CVE Vulnerability Advisory Database

[Affected Scope] Apache HTTP Server versions 2.4.59 and earlier, specifically environments utilizing mod_rewrite rules where substitutions in server context use backreferences or variables as the first segment.

[Impact] Attackers can map URLs to restricted filesystem locations, leading to unauthorized source code disclosure or arbitrary code execution (RCE).

[Mitigation] Immediately upgrade Apache HTTP Server to version 2.4.60 or later, and review/restrict unsafe RewriteRules.

[Affected Scope] All default installations of GeoServer prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2

[Impact] Unauthenticated remote attackers can execute arbitrary system commands on the host server via manipulated OGC request parameters

[Mitigation] Immediately upgrade to patched versions (2.22.6, 2.23.6, 2.24.4, 2.25.2 or higher) or apply the workaround by removing the 'gt-complex' JAR file

[Affected Scope] Progress WhatsUp Gold versions prior to 2023.1.3

[Impact] Unauthenticated remote attackers can execute arbitrary commands with 'iisapppool\ mconsole' privileges, leading to full system compromise

[Mitigation] Immediately upgrade WhatsUp Gold to version 2023.1.3 or later and restrict external access

[Affected Scope] VMware vCenter Server versions 7.0 and 8.0, and VMware Cloud Foundation versions 4.x and 5.x.

[Impact] An unauthenticated remote attacker can trigger a heap-based buffer overflow to execute arbitrary code with root privileges by sending crafted network packets.

[Mitigation] Immediately upgrade to the patched versions (vCenter 8.0 U2b / 7.0 U3r or higher) and restrict network access to DCERPC-related ports.

[Affected Scope] Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier

[Impact] Unauthenticated remote attackers can exploit this vulnerability to read arbitrary files and potentially achieve Remote Code Execution (RCE)

[Mitigation] Apply the official Adobe security patches (APSB24-40) or upgrade to the latest secure releases immediately

[Affected Scope] PHP versions 8.1.x (before 8.1.29), 8.2.x (before 8.2.20), and 8.3.x (before 8.3.8) running on Windows with Apache and PHP-CGI configuration under specific system code pages

[Impact] Unauthenticated remote attackers can inject arbitrary command-line options into the PHP binary, leading to remote code execution (RCE) and source code disclosure

[Mitigation] Immediately upgrade to patched PHP versions (8.1.29, 8.2.20, 8.3.8 or later) or apply Apache Rewrite rules to block malicious query strings

[Affected Scope] Roundcube Webmail versions prior to 1.5.7 and 1.6.x versions prior to 1.6.7

[Impact] Remote attackers can execute arbitrary JavaScript code in the victim's browser session by sending a crafted email containing malicious SVG animate attributes, leading to session hijacking

[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions (1.5.7, 1.6.7, or later)

[Affected Scope] SolarWinds Serv-U FTP Server versions 15.4.2 Hotfix 1 and prior

[Impact] Unauthenticated remote attackers can exploit a directory traversal vulnerability to read sensitive host system and configuration files

[Mitigation] Immediately upgrade to SolarWinds Serv-U version 15.4.2 Hotfix 2 or later

[Affected Scope] Rejetto HTTP File Server (HFS) up to and including version 2.3m

[Impact] Unauthenticated remote attackers can execute arbitrary commands on the host system by sending a specially crafted HTTP request

[Mitigation] Immediately discontinue the use of HFS 2.x, migrate to the completely redesigned HFS 3, or restrict network access

[Affected Scope] Progress Telerik Report Server 2024 Q1 (10.0.24.305) and earlier versions hosted on IIS

[Impact] Unauthenticated remote attackers can bypass authentication mechanisms to gain administrative access, access restricted functionality, or potentially execute arbitrary code

[Mitigation] Immediately upgrade Telerik Report Server to the latest secure version (2024 Q2 10.1.24.514 or later) and restrict IIS access to trusted IPs

[Affected Scope] Apache OFBiz versions prior to 18.12.13

[Impact] Unauthenticated remote attackers can bypass security filters via path traversal, access internal APIs, and execute arbitrary system commands (RCE) on the target server.

[Mitigation] Immediately upgrade Apache OFBiz to the official patched version 18.12.13 or later.

[Affected Scope] All versions of CrushFTP prior to 10.7.1 and 11.1.0 across all operating system platforms

[Impact] Unauthenticated remote attackers can bypass the VFS Sandbox, read arbitrary files from the filesystem, bypass authentication to gain administrative access, and execute arbitrary code on the server.

[Mitigation] Immediately upgrade CrushFTP to the patched versions (10.7.1 or 11.1.0 or higher) and apply WAF rules to block template injection payloads.

[Affected Scope] Apache HugeGraph-Server versions from 1.0.0 before 1.3.0 running on Java 8 & Java 11

[Impact] Unauthenticated remote attackers can bypass security controls and execute arbitrary system commands via the Gremlin query engine, leading to full system compromise

[Mitigation] Upgrade Apache HugeGraph-Server to version 1.3.0 or higher with Java 11, and ensure the Authentication system is enabled

[Affected Scope] Adobe ColdFusion 2023 Update 6 and earlier, and ColdFusion 2021 Update 12 and earlier

[Impact] Unauthenticated attackers can bypass access controls to read or modify arbitrary files on the host system, potentially exposing sensitive configuration data

[Mitigation] Apply the official Adobe APSB24-14 security patch immediately and restrict external internet access to the ColdFusion administrator panel

[Affected Scope] JetBrains TeamCity on-premises servers prior to version 2023.11.4

[Impact] Unauthenticated attackers can bypass authentication via path traversal, allowing them to perform limited administrative actions (e.g., modifying system configurations, creating rogue accounts)

[Mitigation] Immediately upgrade TeamCity to version 2023.11.4 or later, or apply the official security patch plugin

[Affected Scope] All JetBrains TeamCity versions prior to 2023.11.4

[Impact] Unauthenticated remote attackers can completely bypass authentication mechanisms to gain administrative privileges, leading to full server compromise and arbitrary remote code execution (RCE)

[Mitigation] Immediately upgrade TeamCity server to version 2023.11.4 or later, or apply the official security patch plugin

[Affected Scope] ConnectWise ScreenConnect versions 23.9.7 and prior

[Impact] Attackers can bypass authentication to create administrative accounts, leading to full system compromise and Remote Code Execution (RCE) [1, 1.1]

[Mitigation] Immediately upgrade to the patched version (23.9.8 or higher) and restrict external access to the management interface

[Affected Scope] Systems running unpatched versions impacted by CVE-2024-21413

[Impact] Microsoft Outlook Remote Code Execution Vulnerability...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] Devices running Safari prior to 17.3, iOS/iPadOS 15.8.7/16.7.5/17.3, macOS Monterey/Ventura/Sonoma, tvOS, and visionOS

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution (RCE) due to a type confusion issue, which has been actively exploited in the wild

[Mitigation] Immediately apply the official security updates and OS patches provided by Apple

[Affected Scope] Older versions of Atlassian Confluence Data Center and Server (8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x, 8.5.0-8.5.3)

[Impact] Unauthenticated remote attackers can execute arbitrary system commands (RCE) on the affected instance by sending specially crafted HTTP requests.

[Mitigation] Immediately upgrade to the latest patched versions (8.5.4+ or newer LTS releases) provided by Atlassian.