CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
DrayTek Vigor Routers Unauthenticated Remote Code Execution Vulnerability Analysis and Mitigation Guide (CVE-2020-8515)
[Affected Scope] DrayTek Vigor2960 (1.3.1_Beta and prior), Vigor3900 (1.4.4_Beta and prior), and Vigor300B (1.3.3_Beta, 1.4.2.1_Beta, 1.4.4_Beta and prior)
[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges via the web management interface, leading to complete device compromise
[Mitigation] Immediately upgrade the device firmware to version v1.5.1 or higher, and disable WAN-side web management access
SonicWall SMA100 handleWAFRedirect CGI Unauthenticated Directory Traversal (CVE-2019-7483) Analysis and Mitigation Guide
[Affected Scope] SonicWall SMA100 series firmware versions 9.0.0.3-17sv and prior
[Impact] Unauthenticated remote attackers can exploit directory traversal to test for the presence of arbitrary files on the server, mapping out sensitive system structures
[Mitigation] Immediately upgrade the SMA100 firmware to the latest secure version (9.0.0.4 or higher) as recommended by SonicWall
Atlassian Crowd pdkinstall Development Plugin Enabled Remote Code Execution (CVE-2019-11580)
[Affected Scope] Atlassian Crowd and Crowd Data Center from version 2.1.0 up to 3.4.4 (specific minor version ranges)
[Impact] Unauthenticated remote attackers can upload and install arbitrary plugins, leading to complete remote code execution (RCE) on the host system
[Mitigation] Immediately upgrade to the fixed versions (3.0.5, 3.1.6, 3.2.8, 3.3.5, 3.4.4 or later) or disable/remove the pdkinstall plugin
ZyXEL P660HN-T1A Router ViewLog.asp Remote Command Injection Vulnerability (CVE-2017-18368) Analysis and Mitigation Guide
[Affected Scope] ZyXEL P660HN-T1A v1 routers distributed by TrueOnline running TCLinux Firmware v7.3.15.0 v001 / 3.40(ULM.0)b31 or prior
[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by manipulating the remote_host parameter in the ViewLog.asp page
[Mitigation] Immediately disable external WAN access to the web management interface, apply the latest firmware updates, or replace legacy end-of-life devices
Crestron, Barco, Extron Wireless Presentation Systems Remote Code Execution Vulnerability (CVE-2019-3929)
[Affected Scope] Wireless presentation gateways based on the AWIND OEM platform, including Crestron AM-100/101, Barco wePresent WiPG-1000P/1600W, and Extron ShareLink 200/250.
[Impact] An unauthenticated remote attacker can execute arbitrary operating system commands with root privileges via crafted HTTP requests.
[Mitigation] Apply the latest firmware updates from the respective vendors and restrict network access to the device management interfaces.