CVE Vulnerability Advisory Database

[Affected Scope] Microsoft SharePoint Server 2010, 2013, 2016, 2019, and SharePoint Foundation 2013

[Impact] Unauthenticated remote attackers can execute arbitrary code with the privileges of the SharePoint IIS application pool (w3wp.exe) by sending a specially crafted application package, leading to complete system compromise

[Mitigation] Immediately apply the official Microsoft security updates and perform compromise assessments on internet-facing SharePoint servers

[Affected Scope] ThinkPHP framework versions prior to 3.2.4, and applications built on it such as Open Source BMS v1.1.1.

[Impact] Unauthenticated remote attackers can execute arbitrary system commands and gain full control of the web server by sending crafted HTTP GET requests.

[Mitigation] Upgrade the ThinkPHP framework to version 3.2.4 or higher, or implement immediate URL routing filtering and WAF blocking rules.

[Affected Scope] Drupal 8.5.x before 8.5.11, Drupal 8.6.x before 8.6.10, and Drupal 7 environments utilizing web services modules such as RESTful Web Services or JSON:API

[Impact] Unauthenticated remote attackers can execute arbitrary PHP code on the target server by sending specially crafted REST API requests, potentially leading to full system compromise

[Mitigation] Immediately upgrade Drupal Core to the latest secure versions (8.5.11, 8.6.10, or later) or disable vulnerable REST/JSON:API modules as a temporary workaround

[Affected Scope] Systems running Internet Explorer 9, 10, and 11 on supported Windows client and server platforms

[Impact] Remote Code Execution (RCE) under the context of the current user, potentially leading to full system compromise upon visiting a malicious webpage

[Mitigation] Apply the official Microsoft cumulative security updates immediately, or restrict access to JScript.dll as a temporary workaround

[Affected Scope] NoneCms V1.3 and underlying ThinkPHP 5.x framework-based web applications

[Impact] Unauthenticated remote attackers can execute arbitrary PHP code and gain full control of the target server by sending crafted HTTP requests

[Mitigation] Upgrade the ThinkPHP framework to the latest secure version, apply patches to NoneCms, or deploy Web Application Firewall (WAF) rules

[Affected Scope] Google Chrome prior to version 71.0.3578.80

[Impact] Remote attackers can execute arbitrary code inside the browser sandbox by enticing a user to visit a specially crafted HTML page.

[Mitigation] Immediately update Google Chrome to the latest stable version (71.0.3578.80 or higher) across all enterprise endpoints.

[Affected Scope] Jenkins weekly version 2.153 and earlier, LTS version 2.138.3 and earlier utilizing the Stapler web framework.

[Impact] Unauthenticated remote attackers can invoke arbitrary methods on Java objects by sending crafted URLs, leading to full Remote Code Execution (RCE) under system privileges.

[Mitigation] Immediately upgrade Jenkins weekly to version 2.154 or later, and LTS to version 2.138.4 or later.

[Affected Scope] Paessler PRTG Network Monitor versions prior to 18.2.40.1683

[Impact] Unauthenticated remote attackers can exploit a Local File Inclusion (LFI) vulnerability to create unauthorized accounts with administrative privileges, leading to full system compromise

[Mitigation] Immediately upgrade PRTG Network Monitor to version 18.2.40.1683 or later and restrict external access to the web console

[Affected Scope] All Java-based web applications utilizing RichFaces Framework versions 3.0.0 through 3.3.4.

[Impact] A remote, unauthenticated attacker can execute arbitrary system commands and fully compromise the host by sending a crafted chain of serialized Java objects.

[Mitigation] Migrate legacy RichFaces 3.X applications to supported frameworks, or restrict external access to the vulnerable '/org.ajax4jsf.resource.UserResource' path using WAF rules or servlet filters.

[Affected Scope] Internet Explorer 9, 10, and 11 running on Microsoft Windows environments.

[Impact] Successful exploitation allows remote attackers to execute arbitrary code (RCE) with the privileges of the active user by enticing them to visit a specially crafted website.

[Mitigation] Apply the official Microsoft cumulative security updates immediately, or disable VBScript execution in Internet Explorer as a temporary workaround.

[Affected Scope] Laravel Framework versions up to 5.5.40 and 5.6.x versions up to 5.6.29

[Impact] If an attacker obtains or compromises the application key (APP_KEY), they can execute arbitrary remote code (RCE) on the target server by sending a crafted X-XSRF-TOKEN header

[Mitigation] Immediately upgrade the Laravel Framework to the patched versions (5.5.41, 5.6.30, or higher) and rotate the APP_KEY if it has been exposed

[Affected Scope] NUUO NVRmini network video recorder devices

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending crafted HTTP requests

[Mitigation] Apply the latest firmware updates, restrict external internet access to the management interface, and implement firewall rules

[Affected Scope] Drupal Core 7.x and 8.x versions (prior to 7.59, 8.5.3, and 8.4.8)

[Impact] Unauthenticated remote attackers can exploit multiple attack vectors to execute arbitrary code and fully compromise the target Drupal site

[Mitigation] Immediately upgrade Drupal Core to the patched versions (7.59, 8.5.3, 8.4.8, or higher)

[Affected Scope] Paessler PRTG Network Monitor versions prior to 18.2.39

[Impact] An authenticated administrator can execute arbitrary OS commands on both the server and connected devices by sending malformed parameters in sensor or notification configurations

[Mitigation] Immediately upgrade PRTG Network Monitor to version 18.2.39 or later, and restrict access to the administrator web console

[Affected Scope] VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 with the local web UI component enabled.

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges, leading to complete compromise of the SD-WAN appliance.

[Mitigation] Immediately upgrade to version 3.1.0 or higher, or disable the local web UI service and restrict access from untrusted networks.

[Affected Scope] Quest KACE System Management Appliance (SMA) 8.0.318 and prior versions

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with high privileges by sending specially crafted HTTP requests

[Mitigation] Apply official vendor patches immediately and restrict external internet access to the management interface

[Affected Scope] Adobe ColdFusion 2016 Update 5 and earlier, ColdFusion 11 Update 13 and earlier

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by exploiting a deserialization of untrusted data (CWE-502)

[Mitigation] Immediately apply the official Adobe security patch (APSB18-14) and restrict external access to RMI and management ports

[Affected Scope] Internet Explorer and Microsoft Office applications utilizing the VBScript engine on Windows 7, 8.1, 10, and Windows Server 2008, 2012, 2016

[Impact] Remote attackers can execute arbitrary code with the privileges of the current user via malicious web pages or crafted Office documents

[Mitigation] Apply the official Microsoft cumulative security updates or disable VBScript execution via registry modifications

[Affected Scope] Microsoft Windows operating systems including Windows 7, 8.1, 10, and Windows Server 2008, 2012, 2016

[Impact] Remote attackers can execute arbitrary code with SYSTEM privileges by sending specially crafted serialized objects

[Mitigation] Apply the official Microsoft cumulative security updates and restrict untrusted COM/DCOM network traffic

[Affected Scope] Dasan GPON home routers

[Impact] Unauthenticated remote attackers can execute arbitrary system commands and gain full control of the device by sending specially crafted HTTP requests

[Mitigation] Apply the latest firmware updates from the vendor, disable external WAN-side management access, and restrict access to trusted networks