CVE Vulnerability Advisory Database

[Affected Scope] Systems running Microsoft .NET Framework versions 2.0, 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8, and Microsoft SharePoint Server.

[Impact] An unauthenticated remote attacker can execute arbitrary code with system privileges by sending a specially crafted XOML (XML Process Markup Language) file to the target server.

[Mitigation] Immediately apply the official Microsoft security patches and restrict untrusted XOML workflow compilation within your SharePoint environment.

[Affected Scope] D-Link DIR-859 Wi-Fi router firmware versions 1.05 and 1.06B01 Beta01

[Impact] An unauthenticated remote attacker on the local network can execute arbitrary system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service

[Mitigation] Apply the official firmware security patches, disable the UPnP service, and restrict access to the router management interface

[Affected Scope] All Node.js database management environments running mongo-express versions prior to 0.54.0

[Impact] Authenticated attackers can bypass the sandbox and execute arbitrary system commands on the host OS via endpoints utilizing the toBSON method

[Mitigation] Immediately upgrade the mongo-express package to version 0.54.0 or higher, restrict external access, and enforce strong authentication

[Affected Scope] Progress Telerik UI for ASP.NET AJAX versions through 2019.3.1023 (and certain configurations prior to 2020.1.114)

[Impact] If encryption keys are compromised or known, attackers can exploit the RadAsyncUpload function to deserialize malicious .NET objects, resulting in unauthorized Remote Code Execution (RCE) on the target web server.

[Mitigation] Upgrade Telerik UI to version 2020.1.114 or later, or immediately modify web.config to disable RadAsyncUpload or rotate the encryption keys.

[Affected Scope] OpenSLP service running on VMware ESXi and Horizon DaaS appliances.

[Impact] Unauthenticated remote attackers can execute arbitrary code or fully compromise the host by sending malicious SLP messages over the network.

[Mitigation] Apply official VMware security patches immediately, or disable the SLP service and block port 427 (TCP/UDP) as a temporary workaround.

[Affected Scope] QNAP Photo Station versions and associated QTS operating system environments

[Impact] Unauthenticated remote attackers can access or modify critical system files, potentially leading to full Remote Code Execution (RCE)

[Mitigation] Immediately update QNAP Photo Station to the latest secure version and restrict external access

[Affected Scope] QNAP QTS operating system and Photo Station application

[Impact] Unauthenticated remote attackers can inject arbitrary system commands via crafted HTTP requests, leading to complete system compromise

[Mitigation] Immediately update QTS and Photo Station to the latest patched versions recommended by QNAP

[Affected Scope] Google Chrome prior to version 73.0.3683.86

[Impact] A remote attacker can exploit heap corruption via a crafted HTML page, potentially leading to arbitrary code execution within the browser renderer process

[Mitigation] Immediately update Google Chrome to the latest stable version (73.0.3683.86 or higher)

[Affected Scope] PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24, and 7.3.x below 7.3.11 running in certain Nginx + PHP-FPM configurations

[Impact] Unauthenticated remote attackers can trigger an out-of-bounds memory write in the PHP-FPM process, leading to arbitrary remote code execution (RCE) on the target web server

[Mitigation] Immediately upgrade PHP to patched versions (7.1.33, 7.2.24, 7.3.11 or higher) and configure Nginx with 'try_files' to verify file existence before passing requests to FastCGI

[Affected Scope] Exim mail server versions 4.92 through 4.92.2

[Impact] Unauthenticated remote attackers can trigger a heap-based buffer overflow by sending a crafted, long EHLO command, leading to arbitrary code execution or complete denial of service (DoS)

[Mitigation] Immediately upgrade Exim to the latest stable version (4.92.3 or higher) and restrict SMTP command lengths as a temporary workaround

[Affected Scope] D-Link router and AP models including DIR-655C, DIR-866L, DIR-652, DHP-1565, DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands and achieve full system compromise by sending specially crafted HTTP requests.

[Mitigation] Since most affected devices are End-of-Life (EoL), immediately replace them with supported models, or restrict WAN-side management access and disable remote administration.

[Affected Scope] vBulletin versions 5.0.0 through 5.5.4.

[Impact] Unauthenticated remote attackers can execute arbitrary PHP code and system commands on the host server, leading to complete system compromise.

[Mitigation] Apply official security patches immediately, upgrade to vBulletin 5.5.5 or later, and configure Web Application Firewall (WAF) rules to block malicious routing requests.

[Affected Scope] D-Link ShareCenter DNS-320 NAS devices running firmware versions up to and including 2.05.B10

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending specially crafted HTTP requests.

[Mitigation] Immediately restrict external internet access to the device and replace the legacy/EoL hardware with a supported model.

[Affected Scope] Webmin versions 1.920 and prior (with password change feature enabled)

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges by sending a specially crafted HTTP POST request.

[Mitigation] Immediately upgrade Webmin to the latest secure version (1.930 or higher) or disable the password_change.cgi script.

[Affected Scope] SAP Commerce Cloud (formerly Hybris) versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, and 1905 with the virtualjdbc extension enabled

[Impact] Unauthenticated remote attackers can exploit insecure deserialization to execute arbitrary system commands with 'Hybris' user privileges on the target host

[Mitigation] Apply the official SAP security patch (SAP Note 2786035), disable the unused virtualjdbc extension, or restrict external access to the endpoint

[Affected Scope] Jira Server and Data Center versions from 4.4.0 before 7.6.14, 7.7.0 before 7.13.5, 8.0.0 before 8.0.3, 8.1.0 before 8.1.2, and 8.2.0 before 8.2.3

[Impact] Unauthenticated remote attackers can exploit the email template rendering logic to execute arbitrary system commands, leading to full system compromise

[Mitigation] Immediately upgrade Jira Server and Data Center to the patched versions (7.6.14, 7.13.5, 8.0.3, 8.1.2, 8.2.3 or later)

[Affected Scope] Apache Solr versions prior to 8.2.0 with the DataImportHandler (DIH) module enabled

[Impact] An authenticated attacker (or an attacker with admin access) can execute arbitrary system commands on the host server by sending a malicious DIH configuration

[Mitigation] Upgrade Apache Solr to version 8.2.0 or higher, or explicitly disable the 'enable.dih.dataConfigParam' Java system property

[Affected Scope] PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or Gateway enabled.

[Impact] An unauthenticated remote attacker can execute arbitrary code with root privileges on the target firewall, leading to complete system compromise.

[Mitigation] Immediately upgrade PAN-OS to patched versions (7.1.19, 8.0.12, 8.1.3, or later) and restrict access to GlobalProtect interfaces.

[Affected Scope] Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8

[Impact] Authenticated attackers can exploit improper input validation (CWE-78) to execute arbitrary system commands with elevated privileges, leading to complete compromise of the appliance

[Mitigation] Immediately upgrade to the official patched versions (10.2.3, 10.0.8, or higher) provided by the vendor

[Affected Scope] Microsoft SQL Server 2014, 2016, and 2017

[Impact] An authenticated attacker can execute arbitrary code under the security context of the SQL Server Database Engine service account, potentially leading to full system compromise

[Mitigation] Immediately apply the latest Cumulative Updates (CU) or Service Pack (SP) security patches provided by Microsoft