CVE Vulnerability Advisory Database

[Affected Scope] Microsoft Exchange Server 2013, 2016, and 2019

[Impact] High-privileged remote attackers can execute arbitrary code and gain full system control over the Exchange Server

[Mitigation] Immediately apply the official Microsoft Cumulative Updates (CU) and Security Updates (SU), and restrict external access

[Affected Scope] All GitLab versions starting from 10.5 where internal network requests for webhooks are enabled

[Impact] Unauthenticated attackers can bypass registration restrictions to trigger SSRF, accessing sensitive internal network resources and metadata

[Mitigation] Upgrade to the latest patched GitLab version immediately, or disable the 'Allow requests to the local network from web hooks and services' setting

[Affected Scope] OpenPLC ScadaBR through version 0.9.1 on Linux and through version 1.12.4 on Windows

[Impact] Attackers can inject malicious scripts permanently via system_settings.shtm, leading to administrator session hijacking and unauthorized SCADA control

[Mitigation] Apply the latest security patches, restrict external access, and deploy Web Application Firewall (WAF) rules to sanitize input parameters

[Affected Scope] OpenPLC ScadaBR through version 0.9.1 on Linux and through version 1.12.4 on Windows

[Impact] Remote authenticated attackers can upload and execute malicious JSP files, leading to complete system compromise and arbitrary code execution

[Mitigation] Apply the latest security patches, restrict external access to the ScadaBR interface, and block unauthorized JSP uploads via WAF rules

[Affected Scope] Checkbox Survey versions prior to 7.0, specifically affecting the CheckboxWeb.dll component

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges on the target server via untrusted data deserialization

[Mitigation] Immediately upgrade Checkbox Survey to version 7.0 or higher, and restrict external access to vulnerable endpoints

[Affected Scope] VMware vRealize Operations Manager API prior to version 8.4

[Impact] Unauthenticated network-adjacent or remote attackers can perform SSRF attacks to steal administrative credentials and compromise internal infrastructure

[Mitigation] Apply official security patches immediately or implement temporary API endpoint access restrictions

[Affected Scope] Rockwell Automation Studio 5000 Logix Designer v21 and later, RSLogix 5000 v16 through v20, and associated Logix controllers

[Impact] Unauthenticated remote attackers can obtain the hardcoded cryptographic key, bypass verification mechanisms, and gain unauthorized access to modify controller logic or configurations

[Mitigation] Implement network segmentation, restrict EtherNet/IP ports, transition controller keyswitches to 'Run' mode, and deploy CIP Security where applicable

[Affected Scope] Nagios XI version 5.7.5

[Impact] An authenticated attacker can execute arbitrary OS commands on the Nagios XI server via a single crafted HTTP request, potentially leading to full system compromise.

[Mitigation] Immediately upgrade Nagios XI to a patched version (5.8.0 or higher), or disable/restrict access to the vulnerable configuration wizard.

[Affected Scope] Nagios XI version 5.7.5

[Impact] An authenticated attacker can execute arbitrary OS commands on the Nagios XI server via a single crafted HTTP request, potentially leading to full system compromise.

[Mitigation] Immediately upgrade to the latest patched version of Nagios XI, and restrict access to the vulnerable configuration wizard path.

[Affected Scope] Nagios XI version 5.7.5

[Impact] Authenticated attackers can execute arbitrary OS commands on the Nagios XI server via a single crafted HTTP request, leading to complete system compromise.

[Mitigation] Immediately upgrade Nagios XI to the latest secure version (5.8.0 or higher) and restrict access to the web console.

[Affected Scope] Adminer versions 4.0.0 up to (but excluding) 4.7.9, specifically when using the bundled driver package (e.g., adminer.php)

[Impact] Unauthenticated remote attackers can abuse the system to scan internal networks, probe private ports, and access sensitive internal APIs or cloud metadata services (IMDS)

[Mitigation] Immediately upgrade Adminer to version 4.7.9 or higher, and restrict access to the Adminer interface using network-level controls

[Affected Scope] ONLYOFFICE Document Server versions prior to 5.6.3 (when JWT is enabled)

[Impact] Attackers can achieve Remote Code Execution (RCE) by uploading malicious files to arbitrary directories.

[Mitigation] Immediately update ONLYOFFICE Document Server to version 5.6.3 or later.

[Affected Scope] Laravel applications running versions prior to 8.4.2 and utilizing facade/ignition versions prior to 2.5.2 with debug mode (APP_DEBUG=true) enabled

[Impact] Unauthenticated remote attackers can execute arbitrary PHP code on the target server, leading to complete system compromise and data exfiltration

[Mitigation] Upgrade the facade/ignition package to version 2.5.2 or higher, and ensure that Laravel debug mode (APP_DEBUG) is set to 'false' in production environments

[Affected Scope] Apache Flink versions 1.11.0, 1.11.1, and 1.11.2

[Impact] Unauthenticated remote attackers can read arbitrary files on the JobManager local filesystem via the REST interface

[Mitigation] Immediately upgrade to Apache Flink 1.11.3, 1.12.0, or later versions

[Affected Scope] Roundcube Webmail versions before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10

[Impact] Remote attackers can execute arbitrary JavaScript in the victim's browser session by sending a specially crafted plain text email, potentially leading to session hijacking

[Mitigation] Immediately upgrade Roundcube Webmail to version 1.2.13, 1.3.16, or 1.4.10 or higher

[Affected Scope] Drupal Core versions prior to 9.0.8, 8.9.9, 8.8.11, and 7.74

[Impact] Attackers can upload malicious files with double extensions (e.g., filename.php.txt) to execute arbitrary PHP code (RCE) under certain hosting configurations

[Mitigation] Immediately upgrade Drupal Core to the patched versions (9.0.8, 8.9.9, 8.8.11, 7.74 or higher)

[Affected Scope] Apache Airflow versions prior to 1.10.11, and existing installations retaining default configurations

[Impact] Unauthenticated attackers can access the Experimental API to trigger arbitrary DAGs, leading to full remote code execution (RCE) and server compromise

[Mitigation] Upgrade Apache Airflow to version 1.10.11 or higher, or explicitly configure the API authentication backend to 'deny_all' in airflow.cfg

[Affected Scope] QNAP QTS versions prior to 4.4.2.1231 Build 20200302, 4.4.1.1201 Build 20200130, 4.3.6.1218 Build 20200214, 4.3.4.1190 Build 20200107, 4.3.3.1161 Build 20200109, and 4.2.6 Build 20200109

[Impact] Remote attackers can inject malicious scripts into the web console, potentially leading to session hijacking or unauthorized administrative actions

[Mitigation] Immediately upgrade QTS to the patched versions recommended by QNAP and restrict external access to the management interface

[Affected Scope] QNAP NAS devices running QTS versions prior to 4.4.2.1270, 4.4.1.1261, 4.3.6.1263, 4.3.4.1282, 4.3.3.1252, and 4.2.6

[Impact] Remote authenticated attackers can inject malicious scripts, potentially leading to session hijacking, administrative privilege escalation, and unauthorized device control

[Mitigation] Immediately upgrade QTS firmware to the recommended patched versions and restrict external access to the NAS management interface

[Affected Scope] Oracle Business Intelligence Enterprise Edition (OBIEE) versions 5.5.0.0.0, 12.2.1.3.0, and 12.2.1.4.0

[Impact] Unauthenticated remote attackers can access sensitive system files and configuration data via crafted HTTP requests

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or implement path traversal blocking rules on Web Application Firewalls (WAF)