CVE Vulnerability Advisory Database

[Affected Scope] Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1

[Impact] Unauthenticated remote attackers can execute arbitrary system commands and fully compromise the target server by sending specially crafted inputs to the postjournal service.

[Mitigation] Immediately upgrade Zimbra to the latest patched versions (8.8.15 P46, 9.0.0 P41, 10.0.9, 10.1.1 or later), or disable the postjournal service if not required.

[Affected Scope] VMware vCenter Server versions 7.0 and 8.0, VMware Cloud Foundation versions 4.x and 5.x

[Impact] An unauthenticated remote attacker can trigger a heap overflow via specially crafted DCERPC packets, potentially executing arbitrary code with root privileges

[Mitigation] Immediately apply the official Broadcom security patches (vCenter 8.0 U3b / 7.0 U3s or later) and restrict network access to vCenter management ports

[Affected Scope] Ivanti Cloud Services Appliance (CSA) versions 4.6 Patch 518 and prior

[Impact] A remote authenticated attacker with admin-level privileges can inject arbitrary OS commands, leading to remote code execution and full system compromise

[Mitigation] Immediately upgrade to the supported Ivanti CSA 5.0 version or apply the latest security patches to mitigate active exploitation risks

[Affected Scope] Apache OFBiz versions prior to 18.12.16

[Impact] Unauthenticated remote attackers can bypass authorization checks to access internal business logic and sensitive data directly, potentially leading to Remote Code Execution (RCE).

[Mitigation] Immediately upgrade Apache OFBiz to the official patched version 18.12.16 or higher.

[Affected Scope] Authenticated Versa Director systems with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges

[Impact] Authenticated attackers can exploit the 'Change Favicon' feature to upload malicious files masquerading as .png images, leading to arbitrary code execution on the host system

[Mitigation] Apply the official security patches from Versa Networks immediately and restrict access to the management GUI to trusted IP addresses only

[Affected Scope] SolarWinds Web Help Desk (WHD) 12.8.3 and prior versions

[Impact] Remote unauthenticated attackers can exploit hardcoded credentials to access internal functionality and modify sensitive data.

[Mitigation] Immediately apply the official SolarWinds 12.8.3 Hotfix 2 or later, and restrict external network access.

[Affected Scope] Google Chrome prior to 128.0.6613.84 and all affected Chromium-based browsers (e.g., Microsoft Edge)

[Impact] Remote attackers can trigger heap corruption and execute arbitrary code within the browser renderer process via a crafted HTML page

[Mitigation] Immediately update all Chromium-based browsers to the latest stable release (Chrome 128.0.6613.84 or higher)

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 128.0.6613.84

[Impact] A remote attacker can trigger heap corruption via a crafted HTML page, potentially leading to arbitrary code execution (RCE) within the browser process

[Mitigation] Immediately update Google Chrome to the latest stable version (128.0.6613.84/.85 or higher)

[Affected Scope] Kingsoft WPS Office on Windows, versions 12.2.0.13110 up to (but excluding) 12.2.0.16412

[Impact] An attacker can achieve arbitrary Windows library (DLL) loading and remote code execution (RCE) by tricking a user into opening a specially crafted spreadsheet document

[Mitigation] Immediately upgrade Kingsoft WPS Office to the patched version (12.2.0.16412 or higher) and restrict opening untrusted documents

[Affected Scope] SolarWinds Web Help Desk (WHD) 12.8.3 and all prior versions

[Impact] Successful exploitation allows remote attackers to execute arbitrary commands on the host machine via unsafe Java deserialization, potentially leading to full system compromise

[Mitigation] Immediately apply the official SolarWinds Web Help Desk 12.8.3 Hotfix 1 or upgrade to the latest patched version

[Affected Scope] Windows 10, 11, and Windows Server environments utilizing the legacy JScript9 engine, particularly with Internet Explorer mode enabled

[Impact] Remote Code Execution (RCE) and full system compromise via specially crafted malicious web pages

[Mitigation] Apply the Microsoft August 2024 security updates immediately and disable legacy IE scripting engines where applicable

[Affected Scope] Samsung MagicINFO 9 Server versions prior to 21.1050

[Impact] Unauthenticated remote attackers can write arbitrary files with SYSTEM authority, potentially leading to Remote Code Execution (RCE).

[Mitigation] Immediately upgrade MagicINFO 9 Server to version 21.1050 or later, and restrict external network access.

[Affected Scope] Apache OFBiz versions up to and including 18.12.14

[Impact] Unauthenticated remote attackers can execute arbitrary screen rendering code and system commands by sending specially crafted HTTP requests

[Mitigation] Immediately upgrade Apache OFBiz to the latest stable version 18.12.15 or higher

[Affected Scope] ServiceNow Now Platform Washington DC, Vancouver, and earlier releases

[Impact] An unauthenticated remote attacker can execute arbitrary code within the context of the Now Platform due to improper input validation

[Mitigation] Apply the official security patches and hotfixes released during the June 2024 patching cycle immediately

[Affected Scope] ServiceNow Now Platform Vancouver and Washington DC releases

[Impact] Unauthenticated remote attackers can execute arbitrary code within the context of the Now Platform, potentially leading to full system compromise

[Mitigation] Apply official security patches and hotfixes immediately, and restrict external access for self-hosted instances while monitoring for IoCs

[Affected Scope] Microsoft SharePoint Server 2016, 2019, and Subscription Edition

[Impact] An authorized attacker with Site Owner permissions can execute arbitrary code within the server context via specially crafted API requests, leading to full system compromise

[Mitigation] Apply the official Microsoft Cumulative Update (CU) patches immediately, restrict administrative privileges, and audit system logs for indicators of compromise

[Affected Scope] Apache HTTP Server versions 2.4.59 and earlier, specifically environments utilizing mod_rewrite rules where substitutions in server context use backreferences or variables as the first segment.

[Impact] Attackers can map URLs to restricted filesystem locations, leading to unauthorized source code disclosure or arbitrary code execution (RCE).

[Mitigation] Immediately upgrade Apache HTTP Server to version 2.4.60 or later, and review/restrict unsafe RewriteRules.

[Affected Scope] All default installations of GeoServer prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2

[Impact] Unauthenticated remote attackers can execute arbitrary system commands on the host server via manipulated OGC request parameters

[Mitigation] Immediately upgrade to patched versions (2.22.6, 2.23.6, 2.24.4, 2.25.2 or higher) or apply the workaround by removing the 'gt-complex' JAR file

[Affected Scope] Progress WhatsUp Gold versions prior to 2023.1.3

[Impact] Unauthenticated remote attackers can execute arbitrary commands with 'iisapppool\ mconsole' privileges, leading to full system compromise

[Mitigation] Immediately upgrade WhatsUp Gold to version 2023.1.3 or later and restrict external access

[Affected Scope] Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier

[Impact] Unauthenticated remote attackers can exploit this vulnerability to read arbitrary files and potentially achieve Remote Code Execution (RCE)

[Mitigation] Apply the official Adobe security patches (APSB24-40) or upgrade to the latest secure releases immediately