  3. CVE-2023-27992 9.8 Critique Exploitée

    Zyxel NAS326 firmware · Zyxel NAS540 firmware · Zyxel NAS542 firmware

    The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.

  4. CVE-2023-20867 3.9 Faible Exploitée

    VMware Tools · Debian debian linux · Fedoraproject fedora

    A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.

  5. CVE-2023-27997 9.8 Critique Exploitée Rançongiciel

    Fortinet FortiOS-6K7K · Fortinet FortiProxy · Fortinet FortiOS

    A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.

  6. CVE-2023-20887 9.8 Critique Exploitée

    Aria Operations for Networks (Formerly vRealize Network Insight) · Vmware aria operations for networks

    Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.

  7. CVE-2023-3079 8.8 Élevée Exploitée

    Google Chrome · Fedoraproject fedora · Debian debian linux · Couchbase couchbase server

    Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)