CVE Vulnerability Advisory Database

[Affected Scope] All Linux kernel-based systems utilizing HID (Human Interface Device) drivers

[Impact] Local attackers can exploit uninitialized memory buffers to leak sensitive kernel memory contents via specially-crafted HID reports

[Mitigation] Apply the latest stable kernel updates provided by your Linux distribution and reboot the system

[Affected Scope] Oracle Supply Chain - Oracle Agile PLM Framework version 9.3.6 (Software Development Kit, Process Extension component)

[Impact] Unauthenticated remote attackers can exploit this vulnerability via HTTP to gain unauthorized access to critical data or complete access to all accessible data within the framework

[Mitigation] Immediately apply the official security patches provided by Oracle and restrict external HTTP/HTTPS access to the affected system

[Affected Scope] Authenticated administrators with access to the PAN-OS management web interface

[Impact] Complete system compromise via arbitrary OS command execution with root privileges on the firewall

[Mitigation] Apply official security patches immediately and restrict access to the management interface from the public internet

[Affected Scope] Palo Alto Networks firewall appliances running PAN-OS 10.2, 11.0, 11.1, and 11.2 with the management web interface exposed to the network.

[Impact] Unauthenticated remote attackers can bypass authentication to gain administrative privileges, modify configurations, or chain with other privilege escalation flaws like CVE-2024-9474 to compromise the system.

[Mitigation] Immediately upgrade to the patched PAN-OS versions and restrict management interface access to trusted internal IP addresses only.

[Affected Scope] MDaemon Email Server versions prior to 24.5.1c with Webmail enabled

[Impact] Remote attackers can execute arbitrary JavaScript code in the context of a victim's browser session by sending a specially crafted HTML email, potentially leading to session hijacking and credential theft

[Mitigation] Immediately upgrade MDaemon Email Server to version 24.5.1c or later to resolve the sanitization flaw

[Affected Scope] Certain End-of-Life (EOL) GeoVision IP cameras, video servers, and LPR systems

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges, leading to complete device takeover and botnet recruitment

[Mitigation] Since these devices are EOL and no patches will be released, immediately isolate the affected devices from the internet or replace them with supported models

[Affected Scope] Mobile devices running Android OS utilizing the ExternalStorageProvider component

[Impact] Local attackers can bypass file path filters to access sensitive system directories, leading to local privilege escalation without requiring elevated execution privileges

[Mitigation] Apply the Google Android March 2025 security patch and upgrade device firmware to the latest version

[Affected Scope] Citrix Session Recording servers accessible to authenticated users on the same intranet

[Impact] Limited remote code execution (RCE) under the context of the NetworkService account, potentially leading to lateral movement

[Mitigation] Apply official Citrix security patches immediately and restrict network access to the Session Recording infrastructure

[Affected Scope] Authenticated users within the same Windows Active Directory domain as the Citrix Session Recording server

[Impact] Privilege escalation to 'NetworkService' account, enabling unauthorized system control and potential lateral movement within the AD domain

[Mitigation] Immediately upgrade Citrix Session Recording components to the latest patched versions recommended by the vendor

[Affected Scope] All supported versions of Windows 10, Windows 11, and Windows Server

[Impact] A local attacker with low privileges can bypass security boundaries via RPC interfaces to execute arbitrary code with SYSTEM privileges

[Mitigation] Immediately apply the Microsoft November 2024 Security Update and restrict local user privileges

[Affected Scope] All supported versions of Microsoft Windows and Windows Server operating systems

[Impact] Simple user interaction with a malicious file (such as right-clicking or selecting) triggers NTLM credential disclosure, enabling credential theft and NTLM Relay attacks

[Mitigation] Immediately apply the Microsoft November 2024 cumulative security updates and restrict outbound NTLM traffic via Group Policy and firewalls

[Affected Scope] CyberPanel versions through 2.3.6 and unpatched 2.3.7

[Impact] Remote attackers can bypass authentication and execute arbitrary system commands with root privileges

[Mitigation] Immediately upgrade CyberPanel to the latest secure commit (5b08cd6 or later) and restrict access to the management port

[Affected Scope] CyberPanel versions through 2.3.6 and unpatched 2.3.7

[Impact] Remote attackers can bypass authentication and execute arbitrary system commands with root privileges via shell metacharacters

[Mitigation] Immediately upgrade CyberPanel to the latest commit (1c0c6cb or later) and restrict access to the management port

[Affected Scope] Cleo Harmony, VLTrader, and LexiCom versions prior to 5.8.0.21

[Impact] Unauthenticated remote attackers can upload and download arbitrary files, potentially leading to full Remote Code Execution (RCE) on the target server

[Mitigation] Immediately upgrade to version 5.8.0.21 or later, and restrict external access to the file transfer interfaces

[Affected Scope] Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software with Remote Access VPN (RAVPN) service enabled

[Impact] Unauthenticated, remote attackers can exhaust system resources by flooding VPN authentication requests, leading to a Denial of Service (DoS) of the RAVPN service and potentially requiring a device reload

[Mitigation] Apply official Cisco security patches immediately, configure connection rate limiting, and block malicious brute-force IP addresses

[Affected Scope] Multiple versions of FortiManager and FortiManager Cloud (7.6.0, 7.4.0-7.4.4, 7.2.0-7.2.7, 7.0.0-7.0.12, 6.4.0-6.4.14, 6.2.0-6.2.12, etc.)

[Impact] An unauthenticated remote attacker can execute arbitrary code or system commands via specially crafted requests, potentially leading to full system compromise

[Mitigation] Immediately upgrade to the official patched versions or apply workarounds to restrict unauthorized FGFM connections

[Affected Scope] NuPoint Unified Messaging (NPM) component within Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201)

[Impact] Unauthenticated remote attackers can exploit insufficient input validation to perform path traversal, allowing unauthorized access to view, corrupt, or delete user data and system configurations

[Mitigation] Immediately upgrade to the latest patched version provided by the vendor, and restrict external access to management interfaces

[Affected Scope] ScienceLogic SL1 (formerly EM7) versions prior to 12.1.3, 12.2.3, and 12.3, including older lines 10.1.x, 10.2.x, 11.1.x, 11.2.x, and 11.3.x

[Impact] Unauthenticated remote attackers can exploit an unspecified third-party component packaged with SL1 to execute arbitrary commands and gain full system control

[Mitigation] Immediately upgrade to patched SL1 versions (12.1.3+, 12.2.3+, 12.3+) or apply the corresponding hotfixes for your specific version line

[Affected Scope] All vulnerable versions of Palo Alto Networks Expedition migration tool

[Impact] Unauthenticated remote attackers can extract database contents (password hashes, API keys) and read/write arbitrary files, leading to full system compromise

[Mitigation] Immediately upgrade Expedition to the latest patched version and restrict network access to trusted administrative hosts

[Affected Scope] Palo Alto Networks Expedition migration tool versions prior to 1.2.96

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands as root, leading to the exposure of PAN-OS firewall usernames, cleartext passwords, device configurations, and API keys

[Mitigation] Immediately upgrade Expedition to version 1.2.96 or later, and rotate all potentially exposed firewall credentials and API keys