CVE Vulnerability Advisory Database

[Affected Scope] Veeam Backup & Replication versions 10.x and 11.x

[Impact] Unauthenticated remote attackers can execute arbitrary code with SYSTEM privileges, leading to backup data theft and infrastructure compromise

[Mitigation] Immediately apply the official vendor patch (KB4288) or restrict access to vulnerable ports and services

[Affected Scope] Veeam Backup & Replication versions 9.5U3, 9.5U4, 10.x, and 11.x

[Impact] Remote authenticated attackers can access internal API functions, upload arbitrary files, and execute malicious code with SYSTEM privileges

[Mitigation] Apply the official vendor patch (KB4288) immediately or restrict network access to vulnerable ports

[Affected Scope] WatchGuard Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2 on Firebox and XTM appliances

[Impact] An unauthenticated remote attacker can execute arbitrary code with administrative privileges, leading to complete compromise of the firewall appliance

[Mitigation] Immediately upgrade Fireware OS to the patched versions (12.7.2_U2, 12.5.9_U2, 12.1.3_U8 or higher) and restrict external access to management interfaces

[Affected Scope] Spring Cloud Gateway versions prior to 3.1.1 and 3.0.7, where the Gateway Actuator endpoint is enabled, exposed, and unsecured

[Impact] Unauthenticated remote attackers can execute arbitrary system commands on the host by sending maliciously crafted HTTP requests

[Mitigation] Immediately upgrade Spring Cloud Gateway to version 3.1.1, 3.0.7, or higher, and disable or secure the Gateway Actuator endpoint

[Affected Scope] Redis server instances installed via package managers (apt) on Debian, Ubuntu, and derived Linux distributions

[Impact] Unauthenticated remote attackers can bypass the Lua scripting sandbox to execute arbitrary system commands with the privileges of the Redis process (CVSS 10.0, CISA KEV Listed)

[Mitigation] Apply official OS package updates immediately, or disable EVAL/EVALSHA commands and restrict network access to localhost

[Affected Scope] All hardware revisions of D-Link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges via the DDNS function, leading to full device compromise

[Mitigation] Since these devices have reached End of Life (EOL), no official patches will be released; immediate device replacement or strict access control is required

[Affected Scope] Adobe Commerce and Magento Open Source versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier)

[Impact] Unauthenticated attackers can exploit improper input validation during the checkout process to execute arbitrary code (RCE) without user interaction, potentially leading to full system compromise

[Mitigation] Immediately apply the official Adobe security patches (APSB22-12) and update Web Application Firewall (WAF) rules

[Affected Scope] Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers

[Impact] Unauthenticated attackers can execute arbitrary code, elevate privileges, bypass authentication, and run unsigned software

[Mitigation] Apply the official Cisco firmware updates immediately and restrict access to the management interface

[Affected Scope] Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers

[Impact] Unauthenticated remote attackers can execute arbitrary code, elevate privileges, bypass authentication, and run unsigned software to fully compromise the device

[Mitigation] Immediately apply the latest firmware patches provided by Cisco and disable remote WAN management access

[Affected Scope] Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers

[Impact] Unauthenticated remote attackers can execute arbitrary code with root privileges or cause a complete system compromise via the SSL VPN gateway

[Mitigation] Immediately upgrade to the latest patched firmware versions provided by Cisco, and restrict access to the SSL VPN port from untrusted networks

[Affected Scope] Microsoft Windows operating systems utilizing Windows Runtime (WinRT), including Windows 10, Windows 11, and Windows Server 2016/2019/2022

[Impact] Successful exploitation allows an attacker to execute arbitrary code with the privileges of the active user by tricking them into opening a specially crafted file

[Mitigation] Apply the official Microsoft Cumulative Updates immediately and restrict execution of untrusted files

[Affected Scope] Apache Log4j versions 2.0-beta9 to 2.15.0 (including 2.15.0 for Java 8 and 2.12.1 or below for Java 7)

[Impact] Attackers can exploit JNDI Lookup patterns via Thread Context Map (MDC) inputs in non-default configurations to achieve remote code execution (RCE) or information leakage

[Mitigation] Immediately upgrade Apache Log4j to version 2.16.0 (for Java 8+) or 2.12.2 (for Java 7+), which disables JNDI by default and removes message lookup support

[Affected Scope] Java applications utilizing Apache Log4j2 (log4j-core) versions 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1)

[Impact] Unauthenticated remote attackers can execute arbitrary code by forcing the application to load malicious Java classes from attacker-controlled LDAP or other JNDI-related endpoints, leading to full system compromise (CVSS 10.0 Critical)

[Mitigation] Immediately upgrade Log4j2 to the latest secure version (2.17.1 or higher; or 2.12.4 / 2.3.2 depending on Java version), or apply workarounds such as removing the JndiLookup class

[Affected Scope] Ivanti Endpoint Manager Cloud Services Appliance (CSA) versions 4.5 and 4.6

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with limited privileges ('nobody') by sending specially crafted HTTP requests.

[Mitigation] Immediately apply the official security patches provided by Ivanti and restrict access to the CSA management interface from the public internet.

[Affected Scope] SonicWall SMA 200, 210, 400, 410, and 500v appliances running firmware versions 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv, and earlier

[Impact] A remote unauthenticated attacker can execute arbitrary code with 'nobody' user privileges on the appliance by sending a specially crafted HTTP request, potentially leading to full system compromise

[Mitigation] Immediately upgrade the appliance firmware to the patched version (10.2.1.3-27sv or higher) and restrict external access to the management interface

[Affected Scope] All versions of the ajaxpro.2 (Ajax.NET Professional) package

[Impact] Unauthenticated remote attackers can exploit the deserialization of untrusted data to instantiate arbitrary .NET classes, leading to Remote Code Execution (RCE)

[Mitigation] Apply the official security patch from the upstream repository, restrict unused AjaxPro handlers, or deploy WAF rules

[Affected Scope] Zoho ManageEngine ServiceDesk Plus (before 11306), ServiceDesk Plus MSP (before 10530), and SupportCenter Plus (before 11014).

[Impact] Unauthenticated remote attackers can bypass authentication to upload and execute malicious files, gaining full system-level control over the target server.

[Mitigation] Immediately apply the official vendor patches, restrict external access to vulnerable endpoints, and perform a comprehensive log audit for Indicators of Compromise (IoCs).

[Affected Scope] On-premises Microsoft Exchange Server 2016 and 2019

[Impact] Authenticated attackers can execute arbitrary code with SYSTEM privileges, leading to full server compromise

[Mitigation] Immediately apply the official Microsoft Cumulative Update (CU) and Security Update (KB5007409)

[Affected Scope] Sitecore Experience Platform (XP) 7.5 Initial Release to Sitecore XP 8.2 Update-7.

[Impact] Unauthenticated remote attackers can execute arbitrary commands with system privileges on the hosting server by sending specially crafted serialized payloads.

[Mitigation] Apply official security patches immediately or restrict external access to the vulnerable '/sitecore/shell/ClientBin/Reporting/ReportService.asmx' endpoint.

[Affected Scope] Google Chrome prior to version 94.0.4606.71

[Impact] A remote attacker can exploit a heap corruption vulnerability via a crafted HTML page, potentially leading to arbitrary remote code execution (RCE) within the browser renderer process.

[Mitigation] Immediately update Google Chrome to the latest stable version (94.0.4606.71 or higher).