CVE Vulnerability Advisory Database

[Affected Scope] CentOS Web Panel (CWP) 7 versions prior to 0.9.8.1147

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges on the target server by injecting shell metacharacters into the login parameter.

[Mitigation] Immediately upgrade CWP 7 to version 0.9.8.1147 or later, and restrict access to the management ports using firewalls.

[Affected Scope] FortiOS versions 7.2.0 to 7.2.2, 7.0.0 to 7.0.8, 6.4.0 to 6.4.10, 6.2.0 to 6.2.11, 6.0.15 and earlier; FortiProxy versions 7.2.0 to 7.2.1, 7.0.7 and earlier

[Impact] An unauthenticated remote attacker can execute arbitrary code or commands with root privileges on the target system by sending specifically crafted HTTP/HTTPS requests

[Mitigation] Immediately upgrade to the patched firmware versions or disable the SSL-VPN service and restrict access using local-in policies if patching is delayed

[Affected Scope] Citrix ADC and Citrix Gateway versions 12.1 and 13.0 with SAML SP or IdP configuration enabled

[Impact] Unauthenticated remote attackers can execute arbitrary code on the target appliance and gain full system control by sending specially crafted requests

[Mitigation] Immediately upgrade to the patched firmware versions (12.1-65.25, 13.0-88.16, or higher) provided by Citrix

[Affected Scope] D-Link DNR-322L Cloud Network Video Recorder firmware versions 2.60B15 and prior

[Impact] An authenticated attacker can exploit the lack of data integrity verification in the backup configuration feature to execute arbitrary OS-level commands and fully compromise the device

[Mitigation] Since this product is End-of-Life (EOL), immediately isolate the device from the external network and migrate to a supported alternative

[Affected Scope] Windows client and server environments utilizing the Windows Scripting Engine (JScript9)

[Impact] Successful exploitation allows remote attackers to execute arbitrary code with the privileges of the active user via crafted web content or documents

[Mitigation] Apply the official Microsoft cumulative security updates immediately and restrict the execution of legacy JScript engines

[Affected Scope] Netwrix Auditor server and User Activity Video Recording agents installed on monitored systems

[Impact] Unauthenticated remote attackers can execute arbitrary code with 'NT AUTHORITY\SYSTEM' privileges on affected servers and monitored hosts

[Mitigation] Immediately upgrade Netwrix Auditor to the latest secure version and restrict network access to agent communication ports

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 107.0.5304.87

[Impact] A remote attacker can potentially exploit heap corruption via a crafted HTML page, leading to arbitrary remote code execution (RCE) within the browser renderer process

[Mitigation] Immediately update Google Chrome to the latest stable version (107.0.5304.87 or higher) and enforce automatic updates across enterprise environments

[Affected Scope] D-Link DSL-2750B devices running firmware versions prior to 1.05

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges via the 'cli' parameter in login.cgi

[Mitigation] Apply the official firmware patch (v1.05 or later) or immediately disable WAN-side access to the web management interface

[Affected Scope] FortiOS (7.2.0 to 7.2.1, 7.0.0 to 7.0.6), FortiProxy (7.2.0, 7.0.0 to 7.0.6), FortiSwitchManager (7.2.0, 7.0.0)

[Impact] An unauthenticated remote attacker can bypass authentication via specially crafted HTTP/HTTPS requests, gaining full administrative access to perform arbitrary operations

[Mitigation] Immediately upgrade to patched versions (FortiOS 7.2.2 / 7.0.7 or higher) or disable HTTP/HTTPS administrative access from untrusted networks

[Affected Scope] On-premises Microsoft Exchange Server 2013, 2016, and 2019 versions lacking the latest cumulative and security updates

[Impact] Authenticated remote attackers can exploit untrusted deserialization in the Exchange PowerShell backend to execute arbitrary commands with SYSTEM privileges

[Mitigation] Apply official Microsoft security updates immediately, or implement IIS URL Rewrite rules and restrict Remote PowerShell access as temporary workarounds

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 8.8.15 and 9.0 running on Red Hat-based distributions (RHEL/CentOS) where the 'pax' utility is missing.

[Impact] Unauthenticated attackers can upload arbitrary files to the web root directory via a cpio path traversal loophole during amavis scanning, leading to full system compromise.

[Mitigation] Immediately install the 'pax' utility via the OS package manager or upgrade Zimbra to the latest patched version.

[Affected Scope] Sophos Firewall version v19.0 MR1 and older affecting User Portal and Webadmin interfaces

[Impact] Unauthenticated remote attackers can execute arbitrary code and fully compromise the firewall device by sending specially crafted HTTP requests

[Mitigation] Immediately upgrade to the latest firmware version (v19.0 MR2 or later) and disable WAN access to Webadmin and User Portal

[Affected Scope] Trend Micro Apex One and Apex One as a Service client agents

[Impact] An attacker with administrative console access can force clients to execute unverified rollback packages, leading to Remote Code Execution (RCE) with SYSTEM privileges

[Mitigation] Apply the official Trend Micro security patches (CP 11136 / SP1 CP 11046 or higher) and restrict access to the admin console

[Affected Scope] GLPI versions up to and including 10.0.2, specifically within the bundled htmLawed module

[Impact] Unauthenticated remote attackers can inject and execute arbitrary PHP code, leading to full system compromise

[Mitigation] Immediately upgrade GLPI to version 10.0.3 or higher, or delete the vulnerable test script (htmLawedTest.php)

[Affected Scope] D-Link GO-RT-AC750 hardware revA (firmware v101b03 and prior) and revB (firmware FWv200b02 and prior).

[Impact] Unauthenticated remote attackers can execute arbitrary code with root privileges or cause a complete system compromise by sending crafted HTTP requests to the WAN/LAN interface.

[Mitigation] Apply the latest firmware updates immediately, or replace end-of-life (EoL) devices and disable remote WAN management interfaces.

[Affected Scope] ZK Framework versions 9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2, 8.6.4.1, and prior

[Impact] Unauthenticated attackers can access sensitive system files and class resources via crafted POST requests, potentially leading to Remote Code Execution (RCE).

[Mitigation] Immediately upgrade ZK Framework to patched versions (9.6.2, 9.6.0.2, 9.5.1.4, 9.0.1.3, 8.6.4.2 or later) and block suspicious AuUploader requests via WAF.

[Affected Scope] Atlassian Bitbucket Server and Data Center versions 7.0.0 up to 8.3.0 (excluding specific patched releases)

[Impact] Remote attackers with read permissions to a public or private repository can execute arbitrary OS commands via malicious HTTP requests

[Mitigation] Immediately upgrade Bitbucket instances to the official patched versions (7.6.17, 7.17.10, 7.21.4, 8.0.3, 8.1.3, 8.2.2, 8.3.1 or higher)

[Affected Scope] Apple devices running versions prior to iOS 15.6.1, iPadOS 15.6.1, macOS Monterey 12.5.1, and Safari 15.6.1

[Impact] Processing maliciously crafted web content may allow remote attackers to execute arbitrary code (RCE) and compromise the target system

[Mitigation] Immediately apply the official security patches provided by Apple (iOS 15.6.1, macOS 12.5.1, Safari 15.6.1 or later)

[Affected Scope] Microsoft Windows 7, 8.1, 10, 11 and Windows Server 2008, 2012, 2016, 2019, 2022 supporting the MSDT protocol

[Impact] Successful exploitation allows remote attackers to execute arbitrary code on the target system when a user opens a specially crafted '.diagcab' file

[Mitigation] Apply the official Microsoft security updates immediately, or disable the MSDT URL protocol handler as a temporary workaround

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 100.0.4896.127

[Impact] A remote attacker can exploit heap corruption via a crafted HTML page to execute arbitrary code within the browser process context

[Mitigation] Immediately update Google Chrome and Chromium-based browsers to the latest stable version (100.0.4896.127 or higher)