CVE Vulnerability Advisory Database

[Affected Scope] DotNetNuke (DNN) Platform versions 9.2 through 9.2.2.

[Impact] Attackers can bypass security controls due to weak encryption of input parameters, leading to .NET deserialization and Remote Code Execution (RCE) via malicious cookies.

[Mitigation] Immediately upgrade the DNN Platform to version 9.3.0 or higher, and ensure secure machineKey configurations are applied.

[Affected Scope] DotNetNuke (DNN) Platform versions 9.2.0 through 9.2.1

[Impact] Attackers can exploit weak cryptographic algorithms to decrypt, forge, and inject malicious serialized .NET payloads into cookies, leading to Remote Code Execution (RCE)

[Mitigation] Immediately upgrade DNN Platform to version 9.2.2 or higher, and regenerate the MachineKey in web.config

[Affected Scope] Linear eMerge E3-Series physical access control devices (versions 1.00-06 and prior)

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending specially crafted HTTP requests

[Mitigation] Immediately isolate vulnerable devices from the public internet and restrict access using strict firewall rules or apply the latest firmware updates

[Affected Scope] Exim mail server versions 4.87 to 4.91 inclusive

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending specially crafted recipient addresses

[Mitigation] Immediately upgrade Exim packages to a patched version (4.92 or higher) and apply temporary configuration workarounds

[Affected Scope] Atlassian Crowd and Crowd Data Center from version 2.1.0 up to 3.4.4 (specific minor version ranges)

[Impact] Unauthenticated remote attackers can upload and install arbitrary plugins, leading to complete remote code execution (RCE) on the host system

[Mitigation] Immediately upgrade to the fixed versions (3.0.5, 3.1.6, 3.2.8, 3.3.5, 3.4.4 or later) or disable/remove the pdkinstall plugin

[Affected Scope] Sitecore CMS through version 9.1

[Impact] An authenticated attacker can execute arbitrary code on the target server by sending a serialized .NET object in an HTTP POST parameter.

[Mitigation] Apply the official security patches from Sitecore or disable/update the vulnerable anti-CSRF module configuration.

[Affected Scope] Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending a malicious serialized .NET object in the __CSRFTOKEN HTTP POST parameter

[Mitigation] Apply official security patches, disable the vulnerable AntiCSRF module, or upgrade to a supported secure version

[Affected Scope] Synacor Zimbra Collaboration Suite (ZCS) 8.7.x before 8.7.11p10

[Impact] Unauthenticated remote attackers can exploit this XML External Entity (XXE) vulnerability to read arbitrary local files, perform SSRF, and achieve Remote Code Execution (RCE)

[Mitigation] Immediately upgrade Zimbra Collaboration Suite to version 8.7.11p10 or later, and restrict external access to the Autodiscover servlet endpoint

[Affected Scope] Citrix Workspace App for Windows before version 1904

[Impact] Unauthenticated remote attackers can exploit incorrect access control mechanisms to execute arbitrary code and gain full system privileges on the target host

[Mitigation] Immediately upgrade affected client installations to version 1904 or later, and restrict network access for unpatched endpoints

[Affected Scope] WhatsApp and WhatsApp Business prior to specific patched versions across Android, iOS, Windows Phone, and Tizen platforms

[Impact] Remote attackers can execute arbitrary code (RCE) and compromise target devices without user interaction by sending specially crafted RTCP packets

[Mitigation] Immediately update WhatsApp applications to the latest official patched versions via respective app stores

[Affected Scope] ZyXEL P660HN-T1A v1 routers distributed by TrueOnline running TCLinux Firmware v7.3.15.0 v001 / 3.40(ULM.0)b31 or prior

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by manipulating the remote_host parameter in the ViewLog.asp page

[Mitigation] Immediately disable external WAN access to the web management interface, apply the latest firmware updates, or replace legacy end-of-life devices

[Affected Scope] Wireless presentation gateways based on the AWIND OEM platform, including Crestron AM-100/101, Barco wePresent WiPG-1000P/1600W, and Extron ShareLink 200/250.

[Impact] An unauthenticated remote attacker can execute arbitrary operating system commands with root privileges via crafted HTTP requests.

[Mitigation] Apply the latest firmware updates from the respective vendors and restrict network access to the device management interfaces.

[Affected Scope] Oracle WebLogic Server versions 10.3.6.0.0 and 12.1.3.0.0

[Impact] Unauthenticated remote attackers can gain full control of the WebLogic Server and execute arbitrary system commands via malicious HTTP requests

[Mitigation] Apply the official Oracle security patches immediately, or disable/remove the unused wls9-async and wls-wsat components

[Affected Scope] Pulse Connect Secure (versions prior to 9.0R3.4, 8.3R7.1, 8.2R12.1, 8.1R15.1) and Pulse Policy Secure (versions prior to 9.0R3.2, 5.4R7.1, 5.3R12.1, 5.2R12.1, 5.1R15.1)

[Impact] An authenticated attacker with administrative privileges can inject and execute arbitrary OS commands via the admin web interface, leading to complete compromise of the VPN appliance.

[Mitigation] Immediately upgrade to the patched firmware versions provided by the vendor and restrict external access to the admin interface.

[Affected Scope] Systems running Internet Explorer 11 and legacy scripting engines on Windows platforms, including Windows 10

[Impact] Successful exploitation allows remote attackers to execute arbitrary code in the context of the current user, potentially leading to full system compromise

[Mitigation] Apply the latest Microsoft cumulative security updates and disable or transition away from legacy Internet Explorer to modern browsers

[Affected Scope] Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices running firmware versions up to and including 1.0.227.

[Impact] An authenticated administrator can inject and execute arbitrary OS commands with root privileges via shell metacharacters in the 'addr1' field of the 'TestEmail' functionality.

[Mitigation] Immediately upgrade to the latest official firmware provided by the manufacturer and restrict network access to the camera's management interface.

[Affected Scope] Kentico CMS versions 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and all 9.x versions

[Impact] Unauthenticated remote attackers can bypass authentication and execute arbitrary .NET object deserialization, leading to full remote code execution on the host server

[Mitigation] Immediately apply the official vendor hotfixes or restrict external network access to the Kentico Staging Service endpoints

[Affected Scope] Kibana versions before 5.6.15 and 6.6.1

[Impact] Unauthenticated attackers can exploit a prototype pollution flaw in the Timelion visualizer to execute arbitrary shell commands with the privileges of the Kibana process on the host system.

[Mitigation] Immediately upgrade Kibana to version 5.6.15, 6.6.1, or later, or disable the Timelion application in the configuration file.

[Affected Scope] Atlassian Confluence Server and Data Center before 6.6.12, 6.7.0 to before 6.12.3, 6.13.0 to before 6.13.3, and 6.14.0 to before 6.14.2

[Impact] Unauthenticated remote attackers can achieve path traversal and execute arbitrary code (RCE) on the host server via Server-Side Template Injection (SSTI)

[Mitigation] Immediately upgrade Confluence to the patched versions (6.6.12, 6.12.3, 6.13.3, 6.14.2 or later) or disable the Widget Connector macro

[Affected Scope] Sonatype Nexus Repository Manager versions prior to 3.15.0

[Impact] Unauthenticated remote attackers can execute arbitrary Groovy scripts and gain full system-level control by sending specially crafted HTTP POST requests

[Mitigation] Immediately upgrade to the latest stable version (3.15.0 or higher) or restrict external access to the vulnerable endpoints