CVE Vulnerability Advisory Database

[Affected Scope] SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC)

[Impact] A remote unauthenticated attacker can exploit a deserialization of untrusted data vulnerability to execute arbitrary OS commands on the target system

[Mitigation] Immediately apply the official security patches provided by SonicWall and restrict external access to the management consoles

[Affected Scope] Craft CMS 4.x (prior to 4.13.8) and 5.x (prior to 5.5.8) installations where the security key has been compromised

[Impact] Attackers can leverage the compromised security key to forge serialized payloads, leading to arbitrary Remote Code Execution (RCE) on the host server

[Mitigation] Immediately upgrade Craft CMS to version 4.13.8 or 5.5.8 (or higher) and rotate the CRAFT_SECURITY_KEY

[Affected Scope] Citrix Session Recording servers accessible to authenticated users on the same intranet

[Impact] Limited remote code execution (RCE) under the context of the NetworkService account, potentially leading to lateral movement

[Mitigation] Apply official Citrix security patches immediately and restrict network access to the Session Recording infrastructure

[Affected Scope] SolarWinds Web Help Desk (WHD) 12.8.3 and all prior versions

[Impact] Successful exploitation allows remote attackers to execute arbitrary commands on the host machine via unsafe Java deserialization, potentially leading to full system compromise

[Mitigation] Immediately apply the official SolarWinds Web Help Desk 12.8.3 Hotfix 1 or upgrade to the latest patched version

[Affected Scope] Microsoft SharePoint Server 2016, 2019, and Subscription Edition

[Impact] An authorized attacker with Site Owner permissions can execute arbitrary code within the server context via specially crafted API requests, leading to full system compromise

[Mitigation] Apply the official Microsoft Cumulative Update (CU) patches immediately, restrict administrative privileges, and audit system logs for indicators of compromise

[Affected Scope] Apache ActiveMQ brokers and client libraries utilizing the OpenWire protocol

[Impact] Unauthenticated remote attackers can execute arbitrary shell commands on the target system by manipulating serialized class types

[Mitigation] Immediately upgrade both brokers and clients to patched versions (5.15.16, 5.16.7, 5.17.6, or 5.18.3 and above)

[Affected Scope] NextGen Healthcare Mirth Connect versions prior to 4.4.1

[Impact] Unauthenticated remote attackers can bypass authentication to execute arbitrary OS commands with system privileges, leading to full host compromise

[Mitigation] Immediately upgrade Mirth Connect to version 4.4.1 or later, and restrict access to administrative ports

[Affected Scope] Progress WS_FTP Server versions prior to 8.7.4 and 8.8.2 with Ad Hoc Transfer module enabled

[Impact] A pre-authenticated remote attacker can execute arbitrary OS commands with IIS worker process privileges by sending a crafted .NET serialized payload

[Mitigation] Immediately upgrade to patched versions (8.7.4, 8.8.2, or higher) or disable/remove the Ad Hoc Transfer module

[Affected Scope] Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier), and 2023u1 (and earlier)

[Impact] Unauthenticated remote attackers can exploit a Deserialization of Untrusted Data vulnerability (CWE-502) to execute arbitrary code with system privileges

[Mitigation] Immediately apply the official Adobe security patches (APSB23-41), restrict external access, and enable WAF rules

[Affected Scope] Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier), and 2023.0.0.330468 (and earlier)

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending malicious serialized data

[Mitigation] Immediately apply the official Adobe security patch (APSB23-40) and restrict external access to serialization endpoints

[Affected Scope] Microsoft SharePoint Server 2016, 2019, and Subscription Edition

[Impact] An authenticated attacker with high privileges (Site Owner/Administrator) can execute arbitrary code in the context of the server, leading to complete system compromise

[Mitigation] Apply the official Microsoft security patches immediately and restrict access to the SharePoint administration interface from untrusted networks

[Affected Scope] All on-premises and cloud web application servers running Novi Survey versions prior to 8.9.43676.

[Impact] Unauthenticated remote attackers can execute arbitrary system commands and malicious code under the security context of the web service account.

[Mitigation] Immediately upgrade to the official patched version (8.9.43676 or higher) and restrict external access to the application.

[Affected Scope] Adobe ColdFusion 2018 Update 15 (and earlier) and ColdFusion 2021 Update 5 (and earlier).

[Impact] Successful exploitation allows unauthenticated remote attackers to execute arbitrary code in the context of the current user without any user interaction.

[Mitigation] Immediately apply the official Adobe security patches to upgrade to ColdFusion 2018 Update 16, ColdFusion 2021 Update 6, or later.

[Affected Scope] Microsoft Exchange Server 2013, 2016, and 2019

[Impact] An authenticated attacker can execute arbitrary commands with SYSTEM privileges and fully compromise the server by sending specially crafted serialized data

[Mitigation] Immediately apply the latest Cumulative Updates (CU) and Security Updates (SU) provided by Microsoft

[Affected Scope] Fortra (formerly HelpSystems) GoAnywhere MFT versions prior to 7.1.2

[Impact] An unauthenticated remote attacker can execute arbitrary system commands on the target server by sending a malicious serialized object to the License Response Servlet.

[Mitigation] Immediately upgrade GoAnywhere MFT to version 7.1.2 or higher, and restrict external access to the administrator console port (9006).

[Affected Scope] On-premises Microsoft Exchange Server 2013, 2016, and 2019 versions lacking the latest cumulative and security updates

[Impact] Authenticated remote attackers can exploit untrusted deserialization in the Exchange PowerShell backend to execute arbitrary commands with SYSTEM privileges

[Mitigation] Apply official Microsoft security updates immediately, or implement IIS URL Rewrite rules and restrict Remote PowerShell access as temporary workarounds

[Affected Scope] Zoho ManageEngine Password Manager Pro before 12101, PAM360 before 5510, and Access Manager Plus before 4303

[Impact] Unauthenticated (or authenticated for Access Manager Plus) attackers can execute arbitrary code with system privileges by sending malicious XML-RPC requests

[Mitigation] Immediately upgrade to the patched versions (Password Manager Pro 12101, PAM360 5510, Access Manager Plus 4303 or higher)

[Affected Scope] Oracle Fusion Middleware - Oracle Application Development Framework (ADF) versions 12.2.1.3.0 and 12.2.1.4.0

[Impact] Unauthenticated remote attackers can execute arbitrary code and completely compromise the host system via HTTP network access

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately or restrict external access to vulnerable ADF endpoints

[Affected Scope] All versions of the ajaxpro.2 (Ajax.NET Professional) package

[Impact] Unauthenticated remote attackers can exploit the deserialization of untrusted data to instantiate arbitrary .NET classes, leading to Remote Code Execution (RCE)

[Mitigation] Apply the official security patch from the upstream repository, restrict unused AjaxPro handlers, or deploy WAF rules

[Affected Scope] On-premises Microsoft Exchange Server 2016 and 2019

[Impact] Authenticated attackers can execute arbitrary code with SYSTEM privileges, leading to full server compromise

[Mitigation] Immediately apply the official Microsoft Cumulative Update (CU) and Security Update (KB5007409)