Veille CVE

Juin 2023

6 CVE

Critique 1 Élevée 3 Moyenne 1 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2023-32435 8.8 Élevée Exploitée

    Apple macOS · Apple iOS and iPadOS · Apple Safari · Apple ipados

    A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.7 and iPadOS 15.7.7. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.

  2. CVE-2023-2533 8.8 Élevée Exploitée

    PaperCut NG/MF · Papercut papercut mf · Papercut papercut ng

    A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code. This could be exploited if the target is an admin with a current login session. Exploiting this would typically involve the possibility of deceiving an admin into clicking a specially crafted malicious link, potentially leading to unauthorized changes.

  3. CVE-2023-20867 3.9 Faible Exploitée

    VMware Tools · Debian debian linux · Fedoraproject fedora

    A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.

  4. CVE-2023-29178 4.3 Moyenne

    Fortinet FortiOS · Fortinet FortiProxy

    A access of uninitialized pointer vulnerability [CWE-824] vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.11, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiProxy 7.2.0 through 7.2.3, FortiProxy 7.0.0 through 7.0.9, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions allows an authenticated attacker to repetitively crash the httpsd process via crafted HTTP or HTTPS requests.

  5. CVE-2023-20887 9.8 Critique Exploitée

    Aria Operations for Networks (Formerly vRealize Network Insight) · Vmware aria operations for networks

    Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.

  6. CVE-2023-3079 8.8 Élevée Exploitée

    Google Chrome · Fedoraproject fedora · Debian debian linux · Couchbase couchbase server

    Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)