Veille CVE

Février 2025

2 CVE sur 6

Critique 1 Élevée 2 Moyenne 3 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2025-24472 8.1 Élevée Exploitée Rançongiciel

    Fortinet FortiOS · Fortinet FortiProxy

    An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.

  2. CVE-2025-0994 8.8 Élevée Exploitée

    Trimble Cityworks · Trimble Cityworks (with office companion)

    Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services (IIS) web server.