CVE Vulnerability Advisory Database

[Affected Scope] Older versions of Atlassian Confluence Data Center and Server (8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x, 8.5.0-8.5.3)

[Impact] Unauthenticated remote attackers can execute arbitrary system commands (RCE) on the affected instance by sending specially crafted HTTP requests.

[Mitigation] Immediately upgrade to the latest patched versions (8.5.4+ or newer LTS releases) provided by Atlassian.

[Affected Scope] Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) gateway appliances

[Impact] An authenticated administrator can send specially crafted HTTP requests to execute arbitrary OS commands with root privileges, leading to full appliance compromise

[Mitigation] Apply the official vendor security patches immediately, or import the temporary mitigation XML file provided by Ivanti to block vulnerable API endpoints

[Affected Scope] All applications utilizing Spreadsheet::ParseExcel library version 0.65 and prior

[Impact] Remote attackers can execute arbitrary Perl code and gain full system privileges by tricking the application into parsing a specially crafted Excel file

[Mitigation] Immediately upgrade the Spreadsheet::ParseExcel module to the patched version (0.66 or later)

[Affected Scope] Apple iOS prior to 17.1.2, iPadOS prior to 17.1.2, macOS Sonoma prior to 14.1.2, and Safari prior to 17.1.2

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution, with active exploitation reported in the wild

[Mitigation] Immediately apply the official Apple software updates to upgrade operating systems and Safari to the patched versions

[Affected Scope] Qlik Sense Enterprise for Windows (prior to specified patch levels)

[Impact] Unauthenticated remote attackers can elevate privileges and execute arbitrary code on the backend repository server via HTTP request tunneling.

[Mitigation] Immediately apply the official security patches (August 2023 Patch 2 or later, etc.) provided by the vendor.

[Affected Scope] All self-hosted versions of Confluence Data Center and Server. (Atlassian Cloud sites are not affected)

[Impact] Unauthenticated remote attackers can reset Confluence setup states and create unauthorized administrator accounts, leading to a complete compromise of confidentiality, integrity, and availability.

[Mitigation] Immediately upgrade to the latest patched versions or restrict external access to the setup endpoints (/setup/*) via reverse proxy or WAF configurations.

[Affected Scope] Apache ActiveMQ brokers and client libraries utilizing the OpenWire protocol

[Impact] Unauthenticated remote attackers can execute arbitrary shell commands on the target system by manipulating serialized class types

[Mitigation] Immediately upgrade both brokers and clients to patched versions (5.15.16, 5.16.7, 5.17.6, or 5.18.3 and above)

[Affected Scope] F5 BIG-IP Configuration Utility (accessible via management ports and/or self IP addresses)

[Impact] Authenticated attackers with network access can exploit SQL injection to manipulate the database and execute arbitrary system commands with root privileges

[Mitigation] Apply official F5 security patches immediately and restrict access to the Configuration Utility (TMUI) using firewalls and ACLs

[Affected Scope] F5 BIG-IP systems with network access to the Configuration Utility (TMUI) via the management port and/or Self IP addresses.

[Impact] Unauthenticated remote attackers can bypass authentication mechanisms and execute arbitrary system commands with root privileges on the target system.

[Mitigation] Immediately apply the official F5 security patches or restrict access to the TMUI (port 443) from untrusted networks as a temporary workaround.

[Affected Scope] NextGen Healthcare Mirth Connect versions prior to 4.4.1

[Impact] Unauthenticated remote attackers can bypass authentication to execute arbitrary OS commands with system privileges, leading to full host compromise

[Mitigation] Immediately upgrade Mirth Connect to version 4.4.1 or later, and restrict access to administrative ports

[Affected Scope] VMware vCenter Server 7.0 and 8.0 series, VMware Cloud Foundation 4.x and 5.x series

[Impact] An unauthenticated attacker with network access can trigger an out-of-bounds write, potentially leading to remote code execution (RCE) with administrative privileges

[Mitigation] Apply the official security patches immediately, and restrict network access to the vCenter DCERPC port (default 2012/tcp) using firewalls

[Affected Scope] On-premise deployments of Atlassian Confluence Data Center and Confluence Server (Atlassian Cloud instances are not affected)

[Impact] Unauthenticated remote attackers can bypass access controls to access setup endpoints, create unauthorized administrator accounts, and achieve full system compromise

[Mitigation] Immediately upgrade to the patched official versions, or restrict external access to the vulnerable /setup/* endpoints if patching cannot be applied immediately

[Affected Scope] Cisco IOS and Cisco IOS XE Software with the Group Encrypted Transport VPN (GET VPN) feature enabled

[Impact] An authenticated, remote attacker with administrative control over a key server or group member can execute arbitrary code or cause a device reload (DoS)

[Mitigation] Apply the official Cisco software updates and restrict GDOI/G-IKEv2 protocol access to authorized infrastructure nodes only

[Affected Scope] Progress WS_FTP Server versions prior to 8.7.4 and 8.8.2 with Ad Hoc Transfer module enabled

[Impact] A pre-authenticated remote attacker can execute arbitrary OS commands with IIS worker process privileges by sending a crafted .NET serialized payload

[Mitigation] Immediately upgrade to patched versions (8.7.4, 8.8.2, or higher) or disable/remove the Ad Hoc Transfer module

[Affected Scope] Apple WebKit-based browsers and applications on iOS versions prior to 16.7 and macOS prior to Sonoma 14

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution on the target system

[Mitigation] Immediately update Apple operating systems to the latest versions (iOS 16.7+ / macOS Sonoma 14+)

[Affected Scope] All on-premises versions of JetBrains TeamCity prior to 2023.05.4

[Impact] Unauthenticated attackers can bypass authentication, gain administrative privileges, hijack build pipelines, and execute arbitrary code on the server

[Mitigation] Immediately upgrade TeamCity server to version 2023.05.4 or later, or apply the official security patch plugin

[Affected Scope] Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security, and Worry-Free Business Security Services

[Impact] An attacker with administrative console access can manipulate the 3rd party AV uninstaller module to execute arbitrary commands with elevated privileges

[Mitigation] Immediately apply the official security patches provided by Trend Micro and restrict access to the administrative console

[Affected Scope] Google Chrome prior to 116.0.5845.187 and libwebp library prior to 1.3.2

[Impact] A remote attacker can trigger an out-of-bounds memory write and potentially execute arbitrary code via a crafted HTML page containing a malicious WebP image

[Mitigation] Immediately update Google Chrome to version 116.0.5845.187 or higher, and upgrade libwebp dependency to 1.3.2 or above

[Affected Scope] Apple iOS and iPadOS prior to 16.6.1, macOS Monterey prior to 12.6.9, macOS Ventura prior to 13.5.2, iOS/iPadOS prior to 15.7.9, and macOS Big Sur prior to 11.7.10

[Impact] Processing a maliciously crafted image can trigger a buffer overflow, leading to arbitrary code execution (RCE) and potential system takeover

[Mitigation] Immediately apply the official security updates (iOS 16.6.1, macOS 13.5.2, etc.) and consider enabling Lockdown Mode for high-risk environments

[Affected Scope] All Windows endpoint environments running RARLAB WinRAR versions prior to 6.23.

[Impact] Attackers can execute arbitrary code in the background when a user attempts to open a seemingly benign file within a crafted ZIP archive, leading to full system compromise.

[Mitigation] Immediately upgrade WinRAR to version 6.23 or higher, and restrict execution of untrusted archive files.