CVE Vulnerability Advisory Database

[Affected Scope] Microsoft Windows operating systems utilizing the CLFS driver, including Windows 10, 11, and Windows Server 2016, 2019, 2022

[Impact] A locally authenticated attacker can execute a specially crafted application to elevate privileges to NT AUTHORITY\SYSTEM, gaining full control over the system

[Mitigation] Immediately apply the latest cumulative security updates provided by Microsoft and monitor unpatched assets

[Affected Scope] Windows 10, 11, and Windows Server operating systems utilizing the Cloud Files Mini Filter Driver (cldflt.sys)

[Impact] Local attackers can exploit this vulnerability to execute arbitrary code in kernel mode, achieving full SYSTEM privileges (actively exploited in the wild)

[Mitigation] Apply the latest Microsoft cumulative security updates immediately, or disable the affected driver service as a temporary workaround

[Affected Scope] All supported versions of Windows 10, 11, and Windows Server utilizing the Desktop Window Manager (DWM) core library.

[Impact] A local attacker can exploit this vulnerability to execute arbitrary code with SYSTEM privileges, leading to complete system compromise.

[Mitigation] Immediately apply the official Microsoft cumulative security updates released in November 2023 or later.

[Affected Scope] All supported versions of Windows 10, Windows 11, and Windows Server

[Impact] Attackers can completely bypass Windows SmartScreen warnings and Mark of the Web (MotW) protections via crafted internet shortcut (.url) files, leading to silent malicious code execution

[Mitigation] Apply the official Microsoft cumulative security updates immediately and restrict the execution of untrusted .url and .lnk files from external sources

[Affected Scope] Systems running unpatched versions impacted by CVE-2023-47246

[Impact] In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat we...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] All self-hosted versions of Confluence Data Center and Server. (Atlassian Cloud sites are not affected)

[Impact] Unauthenticated remote attackers can reset Confluence setup states and create unauthorized administrator accounts, leading to a complete compromise of confidentiality, integrity, and availability.

[Mitigation] Immediately upgrade to the latest patched versions or restrict external access to the setup endpoints (/setup/*) via reverse proxy or WAF configurations.

[Affected Scope] Apache ActiveMQ brokers and client libraries utilizing the OpenWire protocol

[Impact] Unauthenticated remote attackers can execute arbitrary shell commands on the target system by manipulating serialized class types

[Mitigation] Immediately upgrade both brokers and clients to patched versions (5.15.16, 5.16.7, 5.17.6, or 5.18.3 and above)

[Affected Scope] F5 BIG-IP Configuration Utility (accessible via management ports and/or self IP addresses)

[Impact] Authenticated attackers with network access can exploit SQL injection to manipulate the database and execute arbitrary system commands with root privileges

[Mitigation] Apply official F5 security patches immediately and restrict access to the Configuration Utility (TMUI) using firewalls and ACLs

[Affected Scope] F5 BIG-IP systems with network access to the Configuration Utility (TMUI) via the management port and/or Self IP addresses.

[Impact] Unauthenticated remote attackers can bypass authentication mechanisms and execute arbitrary system commands with root privileges on the target system.

[Mitigation] Immediately apply the official F5 security patches or restrict access to the TMUI (port 443) from untrusted networks as a temporary workaround.

[Affected Scope] NextGen Healthcare Mirth Connect versions prior to 4.4.1

[Impact] Unauthenticated remote attackers can bypass authentication to execute arbitrary OS commands with system privileges, leading to full host compromise

[Mitigation] Immediately upgrade Mirth Connect to version 4.4.1 or later, and restrict access to administrative ports

[Affected Scope] VMware vCenter Server 7.0 and 8.0 series, VMware Cloud Foundation 4.x and 5.x series

[Impact] An unauthenticated attacker with network access can trigger an out-of-bounds write, potentially leading to remote code execution (RCE) with administrative privileges

[Mitigation] Apply the official security patches immediately, and restrict network access to the vCenter DCERPC port (default 2012/tcp) using firewalls

[Affected Scope] Cisco IOS XE Software with the Web UI feature enabled on network devices

[Impact] An authenticated, remote attacker can exploit insufficient input validation to inject arbitrary commands into the underlying operating system with root privileges, leading to complete system compromise

[Mitigation] Immediately disable the Web UI feature or upgrade to the latest patched Cisco IOS XE software release

[Affected Scope] Roundcube versions before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4

[Impact] Remote attackers can execute arbitrary JavaScript code in the victim's browser session by sending a crafted HTML email containing a malicious SVG document

[Mitigation] Immediately upgrade Roundcube to the patched versions (1.4.15, 1.5.5, or 1.6.4 and above)

[Affected Scope] Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier

[Impact] A remote unauthenticated attacker can read arbitrary system files and sensitive account credentials by sending specially crafted XML requests

[Mitigation] Immediately upgrade to the latest patched versions provided by the vendor and disable external entity resolution in XML parsers

[Affected Scope] Cisco IOS XE Software with the Web UI feature enabled and exposed to the internet

[Impact] Unauthenticated remote attackers can bypass authentication to create a local user with Privilege 15 access, subsequently elevating to root to install a persistent malicious implant

[Mitigation] Immediately disable the Web UI (HTTP/HTTPS Server) feature or restrict access to trusted management networks, and upgrade to the recommended fixed software releases

[Affected Scope] On-premises deployments of Microsoft Skype for Business Server 2015 and 2019

[Impact] Unauthenticated remote attackers can send specially crafted HTTP requests to perform Server-Side Request Forgery (SSRF), accessing internal network resources and exposing sensitive information

[Mitigation] Immediately apply the official Microsoft Cumulative Update (CU) patches and restrict outbound traffic from the application servers

[Affected Scope] All supported versions of Microsoft Windows 10, 11, and Windows Server

[Impact] Attackers can bypass MotW warnings and SmartScreen blocks to execute malicious files without user warnings

[Mitigation] Apply the latest Microsoft Cumulative Updates (LCU) immediately and harden SmartScreen policies

[Affected Scope] Microsoft WordPad application on Windows operating systems

[Impact] Attackers can force the system to leak NTLM credentials (hashes) by inducing users to open a specially crafted document, enabling offline brute-force or NTLM relay attacks

[Mitigation] Apply the official Microsoft cumulative security updates, block outbound NTLM traffic, and restrict outbound SMB connections

[Affected Scope] NetScaler ADC and NetScaler Gateway configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server

[Impact] Unauthenticated remote attackers can trigger a memory buffer over-read to leak active session tokens, bypassing Multi-Factor Authentication (MFA) to hijack sessions

[Mitigation] Immediately apply the official vendor security patches and terminate all active user sessions to invalidate potentially compromised tokens

[Affected Scope] All web servers, reverse proxies, load balancers, and CDN architectures that have the HTTP/2 protocol enabled

[Impact] Attackers can cause a complete Denial of Service (DoS) by rapidly opening and immediately canceling (via RST_STREAM) a massive volume of HTTP/2 streams, exhausting server CPU and memory resources

[Mitigation] Immediately apply official security patches for your web servers (Nginx, Apache, IIS, etc.) and proxy devices, or restrict HTTP/2 concurrent streams and enforce strict rate limiting