Veille CVE

Septembre 2024

7 CVE

Critique 3 Élevée 3 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2024-8963 9.1 Critique Exploitée

    Ivanti CSA (Cloud Services Appliance) · ivanti endpoint_manager_cloud_services_appliance · Ivanti endpoint manager cloud services appliance

    Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.

  2. CVE-2024-8957 7.2 Élevée Exploitée

    PTZOptics PT30X-SDI · PTZOptics PT30X-NDI · ptzoptics pt30x-sdi_firmware · ptzoptics pt30x-ndi_firmware

    PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.

  3. CVE-2024-8956 9.1 Critique Exploitée

    PTZOptics PT30X-SDI · PTZOptics PT30X-NDI · ptzoptics pt30x-sdi_firmware · ptzoptics pt30x-ndi-xx-g2_firmware

    PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.

  4. CVE-2024-8190 7.2 Élevée Exploitée

    Ivanti CSA (Cloud Services Appliance) · ivanti endpoint_manager_cloud_services_appliance · Ivanti cloud services appliance

    An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.

  5. CVE-2024-43461 8.8 Élevée Exploitée

    Microsoft Windows 10 Version 1507 · Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2

    Windows MSHTML Platform Spoofing Vulnerability

  6. CVE-2024-21753 6.0 Moyenne

    Fortinet FortiClientEMS · Fortinet forticlient endpoint management server

    A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.4, FortiClientEMS 7.0 all versions, FortiClientEMS 6.4 all versions, FortiClientEMS 06.02 all versions, FortiClientEMS 6.2 all versions, FortiClientEMS 06.00 all versions, FortiClientEMS 6.0 all versions, FortiClientEMS 01.02.02 through 01.02.05 allows attacker to perform a denial of service, read or write a limited number of files via specially crafted HTTP requests

  7. CVE-2024-40711 9.8 Critique Exploitée Rançongiciel

    Veeam Backup and Recovery · veeam backup_\&_replication · Veeam veeam backup \& replication

    A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).