CVE Vulnerability Advisory Database

[Affected Scope] Yii 2 framework versions prior to 2.0.52

[Impact] Remote attackers can execute arbitrary PHP code on the server and fully compromise the system via specially crafted requests.

[Mitigation] Immediately upgrade the Yii2 framework to the patched version 2.0.52 or higher.

[Affected Scope] Windows 10, Windows 11, and Windows Server operating systems utilizing the Common Log File System (CLFS.sys) driver.

[Impact] An authorized local attacker can execute arbitrary code in kernel mode and elevate privileges to NT AUTHORITY\SYSTEM.

[Mitigation] Immediately apply the latest cumulative security updates released by Microsoft (March 2025 Patch Tuesday or later).

[Affected Scope] Langflow versions prior to 1.3.0

[Impact] A remote, unauthenticated attacker can execute arbitrary Python code and fully compromise the host system by sending crafted HTTP requests.

[Mitigation] Immediately upgrade Langflow to version 1.3.0 or later, and restrict external access to the vulnerable endpoint.

[Affected Scope] CrushFTP 10 before 10.8.4 and CrushFTP 11 before 11.3.1

[Impact] Unauthenticated attackers can bypass authentication via HTTP(S) ports to take over the 'crushadmin' account and fully compromise the system

[Mitigation] Immediately upgrade CrushFTP to version 10.8.4 / 11.3.1 or later, and enforce DMZ proxy configurations

[Affected Scope] Gladinet CentreStack versions through 16.1.10296.56315

[Impact] Unauthenticated remote code execution (RCE) via deserialization of malicious payloads using the hardcoded machineKey, actively exploited in the wild

[Mitigation] Immediately upgrade to version 16.4.10315.56368 or later, or manually delete/rotate the hardcoded machineKey in the portal web.config file

[Affected Scope] Ivanti Connect Secure (before 22.7R2.6), Policy Secure (before 22.7R1.4), and ZTA Gateways (before 22.8R2.2)

[Impact] Unauthenticated remote attackers can trigger a stack-based buffer overflow to execute arbitrary code with root privileges on the target gateway

[Mitigation] Immediately apply the official security patches provided by the vendor and restrict access to external-facing management interfaces

[Affected Scope] Projects running Vite development server exposed to the network (via --host or server.host configuration) using versions prior to 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11

[Impact] Remote attackers can bypass access restrictions and retrieve sensitive source code or system files by appending crafted query parameters (?inline&import or ?raw?import) to requests

[Mitigation] Immediately upgrade Vite to the patched versions (6.2.4, 6.1.3, 6.0.13, 5.4.16, or 4.5.11) and disable unnecessary external host binding (--host)

[Affected Scope] Google Chrome on Windows prior to version 134.0.6998.177

[Impact] A remote attacker can exploit incorrect handle validation in the Mojo IPC framework via a malicious file to escape the browser sandbox and execute arbitrary code with elevated privileges

[Mitigation] Immediately update Google Chrome to the latest stable channel (134.0.6998.177 or higher) and enforce auto-updates via Group Policy (GPO)

[Affected Scope] D-Link DIR-823X router firmware versions 240126 and 240802.

[Impact] An authorized attacker can execute arbitrary system commands with root privileges and fully compromise the device by sending a crafted HTTP POST request to the /goform/set_prohibiting endpoint.

[Mitigation] Apply the official firmware patch immediately, disable remote WAN management, and enforce strong administrator credentials.

[Affected Scope] Kentico Xperience through version 13.0.178

[Impact] Authenticated attackers can exploit the Staging Sync Server to upload arbitrary files to relative paths, leading to server-side execution and full Remote Code Execution (RCE)

[Mitigation] Apply the official Kentico hotfix immediately and restrict access to the Staging Sync Server endpoints

[Affected Scope] Kentico Xperience through version 13.0.178 with Staging Sync Server enabled

[Impact] Unauthenticated attackers can bypass authentication to control administrative objects, leading to full Remote Code Execution (RCE)

[Mitigation] Apply the official Kentico hotfix immediately and restrict external access to the Staging Sync Server endpoint

[Affected Scope] Kentico Xperience versions up to and including 13.0.172

[Impact] Attackers can bypass authentication to gain administrative control, potentially leading to full system compromise and Remote Code Execution (RCE)

[Mitigation] Apply the official hotfix immediately, or restrict access to the Staging Sync Server endpoint via IP whitelisting

[Affected Scope] Workflows executing reviewdog/action-setup@v1 and dependent actions between March 11, 2025, 18:42 and 20:31 UTC

[Impact] Malicious code injected into the action dumps exposed secrets to GitHub Actions Workflow Logs, leading to potential credential theft

[Mitigation] Immediately revoke and rotate all secrets exposed during the compromised window, and pin actions to secure commit SHA hashes

[Affected Scope] GitHub Actions workflows utilizing tj-actions/changed-files action versions v1 through v45.0.7

[Impact] Threat actors modified release tags to point to a malicious commit (0e58ed8), enabling execution of malicious code ('updateFeatures') and exfiltration of GitHub Secrets via action logs

[Mitigation] Immediately cease using the affected tags and upgrade to v46 or later, or pin the action to a trusted commit SHA

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 9.0, 10.0, and 10.1 utilizing the Classic Web Client

[Impact] Viewing an email containing a malicious ICS calendar file triggers arbitrary JavaScript execution within the victim's session, enabling unauthorized email redirection and data exfiltration

[Mitigation] Apply official Zimbra security patches (9.0.0 Patch 44, 10.0.13, 10.1.5 or later) immediately, and restrict the use of the Classic Web Client until patched

[Affected Scope] Junos OS versions prior to 21.2R3-S9, 21.4R3-S10, 22.2R3-S6, 22.4R3-S6, 23.2R2-S3, 23.4R2-S4, and 24.2R1-S2/24.2R2

[Impact] A highly privileged local attacker with shell access can inject arbitrary code to compromise the integrity of the device

[Mitigation] Immediately upgrade to the recommended patched Junos OS releases and restrict local shell access to authorized administrators only

[Affected Scope] Devices running iOS 15/16/17/18, iPadOS, macOS Sequoia, visionOS, watchOS, and Safari browser

[Impact] Processing maliciously crafted web content may allow an attacker to break out of the Web Content sandbox and execute arbitrary code, with active exploitation reported in targeted attacks

[Mitigation] Immediately apply the official security updates released by Apple, including iOS 18.3.2 and macOS 15.3.2

[Affected Scope] Microsoft Management Console (MMC) component across various supported Microsoft Windows operating systems

[Impact] Local attackers can bypass critical security boundaries and Mark-of-the-Web (MotW) protections via user interaction, potentially leading to privilege escalation and arbitrary code execution

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and restrict the execution of untrusted .msc files using AppLocker or WDAC

[Affected Scope] Systems running Windows Operating Systems utilizing the NTFS file system driver (ntfs.sys)

[Impact] A local authorized attacker can exploit this vulnerability to trigger a heap-based buffer overflow, leading to local privilege escalation (LPE) and arbitrary code execution with SYSTEM privileges

[Mitigation] Immediately apply the latest Microsoft cumulative security updates and restrict the mounting of untrusted external storage media and disk images

[Affected Scope] Windows 10, Windows 11, and Windows Server families utilizing the NTFS file system driver

[Impact] Local authorized attackers can disclose sensitive kernel memory information, potentially facilitating subsequent privilege escalation (EoP) attacks

[Mitigation] Immediately apply the February 2025 Microsoft Patch Tuesday security updates and restrict local access for unauthorized users