CVE Vulnerability Advisory Database

[Affected Scope] Apache HTTP Server versions 2.4.49 and 2.4.50

[Impact] Unauthenticated remote attackers can exploit this vulnerability to access sensitive files outside the document root or execute arbitrary commands if CGI scripts are enabled

[Mitigation] Immediately upgrade Apache HTTP Server to version 2.4.51 or later, and enforce strict directory access controls

[Affected Scope] Citrix ShareFile Storage Zones Controller versions prior to 5.11.20

[Impact] Unauthenticated remote attackers can bypass access controls to compromise the storage zones controller, potentially leading to arbitrary code execution and data exfiltration

[Mitigation] Immediately upgrade to Citrix ShareFile Storage Zones Controller 5.11.20 or later, and restrict external access to administrative endpoints

[Affected Scope] VMware vCenter Server versions 6.7 and 7.0 running the Analytics (CEIP) service

[Impact] Unauthenticated attackers with network access to port 443/TCP can upload arbitrary files and execute remote code with system privileges

[Mitigation] Apply official vendor patches immediately, or implement the temporary workaround to disable the vulnerable Analytics endpoint

[Affected Scope] Web server software embedded in various Hikvision IP cameras and Network Video Recorders (NVRs)

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending specially crafted HTTP requests, leading to full device compromise

[Mitigation] Immediately upgrade to the latest patched firmware version provided by the vendor and restrict direct internet access to the devices

[Affected Scope] Certain Dahua IP cameras, NVRs, DVRs, and associated firmware versions

[Impact] Attackers can completely bypass the identity authentication process during login and gain full administrative control of the device

[Mitigation] Immediately apply the latest firmware updates provided by the vendor and restrict external network access to the devices

[Affected Scope] Systems running Microsoft Windows OS utilizing the MSHTML (Internet Explorer) rendering engine and Microsoft Office suites

[Impact] Successful exploitation allows remote attackers to execute arbitrary code (RCE) with the privileges of the active user by tricking them into opening a specially crafted Office document

[Mitigation] Apply the official Microsoft security updates immediately, or implement registry workarounds to disable ActiveX controls as a temporary mitigation

[Affected Scope] Open Management Infrastructure (OMI) versions prior to 1.6.8-1, commonly deployed automatically on Microsoft Azure Linux Virtual Machines

[Impact] Unauthenticated remote attackers can execute arbitrary commands with root privileges on the target system by sending a specially crafted HTTP/S request

[Mitigation] Immediately upgrade the OMI package to version 1.6.8-1 or higher, and restrict network access to OMI ports (5985, 5986) using firewalls

[Affected Scope] Microsoft Office, Microsoft 365 Apps, and Access Database Engine Redistributable packages

[Impact] Successful exploitation allows an attacker to execute arbitrary remote code (RCE) with the privileges of the active user by tricking them into opening a crafted database file

[Mitigation] Apply the official Microsoft security updates immediately and restrict execution of untrusted database files

[Affected Scope] SAP NetWeaver (Visual Composer 7.0 RT) versions 7.30, 7.31, 7.40, and 7.50

[Impact] An authenticated non-administrative attacker can upload malicious files and execute arbitrary OS commands with the privileges of the Java Server process, leading to full system compromise or denial of service

[Mitigation] Immediately apply the official patch specified in SAP Security Note 3084487 and restrict access to vulnerable upload endpoints

[Affected Scope] Aviatrix Controller 6.x versions prior to 6.5-1804.1922

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by exploiting directory traversal and unrestricted file upload vulnerabilities

[Mitigation] Immediately upgrade Aviatrix Controller to version 6.5-1804.1922 or later, and restrict external access to the management interface

[Affected Scope] Apple WebKit engine in versions prior to iOS 14.5.1, iPadOS 14.5.1, macOS Big Sur 11.3.1, watchOS 7.4.1, and tvOS 14.6

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution, with active exploitation reported in the wild

[Mitigation] Immediately update Apple operating systems to the latest patched versions (iOS 14.5.1, macOS 11.3.1, or later) using official software update channels

[Affected Scope] Apple devices running versions prior to iOS 14.5, iPadOS 14.5, macOS Big Sur 11.3, tvOS 14.6, and Safari 14.1.1

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution (RCE) on the target device

[Mitigation] Immediately apply the official software updates provided by Apple (iOS 14.5.1, macOS 11.3.1, or later)

[Affected Scope] Systems running Safari prior to 14.1, iOS prior to 12.5.3, iOS/iPadOS prior to 14.5, watchOS prior to 7.4, tvOS prior to 14.5, and macOS Big Sur prior to 11.3

[Impact] Processing maliciously crafted web content may trigger a Use-After-Free vulnerability in the WebKit rendering engine, allowing remote attackers to execute arbitrary code on the target device. Active exploitation in the wild has been reported

[Mitigation] Immediately apply the official security updates provided by Apple to upgrade to patched versions

[Affected Scope] Zoho ManageEngine ADSelfService Plus version 6113 and prior

[Impact] Unauthenticated remote attackers can bypass REST API authentication and execute arbitrary code with SYSTEM privileges

[Mitigation] Immediately upgrade to build 6114 or later and inspect systems for Indicators of Compromise (IoCs)

[Affected Scope] Atlassian Confluence Server and Data Center versions prior to 6.13.23, 6.14.0 to < 7.4.11, 7.5.0 to < 7.11.6, and 7.12.0 to < 7.12.5

[Impact] An unauthenticated, remote attacker can execute arbitrary OS commands with system privileges on the target instance by sending a specially crafted HTTP request.

[Mitigation] Immediately upgrade Confluence instances to the patched versions (6.13.23, 7.4.11, 7.11.6, 7.12.5, or later) or apply the vendor-provided workaround scripts.

[Affected Scope] Apple WebKit-based browsers and applications running on iOS versions prior to 14.8, iPadOS versions prior to 14.8, and macOS Big Sur versions prior to 11.6

[Impact] Processing maliciously crafted web content may allow remote attackers to trigger a Use-After-Free condition, leading to arbitrary code execution (RCE) on the target system

[Mitigation] Immediately apply the official Apple software updates to upgrade to iOS/iPadOS 14.8, macOS Big Sur 11.6, or later

[Affected Scope] Java applications utilizing XStream library versions prior to 1.4.18, and third-party solutions like VMware NSX Manager embedding this library

[Impact] Unauthenticated remote attackers can execute arbitrary system commands on the host by manipulating the processed XML input stream

[Mitigation] Upgrade XStream to version 1.4.18 or higher, and configure XStream's security framework with a strict whitelist

[Affected Scope] IoT and network devices utilizing Realtek Jungle SDK versions v2.x through v3.4.14B

[Impact] Unauthenticated remote attackers can exploit stack buffer overflows and command injection flaws to execute arbitrary code with root privileges, leading to full device compromise

[Mitigation] Apply the latest firmware updates from the respective device manufacturers and restrict external access to the web management interface

[Affected Scope] Embedded IoT devices utilizing Realtek Jungle SDK versions v2.x through v3.4.14B containing the 'MP Daemon' (UDPServer) diagnostic tool

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges or trigger memory corruption on the target device

[Mitigation] Apply the official vendor firmware patch, disable the UDPServer service, or restrict external access to the diagnostic UDP ports using firewall rules

[Affected Scope] Sunhillo SureLine versions prior to 8.7.0.1.1

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands on the target system using shell metacharacters

[Mitigation] Immediately upgrade Sunhillo SureLine to version 8.7.0.1.1 or later, and restrict external network access