CVE Vulnerability Advisory Database

[Affected Scope] Sitecore Experience Platform (XP) 7.5 Initial Release to Sitecore XP 8.2 Update-7.

[Impact] Unauthenticated remote attackers can execute arbitrary commands with system privileges on the hosting server by sending specially crafted serialized payloads.

[Mitigation] Apply official security patches immediately or restrict external access to the vulnerable '/sitecore/shell/ClientBin/Reporting/ReportService.asmx' endpoint.

[Affected Scope] Apple iOS before 14.8, iOS before 12.5.5, macOS Big Sur before 11.6, macOS Catalina (prior to Security Update 2021-005), and watchOS before 7.6.2

[Impact] A sandboxed process or local attacker can bypass sandbox restrictions, escalate privileges, and gain unauthorized access to sensitive system resources

[Mitigation] Immediately apply the official security updates provided by Apple (iOS 14.8, macOS 11.6, etc.)

[Affected Scope] Java applications utilizing XStream library versions prior to 1.4.18, and third-party solutions like VMware NSX Manager embedding this library

[Impact] Unauthenticated remote attackers can execute arbitrary system commands on the host by manipulating the processed XML input stream

[Mitigation] Upgrade XStream to version 1.4.18 or higher, and configure XStream's security framework with a strict whitelist

[Affected Scope] ForgeRock Access Manager (AM) versions prior to 7.0 (including OpenAM 14.6.3 and earlier)

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending a single crafted HTTP request

[Mitigation] Immediately upgrade to ForgeRock AM 7.0 or later, or restrict external access to JATO-related endpoints such as /ccversion/*

[Affected Scope] Checkbox Survey versions prior to 7.0, specifically affecting the CheckboxWeb.dll component

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges on the target server via untrusted data deserialization

[Mitigation] Immediately upgrade Checkbox Survey to version 7.0 or higher, and restrict external access to vulnerable endpoints

[Affected Scope] Microsoft Exchange Server 2013, 2016, and 2019

[Impact] Attackers can execute arbitrary code with SYSTEM privileges, leading to full compromise of the mail server

[Mitigation] Immediately apply the official Microsoft Cumulative Updates (CU) and Security Updates (SU)

[Affected Scope] Microsoft Exchange Server 2010 Service Pack 3, 2013, 2016, and 2019

[Impact] An authenticated attacker can send specially crafted payloads to execute arbitrary code with SYSTEM privileges, leading to full server compromise

[Mitigation] Immediately apply the official Microsoft security updates and restrict external access to Exchange management interfaces

[Affected Scope] Oracle WebLogic Server versions 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0

[Impact] Unauthenticated remote attackers can exploit T3 or IIOP protocols to achieve complete takeover and execute arbitrary code on the target server

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict/block T3 and IIOP protocol access using connection filters

[Affected Scope] Unpatched installations of .NET Framework, Microsoft SharePoint Server, and Visual Studio

[Impact] Remote attackers can execute arbitrary code (RCE) with high privileges by sending a specially crafted XML payload to vulnerable endpoints

[Mitigation] Apply the official Microsoft security updates immediately and restrict untrusted XML deserialization using DataSet/DataTable

[Affected Scope] MobileIron Core & Connector versions 10.6.0.0 and earlier, Sentry versions 9.8.0 and earlier, Monitor & RDB versions 2.0.0.1 and earlier

[Impact] Unauthenticated remote attackers can execute arbitrary code with system administrator privileges by sending specially crafted Hessian serialized data

[Mitigation] Immediately apply the official security patches provided by the vendor and restrict external access to sensitive service endpoints

[Affected Scope] Plex Media Server versions prior to 1.19.3 running on Windows operating systems

[Impact] An authenticated remote attacker with administrative privileges can execute arbitrary Python code via deserialization of untrusted data

[Mitigation] Immediately upgrade Plex Media Server to the latest secure version (1.19.3 or higher) and restrict administrative access

[Affected Scope] Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0

[Impact] Unauthenticated remote attackers can execute arbitrary code and take full control of the Oracle WebLogic Server by sending malicious serialized data via T3 or IIOP protocols

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately, or restrict external access to T3/IIOP protocols using connection filters and firewalls

[Affected Scope] Liferay Portal versions prior to 7.2.1 CE GA2

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by exploiting the JSON web services (JSONWS) API to deserialize untrusted Java objects

[Mitigation] Immediately upgrade Liferay Portal to version 7.2.1 CE GA2 or later, and restrict external access to the JSONWS API endpoints

[Affected Scope] Zoho ManageEngine Desktop Central versions prior to 10.0.474

[Impact] Unauthenticated remote attackers can execute arbitrary code with SYSTEM/Administrator privileges by sending specially crafted serialized Java objects

[Mitigation] Immediately upgrade to version 10.0.474 or higher, and restrict external access to the management ports

[Affected Scope] Microsoft Exchange Server 2010, 2013, 2016, and 2019

[Impact] An authenticated attacker can exploit static cryptographic keys to forge ASP.NET ViewState data, leading to arbitrary code execution with SYSTEM privileges via the Exchange Control Panel (ECP)

[Mitigation] Apply the official Microsoft Cumulative Update (CU) and security patches immediately, and regenerate unique ViewState validation/decryption keys

[Affected Scope] Microsoft SQL Server Reporting Services (SSRS) 2012, 2014, and 2016

[Impact] An authenticated attacker can execute arbitrary remote code under the context of the SSRS service account by sending a crafted HTTP POST request

[Mitigation] Immediately apply the official Microsoft security patches and restrict network access to the SSRS web portal

[Affected Scope] Oracle Coherence versions 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0, including WebLogic Server environments utilizing these components

[Impact] Unauthenticated remote attackers can exploit this vulnerability via the T3 protocol to execute arbitrary code and achieve complete takeover of the target system

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict external access to the T3/T3S protocols (default port 7001) using connection filters

[Affected Scope] Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0

[Impact] Unauthenticated remote attackers can execute arbitrary code and fully compromise the WebLogic Server via malicious IIOP requests

[Mitigation] Apply the official Oracle CPU patches immediately, or disable the IIOP protocol and restrict access to port 7001

[Affected Scope] Progress Telerik UI for ASP.NET AJAX versions through 2019.3.1023 (and certain configurations prior to 2020.1.114)

[Impact] If encryption keys are compromised or known, attackers can exploit the RadAsyncUpload function to deserialize malicious .NET objects, resulting in unauthorized Remote Code Execution (RCE) on the target web server.

[Mitigation] Upgrade Telerik UI to version 2020.1.114 or later, or immediately modify web.config to disable RadAsyncUpload or rotate the encryption keys.

[Affected Scope] SAP Commerce Cloud (formerly Hybris) versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, and 1905 with the virtualjdbc extension enabled

[Impact] Unauthenticated remote attackers can exploit insecure deserialization to execute arbitrary system commands with 'Hybris' user privileges on the target host

[Mitigation] Apply the official SAP security patch (SAP Note 2786035), disable the unused virtualjdbc extension, or restrict external access to the endpoint