CVE Vulnerability Advisory Database

[Affected Scope] Apache Tomcat versions before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12, when JmxRemoteLifecycleListener is enabled

[Impact] Remote attackers with network access to JMX ports can trigger untrusted deserialization without authentication, leading to arbitrary Remote Code Execution (RCE) with system privileges

[Mitigation] Upgrade Apache Tomcat to the latest secure release, or disable JmxRemoteLifecycleListener in server.xml and restrict network access to JMX ports using firewalls

[Affected Scope] Apache ActiveMQ 5.x before 5.14.0 with the Fileserver web application enabled

[Impact] Unauthenticated remote attackers can upload and execute arbitrary JSP files via HTTP PUT and MOVE requests, leading to complete system compromise

[Mitigation] Upgrade Apache ActiveMQ to version 5.14.0 or later, or disable the Fileserver web application in the jetty.xml configuration

[Affected Scope] SAP NetWeaver AS JAVA version 7.4 utilizing the Universal Worklist (UWL) configuration.

[Impact] Unauthenticated remote attackers can obtain sensitive user information and system configuration details via crafted HTTP requests.

[Mitigation] Apply SAP Security Note 2256846 immediately and restrict external access to UWL-related endpoints.

[Affected Scope] UDDI (Universal Description, Discovery, and Integration) server component running on SAP NetWeaver J2EE Engine version 7.40.

[Impact] Unauthenticated remote attackers can execute arbitrary SQL commands via crafted requests, potentially leading to complete database compromise, data exfiltration, or remote code execution.

[Mitigation] Immediately apply SAP Security Note 2101079, disable the UDDI service if not required, and restrict network access.

[Affected Scope] Systems running unpatched versions impacted by CVE-2015-1770

[Impact] Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Of...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] Arcserve UDP versions prior to 5.0 Update 4

[Impact] Unauthenticated remote attackers can retrieve sensitive system files or trigger a denial of service, severely impacting business continuity

[Mitigation] Immediately upgrade to Arcserve UDP 5.0 Update 4 or later, and restrict external access to the management console

[Affected Scope] Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 R2 running IIS (Internet Information Services).

[Impact] Remote unauthenticated attackers can execute arbitrary code with SYSTEM privileges or trigger a Blue Screen of Death (BSOD), leading to complete system compromise or infrastructure denial of service.

[Mitigation] Apply the official Microsoft MS15-034 security patch immediately, or disable IIS Kernel Caching as a temporary workaround.

[Affected Scope] Elasticsearch versions before 1.3.8 and 1.4.x versions before 1.4.3

[Impact] Unauthenticated remote attackers can bypass sandbox restrictions to execute arbitrary shell commands on the host system, leading to complete system compromise

[Mitigation] Immediately upgrade Elasticsearch to version 1.3.8, 1.4.3, or later, or disable dynamic scripting in the configuration

[Affected Scope] Rejetto HTTP File Server (HFS) 2.3x versions prior to 2.3c

[Impact] Unauthenticated remote attackers can execute arbitrary system commands and gain full control of the host by sending crafted HTTP requests

[Mitigation] Immediately upgrade to a patched version (2.3c or later) or decommission the legacy HFS service in favor of secure alternatives

[Affected Scope] Elasticsearch installations prior to version 1.2 running with default configurations

[Impact] Unauthenticated remote attackers can execute arbitrary MVEL expressions and Java code via the source parameter of the _search API, leading to complete system compromise

[Mitigation] Upgrade Elasticsearch to version 1.2 or higher, or explicitly disable dynamic scripting in the elasticsearch.yml configuration file

[Affected Scope] IBM InfoSphere BigInsights versions prior to 2.1.0.3

[Impact] Remote authenticated attackers can bypass file and directory restrictions, potentially accessing untrusted data or executing unauthorized code via crafted API parameters.

[Mitigation] Immediately upgrade to IBM InfoSphere BigInsights 2.1.0.3 or later as recommended by the vendor.

[Affected Scope] OpenSSL versions 1.0.1 through 1.0.1f supporting TLS/DTLS Heartbeat extension

[Impact] Remote attackers can read up to 64KB of host memory per request, potentially exposing private keys, session tokens, and credentials

[Mitigation] Upgrade OpenSSL to version 1.0.1g or later immediately, revoke compromised SSL/TLS certificates, and reissue new keys

[Affected Scope] Apache Struts framework versions 2.0.0 through 2.3.15

[Impact] Remote attackers can execute arbitrary OGNL expressions via crafted 'action:', 'redirect:', or 'redirectAction:' parameter prefixes, leading to full system compromise

[Mitigation] Immediately upgrade Apache Struts to version 2.3.15.1 or higher, or implement strict WAF rules to block vulnerable parameter prefixes

[Affected Scope] Adobe ColdFusion versions 9.0, 9.0.1, 9.0.2, and 10

[Impact] Remote attackers can bypass authentication using a default empty password on the RDS component, hijack the session to access the administrator interface, and execute arbitrary code

[Mitigation] Apply the official APSB13-03 security patch, disable the RDS component, or enforce strong passwords

[Affected Scope] Adobe ColdFusion versions 9.0, 9.0.1, and 9.0.2

[Impact] Unauthenticated remote attackers can obtain sensitive system configuration files and session tokens, potentially leading to full administrative compromise

[Mitigation] Apply the official APSB13-03 security patch immediately and restrict external access to the /CFIDE directory

[Affected Scope] Adobe ColdFusion versions 9.0, 9.0.1, 9.0.2, and 10 where an administrator password is not configured

[Impact] Unauthenticated remote attackers can bypass authentication and access restricted directories, potentially leading to sensitive information disclosure and further system compromise

[Mitigation] Apply the official Adobe security patch (APSB13-03), configure a strong administrator password, and restrict external access to the ColdFusion Administrator console (/CFIDE/administrator)

[Affected Scope] Adobe ColdFusion versions 9.0, 9.0.1, and 9.0.2 when an administrator password is not configured

[Impact] Remote attackers can bypass authentication, gain administrative access, and potentially execute arbitrary code to compromise the server

[Mitigation] Apply the official Adobe security patch (APSB13-03), enforce strong administrator passwords, and restrict external access to the admin console

[Affected Scope] Systems running unpatched versions impacted by CVE-2012-2539

[Impact] Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 al...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] Oracle Application Server Single Sign-On (OSSO) component in Oracle Fusion Middleware 10.1.4.3.0

[Impact] Remote attackers can compromise integrity by redirecting authenticated users to untrusted external malicious websites, facilitating phishing and credential harvesting

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or configure URL redirection filtering on the Oracle HTTP Server (OHS)

[Affected Scope] PHP versions before 5.3.12 and 5.4.x before 5.4.2, configured to run as a CGI script (php-cgi)

[Impact] Unauthenticated remote attackers can execute arbitrary code by injecting command-line options via HTTP query strings

[Mitigation] Upgrade to patched PHP versions or configure web server rewrite rules to block malicious query strings