CVE Vulnerability Advisory Database

[Affected Scope] Atlassian Jira Server and Data Center versions before 8.5.14, 8.6.0 before 8.13.6, and 8.14.0 before 8.16.1

[Impact] Unauthenticated remote attackers can exploit a path traversal vulnerability to read sensitive configuration files, such as '/WEB-INF/web.xml'

[Mitigation] Immediately upgrade Jira instances to the patched versions (8.5.14, 8.13.6, 8.16.1, or later) and apply WAF access control rules

[Affected Scope] End-of-life (EOL) SonicWall Secure Remote Access (SRA) appliances running all 8.x firmware and 9.0.0.9-26sv or earlier

[Impact] Unauthenticated remote attackers can execute arbitrary SQL commands via crafted payloads, potentially leading to credential theft, database compromise, and remote code execution (RCE)

[Mitigation] Since the affected products are EOL, immediately decommission the SRA appliances and migrate to supported SMA (Secure Mobile Access) series, or restrict external access via firewall rules

[Affected Scope] Supported Windows operating system kernels, including Windows 10, Windows 11, and Windows Server 2016/2019/2022

[Impact] A local attacker with low privileges can trigger memory corruption (CWE-119) in the kernel to execute arbitrary code with SYSTEM privileges

[Mitigation] Immediately apply the official Microsoft Cumulative Updates (LCU) and monitor for local privilege escalation indicators

[Affected Scope] Microsoft Exchange Server 2013, 2016, and 2019

[Impact] High-privileged remote attackers can execute arbitrary code and gain full system control over the Exchange Server

[Mitigation] Immediately apply the official Microsoft Cumulative Updates (CU) and Security Updates (SU), and restrict external access

[Affected Scope] Pulse Connect Secure versions prior to 9.1R11.4

[Impact] An authenticated administrator can upload a maliciously crafted archive file to write arbitrary files to the system, potentially leading to remote code execution

[Mitigation] Immediately upgrade Pulse Connect Secure to version 9.1R11.4 or higher, and restrict external access to the administrator interface

[Affected Scope] Tenda AC11 wireless routers running firmware versions up to and including 02.03.01.104_CN

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending a specially crafted HTTP POST request

[Mitigation] Immediately upgrade to the latest patched firmware version and disable external WAN-side HTTP management interfaces

[Affected Scope] SonicWall Email Security version 10.0.9.x

[Impact] A post-authenticated attacker can upload arbitrary files to the remote host, potentially leading to remote code execution with system privileges

[Mitigation] Immediately upgrade to the official patched version (10.0.9.6173 or higher)

[Affected Scope] On-premises and virtual appliance deployments of SonicWall Email Security running version 10.0.9.x.

[Impact] Unauthenticated remote attackers can create administrative accounts by sending crafted HTTP requests, leading to full system compromise.

[Mitigation] Immediately upgrade to the patched firmware version (10.0.9.6173, 10.0.10, or higher).

[Affected Scope] Apple devices running iOS versions prior to 12.5.2, iOS versions prior to 14.4.2, iPadOS versions prior to 14.4.2, and watchOS versions prior to 7.3.3

[Impact] Processing maliciously crafted web content can bypass the Same-Origin Policy (SOP), leading to Universal Cross-Site Scripting (UXSS) and arbitrary script execution, which has been actively exploited in the wild

[Mitigation] Immediately update affected devices to the patched versions: iOS 12.5.2, iOS 14.4.2, iPadOS 14.4.2, watchOS 7.3.3, or later

[Affected Scope] Samsung devices equipped with DSP (Digital Signal Processor) driver prior to SMR (Security Maintenance Release) Mar-2021 Release 1

[Impact] A local attacker with high privileges can load arbitrary ELF libraries inside the DSP subsystem, potentially leading to complete system compromise and evasion of OS-level security controls

[Mitigation] Immediately apply the official Samsung security update (SMR Mar-2021 Release 1 or later)

[Affected Scope] Unpatched versions of Microsoft Office and Excel suites

[Impact] Remote attackers can execute arbitrary code under the context of the current user via crafted Office documents

[Mitigation] Apply the official Microsoft security patches immediately and restrict opening untrusted attachments

[Affected Scope] Accellion FTA versions 9_12_370 and earlier

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands and gain full system control by sending crafted POST requests to various admin endpoints

[Mitigation] Immediately upgrade to Accellion FTA version 9_12_380 or later, or migrate to a supported secure file transfer platform

[Affected Scope] Accellion FTA 9_12_411 and earlier

[Impact] Unauthenticated remote attackers can exploit this vulnerability via crafted POST requests to access internal network resources or chain it with other flaws for remote code execution

[Mitigation] Immediately upgrade Accellion FTA to version 9_12_416 or later and restrict external access

[Affected Scope] Micro Focus Operations Bridge Reporter (OBR) version 10.40.

[Impact] Unauthenticated remote attackers can execute arbitrary system commands on the OBR server, leading to complete system compromise.

[Mitigation] Apply the official vendor security patch (KM03775947) immediately and restrict external access to the OBR management ports.

[Affected Scope] QNAP QTS versions prior to 4.4.2.1231 Build 20200302, 4.4.1.1201 Build 20200130, 4.3.6.1218 Build 20200214, 4.3.4.1190 Build 20200107, 4.3.3.1161 Build 20200109, and 4.2.6 Build 20200109

[Impact] Remote attackers can inject malicious scripts into the web console, potentially leading to session hijacking or unauthorized administrative actions

[Mitigation] Immediately upgrade QTS to the patched versions recommended by QNAP and restrict external access to the management interface

[Affected Scope] QNAP NAS devices running QTS versions prior to 4.4.2.1270, 4.4.1.1261, 4.3.6.1263, 4.3.4.1282, 4.3.3.1252, and 4.2.6

[Impact] Remote authenticated attackers can inject malicious scripts, potentially leading to session hijacking, administrative privilege escalation, and unauthorized device control

[Mitigation] Immediately upgrade QTS firmware to the recommended patched versions and restrict external access to the NAS management interface

[Affected Scope] Pulse Connect Secure versions prior to 9.1R9 admin web interface

[Impact] An authenticated administrator-level attacker can execute arbitrary code with system privileges via uncontrolled gzip extraction

[Mitigation] Immediately upgrade Pulse Connect Secure to version 9.1R9 or higher and restrict external access to the admin interface

[Affected Scope] Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0

[Impact] Unauthenticated remote attackers can bypass authentication via HTTP and gain complete control (RCE) over the Oracle WebLogic Server

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately, or restrict external network access to the administration console (/console)

[Affected Scope] Oracle Business Intelligence Enterprise Edition (OBIEE) versions 5.5.0.0.0, 12.2.1.3.0, and 12.2.1.4.0

[Impact] Unauthenticated remote attackers can access sensitive system files and configuration data via crafted HTTP requests

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or implement path traversal blocking rules on Web Application Firewalls (WAF)

[Affected Scope] Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier

[Impact] Successful exploitation of this Use-After-Free vulnerability allows remote attackers to execute arbitrary code in the context of the current user by tricking them into opening a specially crafted PDF file

[Mitigation] Immediately apply the official Adobe security patch (APSB20-48) and restrict opening PDF files from untrusted sources