CVE Vulnerability Advisory Database

[Affected Scope] Web-based management interface of Cisco HyperFlex HX Data Platform

[Impact] Unauthenticated, remote attackers can execute arbitrary OS commands with system privileges, leading to complete device compromise

[Mitigation] Apply official Cisco security patches immediately, or restrict network access to TCP ports 80/443 to trusted administrative networks

[Affected Scope] All GitLab Community Edition (CE) and Enterprise Edition (EE) versions starting from 11.9

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with the privileges of the GitLab user by uploading a specially crafted image file

[Mitigation] Immediately upgrade the GitLab instance to the latest patched versions (13.10.3, 13.9.6, 13.8.8, or higher)

[Affected Scope] VMware vRealize Operations Manager API prior to version 8.4

[Impact] Unauthenticated network-adjacent or remote attackers can perform SSRF attacks to steal administrative credentials and compromise internal infrastructure

[Mitigation] Apply official security patches immediately or implement temporary API endpoint access restrictions

[Affected Scope] Rockwell Automation Studio 5000 Logix Designer v21 and later, RSLogix 5000 v16 through v20, and associated Logix controllers

[Impact] Unauthenticated remote attackers can obtain the hardcoded cryptographic key, bypass verification mechanisms, and gain unauthorized access to modify controller logic or configurations

[Mitigation] Implement network segmentation, restrict EtherNet/IP ports, transition controller keyswitches to 'Run' mode, and deploy CIP Security where applicable

[Affected Scope] On-premises Microsoft Exchange Server 2013, 2016, and 2019

[Impact] Unauthenticated remote attackers can bypass authentication, access sensitive mailbox data, and chain with other vulnerabilities to execute arbitrary code (RCE)

[Mitigation] Immediately apply the official Microsoft Cumulative Update (CU) and Security Update (SU), or implement IIS URL Rewrite rules to block malicious requests

[Affected Scope] Accellion FTA versions 9_12_370 and earlier

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands and gain full system control by sending crafted POST requests to various admin endpoints

[Mitigation] Immediately upgrade to Accellion FTA version 9_12_380 or later, or migrate to a supported secure file transfer platform

[Affected Scope] Accellion FTA 9_12_411 and earlier

[Impact] Unauthenticated remote attackers can exploit this vulnerability via crafted POST requests to access internal network resources or chain it with other flaws for remote code execution

[Mitigation] Immediately upgrade Accellion FTA to version 9_12_416 or later and restrict external access

[Affected Scope] Accellion FTA 9_12_411 and earlier

[Impact] Local attackers or compromised processes can execute arbitrary OS commands via local web service calls, leading to full system compromise

[Mitigation] Immediately upgrade Accellion FTA to version FTA_9_12_416 or later

[Affected Scope] Accellion FTA versions 9_12_370 and earlier

[Impact] Unauthenticated remote attackers can execute arbitrary SQL commands via a crafted Host header, leading to sensitive data exposure or potential remote code execution (RCE)

[Mitigation] Immediately upgrade Accellion FTA to version 9_12_380 or later and restrict external access

[Affected Scope] Nagios XI version 5.7.5

[Impact] An authenticated attacker can execute arbitrary OS commands on the Nagios XI server via a single crafted HTTP request, potentially leading to full system compromise.

[Mitigation] Immediately upgrade Nagios XI to a patched version (5.8.0 or higher), or disable/restrict access to the vulnerable configuration wizard.

[Affected Scope] Nagios XI version 5.7.5

[Impact] An authenticated attacker can execute arbitrary OS commands on the Nagios XI server via a single crafted HTTP request, potentially leading to full system compromise.

[Mitigation] Immediately upgrade to the latest patched version of Nagios XI, and restrict access to the vulnerable configuration wizard path.

[Affected Scope] Nagios XI version 5.7.5

[Impact] Authenticated attackers can execute arbitrary OS commands on the Nagios XI server via a single crafted HTTP request, leading to complete system compromise.

[Mitigation] Immediately upgrade Nagios XI to the latest secure version (5.8.0 or higher) and restrict access to the web console.

[Affected Scope] Adminer versions 4.0.0 up to (but excluding) 4.7.9, specifically when using the bundled driver package (e.g., adminer.php)

[Impact] Unauthenticated remote attackers can abuse the system to scan internal networks, probe private ports, and access sensitive internal APIs or cloud metadata services (IMDS)

[Mitigation] Immediately upgrade Adminer to version 4.7.9 or higher, and restrict access to the Adminer interface using network-level controls

[Affected Scope] Micro Focus Operations Bridge Reporter (OBR) version 10.40.

[Impact] Unauthenticated remote attackers can execute arbitrary system commands on the OBR server, leading to complete system compromise.

[Mitigation] Apply the official vendor security patch (KM03775947) immediately and restrict external access to the OBR management ports.

[Affected Scope] ONLYOFFICE Document Server versions prior to 5.6.3 (when JWT is enabled)

[Impact] Attackers can achieve Remote Code Execution (RCE) by uploading malicious files to arbitrary directories.

[Mitigation] Immediately update ONLYOFFICE Document Server to version 5.6.3 or later.

[Affected Scope] Laravel applications running versions prior to 8.4.2 and utilizing facade/ignition versions prior to 2.5.2 with debug mode (APP_DEBUG=true) enabled

[Impact] Unauthenticated remote attackers can execute arbitrary PHP code on the target server, leading to complete system compromise and data exfiltration

[Mitigation] Upgrade the facade/ignition package to version 2.5.2 or higher, and ensure that Laravel debug mode (APP_DEBUG) is set to 'false' in production environments

[Affected Scope] Apache Flink versions 1.11.0, 1.11.1, and 1.11.2

[Impact] Unauthenticated remote attackers can read arbitrary files on the JobManager local filesystem via the REST interface

[Mitigation] Immediately upgrade to Apache Flink 1.11.3, 1.12.0, or later versions

[Affected Scope] Roundcube Webmail versions before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10

[Impact] Remote attackers can execute arbitrary JavaScript in the victim's browser session by sending a specially crafted plain text email, potentially leading to session hijacking

[Mitigation] Immediately upgrade Roundcube Webmail to version 1.2.13, 1.3.16, or 1.4.10 or higher

[Affected Scope] Apache Struts framework versions 2.0.0 through 2.5.25

[Impact] Unauthenticated remote attackers can execute arbitrary code on the host system by exploiting forced double OGNL evaluation in tag attributes

[Mitigation] Immediately upgrade Apache Struts to version 2.5.26 or higher, and avoid evaluating raw user input inside Struts tag attributes

[Affected Scope] Microsoft Exchange Server 2010 Service Pack 3, 2013, 2016, and 2019

[Impact] An authenticated attacker can send specially crafted payloads to execute arbitrary code with SYSTEM privileges, leading to full server compromise

[Mitigation] Immediately apply the official Microsoft security updates and restrict external access to Exchange management interfaces