CVE Vulnerability Advisory Database

[Affected Scope] Browsers and applications utilizing WebKit and WebKitGTK engines prior to WSA-2019-0005

[Impact] Processing maliciously crafted web content can trigger memory corruption (CWE-119), potentially leading to arbitrary remote code execution (RCE)

[Mitigation] Upgrade WebKitGTK packages to the latest stable release and restrict access to untrusted web domains

[Affected Scope] IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending a specially crafted API request

[Mitigation] Immediately upgrade to IBM Aspera Faspex 4.4.2 Patch Level 2 or later, or restrict access to the obsolete API endpoints

[Affected Scope] Joomla! versions 4.0.0 through 4.2.7

[Impact] Unauthenticated remote attackers can bypass access controls to access sensitive API endpoints, exposing database credentials and system configuration details

[Mitigation] Immediately upgrade Joomla! to the patched version (4.2.8 or higher) and rotate all database credentials

[Affected Scope] Microsoft Exchange Server 2013, 2016, and 2019

[Impact] An authenticated attacker can execute arbitrary commands with SYSTEM privileges and fully compromise the server by sending specially crafted serialized data

[Mitigation] Immediately apply the latest Cumulative Updates (CU) and Security Updates (SU) provided by Microsoft

[Affected Scope] TerraMaster NAS devices running TOS (TerraMaster Operating System) version 4.2.29 and earlier

[Impact] Unauthenticated remote attackers can retrieve the administrator password hash or plaintext by sending a crafted HTTP request, leading to complete device compromise

[Mitigation] Immediately upgrade TOS to the latest secure version (4.2.30 or higher) and restrict external internet access to the NAS management interface

[Affected Scope] Fortra (formerly HelpSystems) GoAnywhere MFT versions prior to 7.1.2

[Impact] An unauthenticated remote attacker can execute arbitrary system commands on the target server by sending a malicious serialized object to the License Response Servlet.

[Mitigation] Immediately upgrade GoAnywhere MFT to version 7.1.2 or higher, and restrict external access to the administrator console port (9006).

[Affected Scope] Zoho ManageEngine on-premise products with SAML SSO configured or previously enabled (e.g., ServiceDesk Plus through 14003, ADSelfService Plus through 6210, Endpoint Central through 10.1.2228.10)

[Impact] Unauthenticated remote attackers can execute arbitrary code with SYSTEM/Administrator privileges by sending a specially crafted SAML response containing malicious XSLT payloads

[Mitigation] Immediately upgrade the affected ManageEngine products to the latest patched versions, or temporarily disable SAML SSO and restrict access to SAML endpoints

[Affected Scope] Oracle WebLogic Server versions 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0

[Impact] Unauthenticated remote attackers can compromise the server via T3/IIOP protocols, leading to unauthorized access to sensitive data or potential Remote Code Execution (RCE)

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict external access to T3/IIOP protocols (typically port 7001)

[Affected Scope] SugarCRM versions prior to 12.0 without Hotfix 91155

[Impact] Authenticated attackers can inject arbitrary PHP code through crafted requests in the EmailTemplates module, leading to full remote code execution

[Mitigation] Apply SugarCRM Hotfix 91155 immediately or upgrade to version 12.0 or later

[Affected Scope] CentOS Web Panel (CWP) 7 versions prior to 0.9.8.1147

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges on the target server by injecting shell metacharacters into the login parameter.

[Mitigation] Immediately upgrade CWP 7 to version 0.9.8.1147 or later, and restrict access to the management ports using firewalls.

[Affected Scope] Cacti versions 1.2.x up to 1.2.22, and 1.3.x development branches

[Impact] Unauthenticated remote attackers can bypass authentication via HTTP header manipulation and execute arbitrary OS commands with the privileges of the web server

[Mitigation] Immediately upgrade Cacti to version 1.2.23 or later, and restrict access to the monitoring interface

[Affected Scope] Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.11, specifically the Upload component of Web Applications Desktop Integrator.

[Impact] Unauthenticated remote attackers can exploit this vulnerability via HTTP to upload arbitrary files and achieve full system takeover (RCE).

[Mitigation] Immediately apply the official Oracle Critical Patch Update (CPU) patches and restrict external access to vulnerable endpoints.

[Affected Scope] On-premises Microsoft Exchange Server 2013, 2016, and 2019 versions lacking the latest cumulative and security updates

[Impact] Authenticated remote attackers can exploit untrusted deserialization in the Exchange PowerShell backend to execute arbitrary commands with SYSTEM privileges

[Mitigation] Apply official Microsoft security updates immediately, or implement IIS URL Rewrite rules and restrict Remote PowerShell access as temporary workarounds

[Affected Scope] Microsoft Exchange Server 2013, 2016, and 2019 On-Premises environments

[Impact] Authenticated attackers can exploit this SSRF vulnerability to access backend APIs, leading to Remote Code Execution (RCE) and complete system compromise

[Mitigation] Apply the official Microsoft cumulative security updates immediately, or implement IIS URL Rewrite rules as a temporary workaround

[Affected Scope] Systems and network devices running vulnerable versions of Cisco SD-WAN Software CLI

[Impact] An authenticated, local attacker can execute arbitrary commands with root privileges by running a maliciously crafted command

[Mitigation] Apply the official software updates provided by Cisco immediately, as there are no viable workarounds

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 8.8.15 and 9.0 running on Red Hat-based distributions (RHEL/CentOS) where the 'pax' utility is missing.

[Impact] Unauthenticated attackers can upload arbitrary files to the web root directory via a cpio path traversal loophole during amavis scanning, leading to full system compromise.

[Mitigation] Immediately install the 'pax' utility via the OS package manager or upgrade Zimbra to the latest patched version.

[Affected Scope] GLPI versions up to and including 10.0.2, specifically within the bundled htmLawed module

[Impact] Unauthenticated remote attackers can inject and execute arbitrary PHP code, leading to full system compromise

[Mitigation] Immediately upgrade GLPI to version 10.0.3 or higher, or delete the vulnerable test script (htmLawedTest.php)

[Affected Scope] D-Link GO-RT-AC750 hardware revA (firmware v101b03 and prior) and revB (firmware FWv200b02 and prior).

[Impact] Unauthenticated remote attackers can execute arbitrary code with root privileges or cause a complete system compromise by sending crafted HTTP requests to the WAN/LAN interface.

[Mitigation] Apply the latest firmware updates immediately, or replace end-of-life (EoL) devices and disable remote WAN management interfaces.

[Affected Scope] ZK Framework versions 9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2, 8.6.4.1, and prior

[Impact] Unauthenticated attackers can access sensitive system files and class resources via crafted POST requests, potentially leading to Remote Code Execution (RCE).

[Mitigation] Immediately upgrade ZK Framework to patched versions (9.6.2, 9.6.0.2, 9.5.1.4, 9.0.1.3, 8.6.4.2 or later) and block suspicious AuUploader requests via WAF.

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 8.8.15 and 9.0

[Impact] Unauthenticated attackers can bypass authentication, upload malicious ZIP archives, and exploit directory traversal to write arbitrary files, leading to Remote Code Execution (RCE)

[Mitigation] Immediately apply the official Zimbra security patches and restrict external access to the mboximport endpoint