CVE Vulnerability Advisory Database

[Affected Scope] SAP NetWeaver Application Server Java version 7.5.

[Impact] Unauthenticated remote attackers can read arbitrary system and configuration files by exploiting a directory traversal vulnerability using '..' sequences in the query string.

[Mitigation] Apply SAP Security Note 2486657 immediately, and implement WAF rules to block directory traversal patterns in the interim.

[Affected Scope] Cisco IOS and IOS XE Software with SNMP enabled and affected MIBs/OIDs not explicitly excluded

[Impact] Authenticated remote attackers can execute arbitrary code with full system control or trigger a device reload by sending crafted SNMP packets

[Mitigation] Apply official software updates via Cisco IOS Software Checker, or implement SNMPv3 hardening and MIB filtering workarounds

[Affected Scope] Zyxel EMG2926 home routers running firmware version V1.00(AAQT.4)b8

[Impact] An authenticated attacker can execute arbitrary system commands with root privileges by manipulating diagnostic parameters

[Mitigation] Apply the latest firmware updates immediately and restrict external access to the management interface

[Affected Scope] NETGEAR DGN2200 wireless ADSL2+ modem router devices running firmware versions up to and including 10.0.0.50.

[Impact] Remote authenticated attackers can execute arbitrary OS commands with root privileges via shell metacharacters in the ping_IPAddr parameter of HTTP POST requests, leading to complete device compromise.

[Mitigation] Apply the latest official firmware updates from NETGEAR, disable remote management, and restrict access to the web administration interface.

[Affected Scope] Adobe Flash Player versions 23.0.0.207 and earlier, and 11.2.202.644 and earlier for Linux

[Impact] Successful exploitation allows remote attackers to execute arbitrary code on the target system via memory corruption

[Mitigation] Since Adobe Flash Player has reached End-of-Life (EOL), the recommended mitigation is to completely uninstall the software from all systems

[Affected Scope] Apache ActiveMQ 5.x before 5.14.0 with the Fileserver web application enabled

[Impact] Unauthenticated remote attackers can upload and execute arbitrary JSP files via HTTP PUT and MOVE requests, leading to complete system compromise

[Mitigation] Upgrade Apache ActiveMQ to version 5.14.0 or later, or disable the Fileserver web application in the jetty.xml configuration

[Affected Scope] SAP NetWeaver Application Server Java platforms, typically prior to version 7.3

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands and Java code via crafted HTTP/HTTPS requests (CVSS 10.0)

[Mitigation] Apply SAP Note 1445998 and disable the Invoker Servlet globally in the web.xml configuration

[Affected Scope] IBM WebSphere Application Server and associated business, analytics, and mobile solutions utilizing vulnerable Apache Commons Collections library versions

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with system privileges by sending crafted serialized Java objects to exposed interfaces

[Mitigation] Apply official IBM security patches (Interim Fixes) immediately, or implement JVM-level deserialization filters to block the InvokerTransformer class

[Affected Scope] Linux systems utilizing libuser versions before 0.56.13-8 and 0.60 before 0.60-7, specifically via the userhelper utility in the usermode package

[Impact] Local attackers can cause a Denial of Service (DoS) by corrupting the /etc/passwd file, or combine this with CVE-2015-3245 to achieve full root privilege escalation

[Mitigation] Immediately update the libuser and usermode packages to the latest patched versions using your system package manager

[Affected Scope] Routers and embedded devices utilizing the Realtek SDK with the miniigd UPnP SOAP service enabled

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending crafted SOAP requests, leading to complete device compromise

[Mitigation] Disable the UPnP service, block external access to port 52869/TCP, and apply the latest firmware updates from the device vendor

[Affected Scope] Cisco Prime Data Center Network Manager (DCNM) versions prior to 7.1(1)

[Impact] Unauthenticated remote attackers can read arbitrary system files by sending crafted HTTP requests containing directory traversal sequences

[Mitigation] Immediately upgrade Cisco DCNM to version 7.1(1) or later, and restrict access to the DCNM management interface

[Affected Scope] Adobe Flash Player through 13.0.0.262, 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X, and through 11.2.202.438 on Linux

[Impact] Remote attackers can execute arbitrary code with the privileges of the active user and compromise the host system by enticing users to visit a website containing malicious Flash content (SWF)

[Mitigation] Since Adobe Flash Player has reached End-of-Life (EOL), it is highly recommended to completely uninstall Flash Player from all endpoints and disable Flash plugins in web browsers

[Affected Scope] Microsoft Internet Explorer versions 6 through 11

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (memory corruption) via crafted web pages, potentially leading to full system compromise

[Mitigation] Apply the official Microsoft cumulative security update, or implement immediate workarounds such as unregistering VGX.DLL and enabling Enhanced Mitigation Experience Toolkit (EMET)

[Affected Scope] D-Link DSL-2760U Gateway (Rev. E1) hardware and firmware.

[Impact] Remote authenticated attackers can inject arbitrary web script or HTML via multiple parameters, leading to administrator session hijacking and device compromise.

[Mitigation] Apply the latest official firmware patches, disable external WAN management interfaces, and restrict access to trusted IP ranges.

[Affected Scope] Microsoft Internet Explorer versions 6 through 11

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (memory corruption) via crafted JavaScript code leveraging the onpropertychange event handler

[Mitigation] Apply the official MS13-080 security update immediately, transition to modern browsers, or implement temporary workarounds such as unregistering VGX.dll

[Affected Scope] Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03

[Impact] Attackers can execute arbitrary code or cause a denial of service (memory corruption) via crafted PDF files

[Mitigation] Immediately upgrade to patched versions (9.5.5, 10.1.7, 11.0.03 or later) and enforce sandbox security policies

[Affected Scope] Adobe Flash Player versions before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 11.2.202.273 on Linux

[Impact] Remote attackers can execute arbitrary code and gain full control of the target system by enticing users to load a specially crafted SWF file

[Mitigation] Immediately uninstall Adobe Flash Player from all endpoints and servers, or disable Flash execution within web browsers and document viewers

[Affected Scope] Oracle Java 7 Update 10 and earlier versions (all versions prior to Java 7 Update 11).

[Impact] Remote attackers can completely bypass the JVM security sandbox and execute arbitrary system commands with the privileges of the running user by enticing them to visit a malicious web page containing a crafted Java applet.

[Mitigation] Immediately upgrade to Oracle Java 7 Update 11 or later (or migrate to modern LTS versions like Java 8/11/17), and disable the Java browser plug-in across all enterprise endpoints.

[Affected Scope] Adobe ColdFusion versions 9.0, 9.0.1, and 9.0.2

[Impact] Unauthenticated remote attackers can obtain sensitive system configuration files and session tokens, potentially leading to full administrative compromise

[Mitigation] Apply the official APSB13-03 security patch immediately and restrict external access to the /CFIDE directory

[Affected Scope] Adobe ColdFusion versions 9.0, 9.0.1, and 9.0.2 when an administrator password is not configured

[Impact] Remote attackers can bypass authentication, gain administrative access, and potentially execute arbitrary code to compromise the server

[Mitigation] Apply the official Adobe security patch (APSB13-03), enforce strong administrator passwords, and restrict external access to the admin console