Veille CVE

Mai 2025

8 CVE

Critique 2 Élevée 3 Moyenne 3 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2025-48928 4.0 Moyenne Exploitée

    TeleMessage service · Smarsh telemessage

    The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.

  2. CVE-2025-48927 5.3 Moyenne Exploitée

    TeleMessage service · Smarsh telemessage

    The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.

  3. CVE-2025-34026 7.5 Élevée Exploitée

    Versa Concerto · Versa-networks concerto

    The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.

  4. CVE-2025-4008 8.8 Élevée Exploitée

    Smartbedded MeteoBridge · Smartbedded meteobridge vm · Smartbedded meteobridge firmware

    The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C. This web interface exposes an endpoint that is vulnerable to command injection. Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.

  5. CVE-2025-4632 9.8 Critique Exploitée

    Samsung Electronics MagicINFO 9 Server · Samsung magicinfo 9 server

    Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority.

  6. CVE-2025-47729 4.9 Moyenne Exploitée

    TeleMessage archiving backend · Telemessage text message archiver

    The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functionality than described in the TeleMessage "End-to-End encryption from the mobile phone through to the corporate archive" documentation, as exploited in the wild in May 2025.

  7. CVE-2025-2776 9.8 Critique Exploitée

    SysAid On-Prem · Sysaid sysaid

    SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.

  8. CVE-2025-2775 7.5 Élevée Exploitée

    SysAid On-Prem · Sysaid sysaid

    SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.