Base de données CVE
Archive des vulnérabilités connues (CVE) avec score CVSS, gravité, produits et éditeurs concernés. Filtrez par année et par sévérité.
- CVE-2022-20700Critique10.0
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.
- CVE-2022-20699Critique10.0
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.
- CVE-2022-22536Critique10.0
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.
- CVE-2022-22718Élevée7.8
Windows Print Spooler Elevation of Privilege Vulnerability
- CVE-2022-21999Élevée7.8
Windows Print Spooler Elevation of Privilege Vulnerability
- CVE-2022-21971Élevée7.8
Windows Runtime Remote Code Execution Vulnerability
- CVE-2022-24682Moyenne6.1
Un problème a été découvert dans la fonctionnalité Calendar de Zimbra Collaboration Suite 8.8.x avant 8.8.15 patch 30 (update 1), tel qu'exploité dans la nature à partir de décembre 2021. Un attaquant pouvait placer du HTML contenant du JavaScript exécutable à l'intérieur d'attributs d'élément. Ce balisage devient non échappé, provoquant l'injection de balisage arbitraire dans le document.
- CVE-2021-4034Élevée7.8
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
- CVE-2021-40407Élevée7.2
An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->domain variable, that has the value of the domain parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection. An attacker can send an HTTP request to trigger this vulnerability.
- CVE-2021-22600Moyenne6.6
Un bug double free dans packet_set_ring() dans net/packet/af_packet.c peut être exploité par un utilisateur local via des appels système spécialement conçus pour élever les privilèges ou provoquer un déni de service. Nous recommandons de mettre à niveau le noyau au-delà des versions concernées ou de reconstruire après ec6af094ea28f0f2dda1a6a33b14cd57e36a9755
- CVE-2021-35587Critique9.8
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- CVE-2022-23227Critique9.8
NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.
- CVE-2022-23134Faible3.7
After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.
- CVE-2022-23131Critique9.1
In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).
- CVE-2022-21894Moyenne4.4
Secure Boot Security Feature Bypass Vulnerability
- CVE-2022-21919Élevée7.0
Windows User Profile Service Elevation of Privilege Vulnerability
- CVE-2022-21882Élevée7.0
Win32k Elevation of Privilege Vulnerability
- CVE-2022-22265Moyenne5.0
An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution.
- CVE-2021-35247Moyenne4.3
Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.
- CVE-2021-44168Faible3.3
A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages.
This product uses the NVD API but is not endorsed or certified by the NVD.