CVE Vulnerability Advisory Database

[Affected Scope] Google Chrome prior to 116.0.5845.187 and libwebp library prior to 1.3.2

[Impact] A remote attacker can trigger an out-of-bounds memory write and potentially execute arbitrary code via a crafted HTML page containing a malicious WebP image

[Mitigation] Immediately update Google Chrome to version 116.0.5845.187 or higher, and upgrade libwebp dependency to 1.3.2 or above

[Affected Scope] .NET 6.0, .NET 7.0, ASP.NET Core, and Microsoft Visual Studio 2022 environments

[Impact] Unauthenticated remote attackers can trigger resource exhaustion (CPU/Memory) via crafted HTTP requests, leading to a complete Denial of Service (DoS)

[Mitigation] Immediately update the .NET SDK/Runtime and Visual Studio to the latest patched versions

[Affected Scope] Atlassian Bitbucket Server and Data Center versions 7.0.0 up to 8.3.0 (excluding specific patched releases)

[Impact] Remote attackers with read permissions to a public or private repository can execute arbitrary OS commands via malicious HTTP requests

[Mitigation] Immediately upgrade Bitbucket instances to the official patched versions (7.6.17, 7.17.10, 7.21.4, 8.0.3, 8.1.3, 8.2.2, 8.3.1 or higher)

[Affected Scope] Apache Log4j versions 2.0-beta9 to 2.15.0 (including 2.15.0 for Java 8 and 2.12.1 or below for Java 7)

[Impact] Attackers can exploit JNDI Lookup patterns via Thread Context Map (MDC) inputs in non-default configurations to achieve remote code execution (RCE) or information leakage

[Mitigation] Immediately upgrade Apache Log4j to version 2.16.0 (for Java 8+) or 2.12.2 (for Java 7+), which disables JNDI by default and removes message lookup support

[Affected Scope] All versions of the ajaxpro.2 (Ajax.NET Professional) package

[Impact] Unauthenticated remote attackers can exploit the deserialization of untrusted data to instantiate arbitrary .NET classes, leading to Remote Code Execution (RCE)

[Mitigation] Apply the official security patch from the upstream repository, restrict unused AjaxPro handlers, or deploy WAF rules

[Affected Scope] Java applications utilizing XStream library versions prior to 1.4.18, and third-party solutions like VMware NSX Manager embedding this library

[Impact] Unauthenticated remote attackers can execute arbitrary system commands on the host by manipulating the processed XML input stream

[Mitigation] Upgrade XStream to version 1.4.18 or higher, and configure XStream's security framework with a strict whitelist

[Affected Scope] jQuery versions greater than or equal to 1.0.3 and before 3.5.0

[Impact] Passing untrusted HTML to jQuery's DOM manipulation methods (e.g., .html(), .append()) can execute arbitrary JavaScript code even after sanitization

[Mitigation] Upgrade jQuery to the patched version 3.5.0 or higher, or apply a workaround to bypass the vulnerable htmlPrefilter function

[Affected Scope] Ruby on Rails Action View versions prior to 5.2.2.1, 5.1.6.2, 5.0.7.2, 4.2.11.1, and all v3 versions

[Impact] Unauthenticated remote attackers can exploit specially crafted Accept headers to read arbitrary files from the target system's filesystem, leading to sensitive data exposure

[Mitigation] Immediately upgrade Ruby on Rails and Action View to the patched versions, or apply temporary web server filtering rules

[Affected Scope] Laravel Framework versions up to 5.5.40 and 5.6.x versions up to 5.6.29

[Impact] If an attacker obtains or compromises the application key (APP_KEY), they can execute arbitrary remote code (RCE) on the target server by sending a crafted X-XSRF-TOKEN header

[Mitigation] Immediately upgrade the Laravel Framework to the patched versions (5.5.41, 5.6.30, or higher) and rotate the APP_KEY if it has been exposed

[Affected Scope] Jenkins weekly versions 2.56 and earlier, and LTS versions 2.46.1 and earlier

[Impact] Unauthenticated remote attackers can execute arbitrary system commands and fully compromise the Jenkins master node by sending a serialized Java SignedObject

[Mitigation] Immediately upgrade Jenkins to version 2.57+ or LTS 2.46.2+, and disable the legacy remoting-based CLI protocol

[Affected Scope] All PHP web applications utilizing PHPMailer versions prior to 5.2.18

[Impact] Remote attackers can exploit the vulnerability to execute arbitrary code on the target server by manipulating the Sender (From) field

[Mitigation] Immediately upgrade the PHPMailer library to the latest stable version (5.2.18 or higher)

[Affected Scope] All systems running ImageMagick versions prior to 6.9.3-10 and 7.x prior to 7.0.1-1

[Impact] Remote attackers can execute arbitrary system commands with the privileges of the web server by uploading or processing a specially crafted image file

[Mitigation] Upgrade ImageMagick to the latest secure version (6.9.3-10+ or 7.0.1-1+) or disable vulnerable coders (MVG, MSL, etc.) via the policy.xml configuration file

[Affected Scope] Apache Struts versions 2.3.19 through 2.3.28 with Dynamic Method Invocation (DMI) enabled.

[Impact] Remote attackers can execute arbitrary code (RCE) with server privileges via specially crafted HTTP requests, leading to full system compromise.

[Mitigation] Immediately upgrade to Struts 2.3.20.3, 2.3.24.3, or 2.3.28.1 and set 'struts.enable.DynamicMethodInvocation' to 'false'.

[Affected Scope] Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9

[Impact] Remote attackers can execute arbitrary code without authentication by sending malicious serialized objects to the JMX service port, leading to complete system compromise

[Mitigation] Apply the latest Oracle Java SE security updates, restrict external access to JMX ports, and enforce robust authentication and SSL/TLS

[Affected Scope] Jenkins weekly versions prior to 1.638 and LTS versions prior to 1.625.2

[Impact] Unauthenticated remote attackers can obtain sensitive job and build name information via direct HTTP requests to fingerprint pages.

[Mitigation] Immediately upgrade Jenkins to LTS 1.625.2+ or weekly 1.638+, and restrict unauthorized access to the fingerprint endpoints.

[Affected Scope] Systems running unpatched versions impacted by CVE-2015-3245

[Impact] Incomplete blacklist vulnerability in the chfn function in libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper progra...

[Mitigation] Apply vendor security patches and restrict external network exposure.