CVE Vulnerability Advisory Database

[Affected Scope] Systems running unpatched versions impacted by CVE-2012-2539

[Impact] Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 al...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] Oracle Application Server Single Sign-On (OSSO) component in Oracle Fusion Middleware 10.1.4.3.0

[Impact] Remote attackers can compromise integrity by redirecting authenticated users to untrusted external malicious websites, facilitating phishing and credential harvesting

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or configure URL redirection filtering on the Oracle HTTP Server (OHS)

[Affected Scope] PHP versions before 5.3.12 and 5.4.x before 5.4.2, configured to run as a CGI script (php-cgi)

[Impact] Unauthenticated remote attackers can execute arbitrary code by injecting command-line options via HTTP query strings

[Mitigation] Upgrade to patched PHP versions or configure web server rewrite rules to block malicious query strings

[Affected Scope] Oracle WebCenter Forms Recognition (Designer component) in Oracle Fusion Middleware 10.1.3.5

[Impact] Unauthenticated remote attackers can compromise confidentiality, integrity, and availability, leading to complete system takeover

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately and restrict network access to the affected components

[Affected Scope] Apache Struts versions prior to 2.2.3.1

[Impact] Unauthenticated remote attackers can execute arbitrary Java code with system privileges on the target server by sending crafted HTTP request parameters.

[Mitigation] Immediately upgrade Apache Struts to version 2.2.3.1 or later secure releases.

[Affected Scope] Adobe ColdFusion 9.0.1 and earlier versions containing the CFIDE/administrator console

[Impact] Unauthenticated remote attackers can exploit directory traversal to read arbitrary system and configuration files, potentially retrieving administrator password hashes and fully compromising the server

[Mitigation] Apply the official APSB10-18 security patch, restrict external access to the CFIDE directory, or upgrade to a supported secure version

[Affected Scope] JBoss Seam 2 (jboss-seam2) framework as integrated in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux

[Impact] Remote attackers can execute arbitrary Java code and system commands via crafted URLs when the Java Security Manager is not properly configured

[Mitigation] Upgrade to the patched version of JBoss Seam/EAP, enable the Java Security Manager, and implement strict input validation filters

[Affected Scope] Red Hat JBoss Enterprise Application Platform (JBoss EAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08.

[Impact] Remote attackers can bypass authentication and access sensitive administrative information within the Web Console by utilizing non-standard HTTP methods (such as HEAD or PUT).

[Mitigation] Apply the official Cumulative Patch (CP) or modify the web.xml configuration to enforce authentication across all HTTP methods.

[Affected Scope] Red Hat JBoss Enterprise Application Platform (JBoss EAP) 4.2 (prior to 4.2.0.CP09) and 4.3 (prior to 4.3.0.CP08).

[Impact] Remote attackers can bypass authentication on the JMX-Console by utilizing non-standard HTTP methods (such as HEAD), allowing unauthorized administrative actions.

[Mitigation] Apply the official Cumulative Patch (CP), or modify the web.xml configuration to enforce authentication across all HTTP methods.

[Affected Scope] Adobe BlazeDS 3.2 and earlier, and integrated products including LiveCycle, ColdFusion, and Flex Data Services

[Impact] Unauthenticated remote attackers can read arbitrary local files and disclose sensitive system information via crafted XML requests

[Mitigation] Apply official security patches or disable external entity resolution (XXE) in the XML parser configuration

[Affected Scope] Systems running Microsoft Windows 2000 SP4, XP SP2/SP3, Server 2003 SP2, Vista, and Server 2008 utilizing the MPEG2TuneRequest ActiveX control (msvidctl.dll)

[Impact] Remote attackers can execute arbitrary code with the privileges of the logged-in user by enticing them to visit a specially crafted malicious web page

[Mitigation] Apply the official Microsoft security updates (MS09-037) or configure the ActiveX Kill Bit in the Windows Registry to disable the vulnerable control

[Affected Scope] Microsoft Office PowerPoint 2000 SP3, 2002 SP3, 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac.

[Impact] Remote attackers can execute arbitrary code with the privileges of the active user by tricking them into opening a specially crafted PowerPoint file.

[Mitigation] Apply the official Microsoft MS09-017 security update immediately and restrict the execution of untrusted PPT/PPS files.

[Affected Scope] phpMyAdmin versions 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1

[Impact] Unauthenticated remote attackers can inject arbitrary PHP code into the configuration file via the setup.php save action, leading to full system compromise

[Mitigation] Upgrade to patched versions immediately, or delete/restrict access to the setup.php script in production environments

[Affected Scope] HP OpenView Network Node Manager (NNM) versions 6.2 through 7.50 are affected.

[Impact] Remote attackers can execute arbitrary system commands with web server privileges without authentication by injecting shell metacharacters into vulnerable OVPL scripts.

[Mitigation] Restrict external access to the vulnerable OVPL scripts immediately and apply official vendor patches or upgrade to a supported version.