CVE Vulnerability Advisory Database

[Affected Scope] Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier), and 2023u1 (and earlier)

[Impact] Unauthenticated remote attackers can exploit a Deserialization of Untrusted Data vulnerability (CWE-502) to execute arbitrary code with system privileges

[Mitigation] Immediately apply the official Adobe security patches (APSB23-41), restrict external access, and enable WAF rules

[Affected Scope] Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier), and 2023.0.0.330468 (and earlier)

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending malicious serialized data

[Mitigation] Immediately apply the official Adobe security patch (APSB23-40) and restrict external access to serialization endpoints

[Affected Scope] Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier), and 2023.0.0.330468 (and earlier)

[Impact] Unauthenticated remote attackers can bypass security controls to access administrative CFM and CFC endpoints, potentially leading to full system compromise

[Mitigation] Apply the official Adobe security patches (APSB23-40) immediately and restrict external access to the ColdFusion Administrator interface

[Affected Scope] Citrix ShareFile Storage Zones Controller versions prior to 5.11.24

[Impact] Unauthenticated remote attackers can exploit a padding oracle vulnerability to bypass authentication, upload arbitrary files, and execute remote code with SYSTEM privileges

[Mitigation] Immediately upgrade customer-managed Storage Zones Controllers to version 5.11.24 or later, and restrict external access

[Affected Scope] Zimbra Collaboration Suite (ZCS) version 8.8.15

[Impact] A remote authenticated attacker can execute arbitrary code and hijack sessions by injecting malicious scripts into the '/h/autoSaveDraft' function

[Mitigation] Immediately apply the official Zimbra security patches and restrict access to the affected endpoint using WAF rules

[Affected Scope] All Apple devices running versions prior to iOS/iPadOS 15.7.6 and 16.5, macOS Ventura 13.4, tvOS 16.5, watchOS 9.5, and Safari 16.5

[Impact] Processing maliciously crafted web content may lead to out-of-bounds memory access, disclosing sensitive system information and enabling further sandbox escape or privilege escalation

[Mitigation] Immediately apply official Apple software updates to upgrade to iOS 16.5, macOS Ventura 13.4, Safari 16.5, or later

[Affected Scope] PaperCut NG and MF systems with an active administrator login session.

[Impact] Attackers can trick administrators into clicking malicious links, leading to unauthorized security setting modifications and arbitrary code execution.

[Mitigation] Apply the official vendor security patches immediately and restrict external access to the admin interface.

[Affected Scope] Microsoft SharePoint Server 2019 and SharePoint Server Subscription Edition.

[Impact] An unauthenticated attacker can send a specially crafted JWT token to bypass authentication, gain administrator privileges, and potentially chain it with RCE vulnerabilities.

[Mitigation] Apply the official Microsoft Cumulative Update (CU) immediately and restrict unauthorized access at the network and IIS levels prior to patching.

[Affected Scope] All MOVEit Transfer versions prior to 2021.0.6, 2021.1.4, 2022.0.4, 2022.1.5, and 2023.0.1, including older unsupported versions

[Impact] Unauthenticated remote attackers can manipulate the database via HTTP/HTTPS requests, potentially leading to remote code execution (RCE) and unauthorized data exfiltration

[Mitigation] Immediately upgrade to the patched versions, restrict external HTTP/HTTPS access to the server, and conduct a thorough compromise assessment

[Affected Scope] All Openfire versions from 3.10.0 (released in April 2015) up to 4.6.7 and 4.7.4

[Impact] Unauthenticated remote attackers can bypass authentication via path traversal, gain administrative access, and potentially execute arbitrary code (RCE) by uploading malicious plugins

[Mitigation] Immediately upgrade to patched versions of Openfire (4.6.8, 4.7.5, or 4.8.0+) or apply strict access control and WAF rules to block path traversal patterns

[Affected Scope] Microsoft SharePoint Server 2016, 2019, and Subscription Edition

[Impact] An authenticated attacker with high privileges (Site Owner/Administrator) can execute arbitrary code in the context of the server, leading to complete system compromise

[Mitigation] Apply the official Microsoft security patches immediately and restrict access to the SharePoint administration interface from untrusted networks

[Affected Scope] Apache Superset installations up to and including version 2.0.1 that have not altered the default configured SECRET_KEY.

[Impact] Unauthorized attackers can forge session cookies to authenticate as administrators, leading to unauthorized resource access, database compromise, and potential Remote Code Execution (RCE).

[Mitigation] Immediately configure a unique, cryptographically strong, randomly generated SECRET_KEY in 'superset_config.py' or via environment variables.

[Affected Scope] PaperCut NG and MF versions 22.0.5 (Build 63914) and earlier

[Impact] Unauthenticated remote attackers can bypass authentication to gain administrative access and execute arbitrary code with system privileges

[Mitigation] Immediately upgrade to the latest patched versions (22.0.9 or higher) and restrict external access to management ports 9191 and 9192

[Affected Scope] Systems running unpatched versions impacted by CVE-2023-27350

[Impact] This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentic...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] All Strapi deployments running version 4.5.5 or earlier.

[Impact] Authenticated attackers with admin panel access can leak sensitive user data, including password hashes and reset tokens, via side-channel inference.

[Mitigation] Immediately upgrade Strapi to version 4.6.0 or later.

[Affected Scope] All on-premises and cloud web application servers running Novi Survey versions prior to 8.9.43676.

[Impact] Unauthenticated remote attackers can execute arbitrary system commands and malicious code under the security context of the web service account.

[Mitigation] Immediately upgrade to the official patched version (8.9.43676 or higher) and restrict external access to the application.

[Affected Scope] Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x

[Impact] Unauthenticated attackers can bypass security restrictions to gain administrative access and chain it with Server-Side Template Injection (SSTI) to execute arbitrary code

[Mitigation] Immediately upgrade to patched versions (9.4.0.1, 9.3.0.2 or later) and restrict external access to the Pentaho management interface

[Affected Scope] Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x

[Impact] Remote attackers can inject malicious Spring templates via specific web services, leading to Server-Side Template Injection (SSTI) and arbitrary code execution.

[Mitigation] Immediately upgrade affected Pentaho instances to patched versions (9.4.0.1, 9.3.0.2 or higher) and restrict external access.

[Affected Scope] Adobe ColdFusion 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier)

[Impact] Unauthenticated remote attackers can execute arbitrary code or access sensitive files in the context of the current user without any user interaction

[Mitigation] Immediately apply official vendor patches (ColdFusion 2018 Update 16, ColdFusion 2021 Update 6 or later) and restrict external access

[Affected Scope] Adobe ColdFusion 2018 Update 15 (and earlier) and ColdFusion 2021 Update 5 (and earlier).

[Impact] Successful exploitation allows unauthenticated remote attackers to execute arbitrary code in the context of the current user without any user interaction.

[Mitigation] Immediately apply the official Adobe security patches to upgrade to ColdFusion 2018 Update 16, ColdFusion 2021 Update 6, or later.