CVE Vulnerability Advisory Database

[Affected Scope] Elasticsearch installations prior to version 1.2 running with default configurations

[Impact] Unauthenticated remote attackers can execute arbitrary MVEL expressions and Java code via the source parameter of the _search API, leading to complete system compromise

[Mitigation] Upgrade Elasticsearch to version 1.2 or higher, or explicitly disable dynamic scripting in the elasticsearch.yml configuration file

[Affected Scope] IBM InfoSphere BigInsights versions prior to 2.1.0.3

[Impact] Remote authenticated attackers can bypass file and directory restrictions, potentially accessing untrusted data or executing unauthorized code via crafted API parameters.

[Mitigation] Immediately upgrade to IBM InfoSphere BigInsights 2.1.0.3 or later as recommended by the vendor.

[Affected Scope] OpenSSL versions 1.0.1 through 1.0.1f supporting TLS/DTLS Heartbeat extension

[Impact] Remote attackers can read up to 64KB of host memory per request, potentially exposing private keys, session tokens, and credentials

[Mitigation] Upgrade OpenSSL to version 1.0.1g or later immediately, revoke compromised SSL/TLS certificates, and reissue new keys

[Affected Scope] Apache Struts framework versions 2.0.0 through 2.3.15

[Impact] Remote attackers can execute arbitrary OGNL expressions via crafted 'action:', 'redirect:', or 'redirectAction:' parameter prefixes, leading to full system compromise

[Mitigation] Immediately upgrade Apache Struts to version 2.3.15.1 or higher, or implement strict WAF rules to block vulnerable parameter prefixes

[Affected Scope] Adobe ColdFusion versions 9.0, 9.0.1, 9.0.2, and 10

[Impact] Remote attackers can bypass authentication using a default empty password on the RDS component, hijack the session to access the administrator interface, and execute arbitrary code

[Mitigation] Apply the official APSB13-03 security patch, disable the RDS component, or enforce strong passwords

[Affected Scope] Adobe ColdFusion versions 9.0, 9.0.1, and 9.0.2

[Impact] Unauthenticated remote attackers can obtain sensitive system configuration files and session tokens, potentially leading to full administrative compromise

[Mitigation] Apply the official APSB13-03 security patch immediately and restrict external access to the /CFIDE directory

[Affected Scope] Adobe ColdFusion versions 9.0, 9.0.1, 9.0.2, and 10 where an administrator password is not configured

[Impact] Unauthenticated remote attackers can bypass authentication and access restricted directories, potentially leading to sensitive information disclosure and further system compromise

[Mitigation] Apply the official Adobe security patch (APSB13-03), configure a strong administrator password, and restrict external access to the ColdFusion Administrator console (/CFIDE/administrator)

[Affected Scope] Adobe ColdFusion versions 9.0, 9.0.1, and 9.0.2 when an administrator password is not configured

[Impact] Remote attackers can bypass authentication, gain administrative access, and potentially execute arbitrary code to compromise the server

[Mitigation] Apply the official Adobe security patch (APSB13-03), enforce strong administrator passwords, and restrict external access to the admin console

[Affected Scope] Systems running unpatched versions impacted by CVE-2012-2539

[Impact] Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 al...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] Oracle Application Server Single Sign-On (OSSO) component in Oracle Fusion Middleware 10.1.4.3.0

[Impact] Remote attackers can compromise integrity by redirecting authenticated users to untrusted external malicious websites, facilitating phishing and credential harvesting

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or configure URL redirection filtering on the Oracle HTTP Server (OHS)

[Affected Scope] PHP versions before 5.3.12 and 5.4.x before 5.4.2, configured to run as a CGI script (php-cgi)

[Impact] Unauthenticated remote attackers can execute arbitrary code by injecting command-line options via HTTP query strings

[Mitigation] Upgrade to patched PHP versions or configure web server rewrite rules to block malicious query strings

[Affected Scope] Oracle WebCenter Forms Recognition (Designer component) in Oracle Fusion Middleware 10.1.3.5

[Impact] Unauthenticated remote attackers can compromise confidentiality, integrity, and availability, leading to complete system takeover

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately and restrict network access to the affected components

[Affected Scope] Apache Struts versions prior to 2.2.3.1

[Impact] Unauthenticated remote attackers can execute arbitrary Java code with system privileges on the target server by sending crafted HTTP request parameters.

[Mitigation] Immediately upgrade Apache Struts to version 2.2.3.1 or later secure releases.

[Affected Scope] Adobe ColdFusion 9.0.1 and earlier versions containing the CFIDE/administrator console

[Impact] Unauthenticated remote attackers can exploit directory traversal to read arbitrary system and configuration files, potentially retrieving administrator password hashes and fully compromising the server

[Mitigation] Apply the official APSB10-18 security patch, restrict external access to the CFIDE directory, or upgrade to a supported secure version

[Affected Scope] Red Hat JBoss Enterprise Application Platform (JBoss EAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08.

[Impact] Remote attackers can bypass authentication and access sensitive administrative information within the Web Console by utilizing non-standard HTTP methods (such as HEAD or PUT).

[Mitigation] Apply the official Cumulative Patch (CP) or modify the web.xml configuration to enforce authentication across all HTTP methods.

[Affected Scope] Red Hat JBoss Enterprise Application Platform (JBoss EAP) 4.2 (prior to 4.2.0.CP09) and 4.3 (prior to 4.3.0.CP08).

[Impact] Remote attackers can bypass authentication on the JMX-Console by utilizing non-standard HTTP methods (such as HEAD), allowing unauthorized administrative actions.

[Mitigation] Apply the official Cumulative Patch (CP), or modify the web.xml configuration to enforce authentication across all HTTP methods.

[Affected Scope] Adobe BlazeDS 3.2 and earlier, and integrated products including LiveCycle, ColdFusion, and Flex Data Services

[Impact] Unauthenticated remote attackers can read arbitrary local files and disclose sensitive system information via crafted XML requests

[Mitigation] Apply official security patches or disable external entity resolution (XXE) in the XML parser configuration

[Affected Scope] Systems running Microsoft Windows 2000 SP4, XP SP2/SP3, Server 2003 SP2, Vista, and Server 2008 utilizing the MPEG2TuneRequest ActiveX control (msvidctl.dll)

[Impact] Remote attackers can execute arbitrary code with the privileges of the logged-in user by enticing them to visit a specially crafted malicious web page

[Mitigation] Apply the official Microsoft security updates (MS09-037) or configure the ActiveX Kill Bit in the Windows Registry to disable the vulnerable control

[Affected Scope] Microsoft Office PowerPoint 2000 SP3, 2002 SP3, 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac.

[Impact] Remote attackers can execute arbitrary code with the privileges of the active user by tricking them into opening a specially crafted PowerPoint file.

[Mitigation] Apply the official Microsoft MS09-017 security update immediately and restrict the execution of untrusted PPT/PPS files.

[Affected Scope] phpMyAdmin versions 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1

[Impact] Unauthenticated remote attackers can inject arbitrary PHP code into the configuration file via the setup.php save action, leading to full system compromise

[Mitigation] Upgrade to patched versions immediately, or delete/restrict access to the setup.php script in production environments