Base de données CVE
Archive des vulnérabilités connues (CVE) avec score CVSS, gravité, produits et éditeurs concernés. Filtrez par année et par sévérité.
- CVE-2023-6549Élevée8.2
Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of Service and Out-Of-Bounds Memory Read
- CVE-2023-6548Moyenne5.5
Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.
- CVE-2024-0519Élevée8.8
Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CVE-2023-22527Critique9.8
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.
- CVE-2024-21887Critique9.1
Une vulnérabilité d'injection de commande dans les composants web d'Ivanti Connect Secure (9.x, 22.x) et d'Ivanti Policy Secure (9.x, 22.x) permet à un administrateur authentifié d'envoyer des requêtes spécialement conçues et d'exécuter des commandes arbitraires sur l'appliance.
- CVE-2023-46805Élevée8.2
Une vulnérabilité de contournement d'authentification dans le composant web d'Ivanti ICS 9.x, 22.x et Ivanti Policy Secure permet à un attaquant distant d'accéder à des ressources restreintes en contournant les contrôles.
- CVE-2023-7028Critique10.0
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
- CVE-2023-41974Élevée7.8
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, iOS 15.8.7 and iPadOS 15.8.7. An app may be able to execute arbitrary code with kernel privileges.
- CVE-2022-48618Élevée7.0
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited against versions of iOS released before iOS 15.7.1.
- CVE-2022-2586Moyenne5.3
It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.
- CVE-2023-7102Critique9.8
Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic.
- CVE-2023-7101Élevée7.8
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.
- CVE-2023-7024Élevée8.8
Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CVE-2023-47565Élevée8.0
An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions: QVR Firmware 5.0.0 and later
- CVE-2023-36880Moyenne4.8
Vulnérabilité de divulgation d'informations dans Microsoft Edge (basé sur Chromium)
- CVE-2023-49897Élevée8.8
An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
- CVE-2023-44221Élevée7.2
Neutralisation incorrecte des éléments spéciaux dans l'interface de gestion SMA100 SSL-VPN permet à un attaquant distant authentifié avec privilège administratif d'injecter des commandes arbitraires en tant qu'utilisateur 'nobody', pouvant conduire à une vulnérabilité d'injection de commandes OS.
- CVE-2023-6448Critique9.8
Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.
- CVE-2023-33107Élevée8.4
Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
- CVE-2023-33106Élevée8.4
Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.
This product uses the NVD API but is not endorsed or certified by the NVD.