Veille CVE

Avril 2025

5 CVE sur 7

Critique 5 Élevée 2 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2025-31324 9.8 Critique Exploitée Rançongiciel

    SAP_SE SAP NetWeaver (Visual Composer development server) · Sap netweaver

    SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.

  2. CVE-2025-34028 10.0 Critique Exploitée

    Commvault Command Center Innovation Release · Commvault commvault

    The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP. This issue affects Command Center Innovation Release: 11.38.0 to 11.38.20. The vulnerability is fixed in 11.38.20 with SP38-CU20-433 and SP38-CU20-436 and also fixed in 11.38.25 with SP38-CU25-434 and SP38-CU25-438.

  3. CVE-2025-31200 9.8 Critique Exploitée

    Apple iOS and iPadOS · Apple macOS · Apple tvOS · Apple visionOS

    A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1, watchOS 11.5. Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS released before iOS 18.4.1.

  4. CVE-2024-58136 9.8 Critique Exploitée

    yiiframework Yii

    Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.

  5. CVE-2025-22457 9.8 Critique Exploitée Rançongiciel

    Ivanti Connect Secure · Ivanti Policy Secure · Ivanti Neurons for ZTA gateways · Ivanti zero trust access gateway

    A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.