CVE Vulnerability Advisory Database

[Affected Scope] PHP versions 8.1.x (before 8.1.29), 8.2.x (before 8.2.20), and 8.3.x (before 8.3.8) running on Windows with Apache and PHP-CGI configuration under specific system code pages

[Impact] Unauthenticated remote attackers can inject arbitrary command-line options into the PHP binary, leading to remote code execution (RCE) and source code disclosure

[Mitigation] Immediately upgrade to patched PHP versions (8.1.29, 8.2.20, 8.3.8 or later) or apply Apache Rewrite rules to block malicious query strings

[Affected Scope] Ivanti Endpoint Manager (EPM) 2022 SU5 and prior (Core Server component)

[Impact] Unauthenticated attackers within the same network can exploit an SQL injection vulnerability to execute arbitrary code with SYSTEM privileges

[Mitigation] Immediately apply the official security patch (EPM 2022 SU6 or later) and restrict network access to the Core Server

[Affected Scope] Rejetto HTTP File Server (HFS) up to and including version 2.3m

[Impact] Unauthenticated remote attackers can execute arbitrary commands on the host system by sending a specially crafted HTTP request

[Mitigation] Immediately discontinue the use of HFS 2.x, migrate to the completely redesigned HFS 3, or restrict network access

[Affected Scope] Progress Telerik Report Server 2024 Q1 (10.0.24.305) and earlier versions hosted on IIS

[Impact] Unauthenticated remote attackers can bypass authentication mechanisms to gain administrative access, access restricted functionality, or potentially execute arbitrary code

[Mitigation] Immediately upgrade Telerik Report Server to the latest secure version (2024 Q2 10.1.24.514 or later) and restrict IIS access to trusted IPs

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 124.0.6367.207

[Impact] A remote attacker can trigger an out-of-bounds memory write via a crafted HTML page, potentially leading to arbitrary code execution or denial of service (DoS)

[Mitigation] Immediately update Google Chrome to the latest stable version (124.0.6367.207 or higher) and enforce automatic update policies across the enterprise

[Affected Scope] Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software

[Impact] An authenticated, local attacker with administrator privileges can execute arbitrary code with root-level privileges and establish persistence across device reboots by preloading crafted files

[Mitigation] Apply the official security updates provided by Cisco immediately and audit the flash file system for unauthorized files

[Affected Scope] All versions of CrushFTP prior to 10.7.1 and 11.1.0 across all operating system platforms

[Impact] Unauthenticated remote attackers can bypass the VFS Sandbox, read arbitrary files from the filesystem, bypass authentication to gain administrative access, and execute arbitrary code on the server.

[Mitigation] Immediately upgrade CrushFTP to the patched versions (10.7.1 or 11.1.0 or higher) and apply WAF rules to block template injection payloads.

[Affected Scope] Apache HugeGraph-Server versions from 1.0.0 before 1.3.0 running on Java 8 & Java 11

[Impact] Unauthenticated remote attackers can bypass security controls and execute arbitrary system commands via the Gremlin query engine, leading to full system compromise

[Mitigation] Upgrade Apache HugeGraph-Server to version 1.3.0 or higher with Java 11, and ensure the Authentication system is enabled

[Affected Scope] Palo Alto Networks PAN-OS 10.2, 11.0, and 11.1 firewalls with GlobalProtect gateway or portal enabled

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges on the firewall via specially crafted requests

[Mitigation] Immediately apply the official PAN-OS hotfix, or implement temporary workarounds such as disabling Device Telemetry or applying Threat Prevention signatures

[Affected Scope] All supported versions of Windows 10, Windows 11, and Windows Server utilizing Microsoft Defender SmartScreen

[Impact] Attackers can bypass Mark-of-the-Web (MotW) warnings and SmartScreen prompts entirely, leading to arbitrary code execution when a user opens a crafted malicious file

[Mitigation] Apply the official Microsoft cumulative security updates immediately, or restrict the execution of unverified downloaded files via Group Policy

[Affected Scope] All firmware versions of legacy D-Link NAS models DNS-320L, DNS-325, DNS-327L, and DNS-340L.

[Impact] Remote unauthenticated attackers can bypass authentication using hard-coded credentials, leading to complete system compromise and arbitrary code execution.

[Mitigation] Since these devices are End-of-Life (EOL) and will not receive security patches, they must be immediately decommissioned and replaced.

[Affected Scope] All JetBrains TeamCity versions prior to 2023.11.4

[Impact] Unauthenticated remote attackers can completely bypass authentication mechanisms to gain administrative privileges, leading to full server compromise and arbitrary remote code execution (RCE)

[Mitigation] Immediately upgrade TeamCity server to version 2023.11.4 or later, or apply the official security patch plugin

[Affected Scope] Progress Kemp LoadMaster OS (LMOS) versions prior to 7.2.48.10, 7.2.54.8, and 7.2.59.2

[Impact] Unauthenticated remote attackers can access the system via the management interface to execute arbitrary OS commands and gain full system control

[Mitigation] Immediately upgrade to patched LMOS versions (7.2.59.2, 7.2.54.8, 7.2.48.10 or higher) and restrict external access to the management interface

[Affected Scope] ConnectWise ScreenConnect versions 23.9.7 and prior

[Impact] Attackers can bypass authentication to create administrative accounts, leading to full system compromise and Remote Code Execution (RCE) [1, 1.1]

[Mitigation] Immediately upgrade to the patched version (23.9.8 or higher) and restrict external access to the management interface

[Affected Scope] On-premise deployments of ConnectWise ScreenConnect version 23.9.7 and prior

[Impact] Attackers can exploit a path traversal vulnerability to escape restricted directories, upload malicious files, and achieve arbitrary remote code execution (RCE)

[Mitigation] Immediately upgrade ConnectWise ScreenConnect to the patched version (23.9.8 or higher)

[Affected Scope] FortiOS (7.0.0~7.0.13, 7.2.0~7.2.6, 7.4.0~7.4.2), FortiProxy (7.0.0~7.0.14, 7.2.0~7.2.8, 7.4.0~7.4.2), FortiPAM, and FortiSwitchManager specific versions

[Impact] Unauthenticated remote attackers can execute unauthorized code or commands with root privileges via specially crafted packets

[Mitigation] Upgrade to the official patched versions immediately, or disable the FGFM (FortiGate Federation Management) service on interfaces as a temporary workaround

[Affected Scope] FortiOS versions 6.0 through 7.4.2 and FortiProxy versions 1.0 through 7.4.2 with SSL-VPN service enabled

[Impact] Unauthenticated remote attackers can execute arbitrary code or commands on the target system via specially crafted HTTP requests

[Mitigation] Immediately upgrade to the patched firmware versions, or disable the SSL-VPN service as a temporary workaround

[Affected Scope] Devices running Safari prior to 17.3, iOS/iPadOS 15.8.7/16.7.5/17.3, macOS Monterey/Ventura/Sonoma, tvOS, and visionOS

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution (RCE) due to a type confusion issue, which has been actively exploited in the wild

[Mitigation] Immediately apply the official security updates and OS patches provided by Apple

[Affected Scope] Citrix NetScaler ADC and NetScaler Gateway appliances with management interfaces (NSIP, CLIP, or SNIP) exposed and possessing authenticated (low-privileged) credentials

[Impact] Authenticated attackers can perform remote code execution (RCE) on the management interface, potentially leading to full system compromise

[Mitigation] Immediately apply the official security patches provided by Citrix and restrict access to management interfaces (NSIP, CLIP, SNIP)

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 120.0.6099.224

[Impact] A remote attacker can trigger heap corruption via a crafted HTML page, potentially leading to arbitrary code execution (RCE) or sensitive information disclosure within the browser renderer process

[Mitigation] Immediately update Google Chrome and Chromium-based browsers to the latest stable version (120.0.6099.224 or higher)