CVE Vulnerability Advisory Database

[Affected Scope] Google Chrome versions prior to 99.0.4844.84 and all affected Chromium-based browsers (Edge, Brave, Opera, etc.)

[Impact] A remote attacker can exploit heap corruption via a specially crafted HTML page, potentially leading to arbitrary code execution (RCE) within the browser process context

[Mitigation] Immediately update all Chromium-based browsers to the latest stable release (Chrome 99.0.4844.84 or higher)

[Affected Scope] Zoho ManageEngine Password Manager Pro before 12101, PAM360 before 5510, and Access Manager Plus before 4303

[Impact] Unauthenticated (or authenticated for Access Manager Plus) attackers can execute arbitrary code with system privileges by sending malicious XML-RPC requests

[Mitigation] Immediately upgrade to the patched versions (Password Manager Pro 12101, PAM360 5510, Access Manager Plus 4303 or higher)

[Affected Scope] Apache Spark versions 3.0.3 and earlier, 3.1.1 to 3.1.2, and 3.2.0 to 3.2.1

[Impact] Remote attackers can execute arbitrary OS shell commands with the privileges of the Spark process via crafted HTTP requests

[Mitigation] Immediately upgrade Apache Spark to versions 3.1.3, 3.2.2, 3.3.0 or later, or disable the spark.acls.enable configuration

[Affected Scope] dotCMS versions 3.0 through 22.02

[Impact] Unauthenticated attackers can upload malicious JSP files via directory traversal when anonymous content creation is enabled, leading to full Remote Code Execution (RCE)

[Mitigation] Immediately upgrade to patched dotCMS versions (22.03 or higher) and disable anonymous content creation APIs if not required

[Affected Scope] Atlassian Confluence Server and Data Center versions from 1.3.0 before 7.4.17, and specific release lines up to 7.18.1

[Impact] An unauthenticated remote attacker can execute arbitrary Java code on the Confluence instance with system privileges, leading to full host compromise.

[Mitigation] Immediately upgrade Confluence to the patched versions (7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, 7.18.1 or higher) or apply the vendor-provided workaround JAR files.

[Affected Scope] Windows Operating Systems and Microsoft Office applications utilizing the Microsoft Support Diagnostics Tool (MSDT) protocol

[Impact] Remote attackers can execute arbitrary code with the privileges of the calling application, potentially taking full control of the system

[Mitigation] Apply the official Microsoft cumulative security updates immediately, or disable the MSDT URL protocol handler via registry modification

[Affected Scope] Contec SolarView Compact version 6.00 and prior.

[Impact] Unauthenticated attackers can execute arbitrary OS commands via the web interface, leading to complete system compromise.

[Mitigation] Apply the latest firmware updates immediately and restrict external internet access to the management interface.

[Affected Scope] Zyxel USG FLEX, ATP, and VPN series firewalls running vulnerable firmware versions (with ZTP enabled)

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges by sending crafted HTTP POST requests, leading to complete device compromise

[Mitigation] Immediately upgrade to the patched firmware versions recommended by Zyxel and restrict external access to the management interface

[Affected Scope] F5 BIG-IP versions 16.1.x (prior to 16.1.2.2), 15.1.x (prior to 15.1.5.1), 14.1.x (prior to 14.1.4.6), 13.1.x (prior to 13.1.5), and all end-of-support 12.1.x and 11.6.x versions

[Impact] Unauthenticated remote attackers can bypass iControl REST authentication via crafted HTTP requests, enabling them to execute arbitrary system commands with root privileges on the target system

[Mitigation] Immediately upgrade to the patched versions, restrict access to the management interface, or apply temporary workarounds such as modifying self-IP port lockdown settings

[Affected Scope] Apache CouchDB installations prior to version 3.2.2

[Impact] Unauthenticated attackers can bypass authentication, gain administrative privileges, and execute arbitrary code via Erlang distribution ports

[Mitigation] Upgrade Apache CouchDB to version 3.2.2 or higher, and restrict access to Erlang ports (4369, 9100-9200) using a firewall

[Affected Scope] Mitel MiVoice Connect through 19.2 SP3 Service Appliances (SA 100, SA 400, and Virtual SA).

[Impact] Unauthenticated remote attackers can exploit incorrect data validation to execute arbitrary code and gain full control over the affected appliance.

[Mitigation] Apply the official security patches immediately and restrict access to the management interfaces from the public internet.

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 8.8.15 and 9.0

[Impact] An authenticated administrator can upload a malicious ZIP archive to write arbitrary files, leading to Remote Code Execution (RCE)

[Mitigation] Immediately apply the official Zimbra security patches (9.0.0 Patch 24 / 8.8.15 Patch 31 or later)

[Affected Scope] WSO2 API Manager (2.2.0 to 4.0.0), Identity Server (5.2.0 to 5.11.0), Enterprise Integrator (6.2.0 to 6.6.0), and other major WSO2 products

[Impact] Unauthenticated attackers can upload and execute arbitrary JSP files via a crafted HTTP request, leading to complete system compromise

[Mitigation] Apply official WSO2 security patches immediately, restrict external access to the '/fileupload' endpoint, and disable execution permissions in web root subdirectories

[Affected Scope] Zoho ManageEngine ADSelfService Plus versions prior to build 6122

[Impact] A remote authenticated administrator or partially authenticated attacker can execute arbitrary OS commands with SYSTEM privileges by exploiting the policy custom script feature and unsanitized input fields

[Mitigation] Immediately upgrade ADSelfService Plus to build 6122 or later, change default administrator credentials, and restrict external access

[Affected Scope] Java applications utilizing JAI-EXT library versions prior to 1.2.22, including downstream GeoServer deployments.

[Impact] Unauthenticated remote attackers can execute arbitrary Java code on the target server by injecting malicious Jiffle scripts, leading to complete system compromise.

[Mitigation] Immediately upgrade JAI-EXT to version 1.2.22 or higher, or temporarily remove the Janino compiler JAR file from the classpath.

[Affected Scope] Specific versions of VMware Workspace ONE Access and Identity Manager

[Impact] Unauthenticated remote attackers with network access can execute arbitrary system commands on the target server, posing a critical risk (CVSS 9.8)

[Mitigation] Immediately apply the official security patches (VMSA-2022-0011) or implement temporary workarounds to restrict external access

[Affected Scope] Spring MVC or Spring WebFlux applications running on JDK 9+ and deployed as a WAR on Apache Tomcat.

[Impact] Unauthenticated remote attackers can manipulate HTTP request parameters to modify Tomcat logging configurations and upload a web shell, leading to complete system compromise.

[Mitigation] Immediately upgrade Spring Framework to secure versions (5.3.18+, 5.2.20+) or update the corresponding Spring Boot parent version.

[Affected Scope] Spring Cloud Function versions 3.1.6, 3.2.2, and older unsupported versions

[Impact] Unauthenticated remote attackers can inject malicious SpEL expressions via HTTP headers to execute arbitrary system commands and access local resources.

[Mitigation] Immediately upgrade Spring Cloud Function to version 3.1.7, 3.2.3, or higher, and block suspicious routing headers using WAF rules.

[Affected Scope] D-Link DIR-820L firmware version 1.05B03 and prior.

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges via crafted HTTP POST requests, leading to full device compromise.

[Mitigation] Since this device is End-of-Life (EOL), immediate replacement of the hardware is highly recommended. Alternatively, disable remote management and restrict access.

[Affected Scope] Systems running macOS Monterey prior to 12.2.1, iOS prior to 15.3.1, iPadOS prior to 15.3.1, and Safari prior to 15.3

[Impact] Processing maliciously crafted web content may lead to arbitrary remote code execution (RCE) on the target system, with active exploitation reported in the wild

[Mitigation] Immediately apply official Apple security updates to upgrade macOS, iOS, iPadOS, and Safari to the patched versions