CVE Vulnerability Advisory Database

[Affected Scope] Legacy Windows operating systems including Windows Vista SP2, 7 SP1, 8.1, 10, and Windows Server 2008, 2012, 2016

[Impact] Remote attackers can execute arbitrary code with the privileges of the current user and compromise the system via crafted websites or documents

[Mitigation] Apply the official Microsoft security updates (MS16-120) immediately and restrict access to untrusted websites on unpatched systems

[Affected Scope] Apple iPhone, iPad, and iPod touch devices running iOS versions prior to 9.3.5, and applications utilizing the WebKit rendering engine

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (memory corruption) by enticing a user to visit a specially crafted website

[Mitigation] Immediately update the operating system of affected devices to iOS 9.3.5 or later

[Affected Scope] Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, 5500-X, ASAv, Firepower 9300, PIX, and FWSM devices

[Impact] Remote authenticated attackers can exploit this vulnerability to execute arbitrary code (RCE) with elevated privileges or cause a denial of service (DoS) via crafted IPv4 SNMP packets

[Mitigation] Apply official Cisco software updates immediately, restrict SNMP access using strict Access Control Lists (ACLs), and rotate SNMP community strings

[Affected Scope] All Java applications utilizing Apache Shiro versions prior to 1.2.5

[Impact] Remote attackers can leverage the hardcoded default AES encryption key to send malicious serialized objects, leading to arbitrary code execution (RCE) or access control bypass

[Mitigation] Immediately upgrade Apache Shiro to version 1.2.5 or higher, and explicitly configure a unique, secure random cipher key for the RememberMe service

[Affected Scope] Apache ActiveMQ 5.x before 5.14.0 with the Fileserver web application enabled

[Impact] Unauthenticated remote attackers can upload and execute arbitrary JSP files via HTTP PUT and MOVE requests, leading to complete system compromise

[Mitigation] Upgrade Apache ActiveMQ to version 5.14.0 or later, or disable the Fileserver web application in the jetty.xml configuration

[Affected Scope] SAP NetWeaver Application Server Java platforms, typically prior to version 7.3

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands and Java code via crafted HTTP/HTTPS requests (CVSS 10.0)

[Mitigation] Apply SAP Note 1445998 and disable the Invoker Servlet globally in the web.xml configuration

[Affected Scope] Windows Media Center on Windows Vista SP2, Windows 7 SP1, and Windows 8.1

[Impact] Successful exploitation allows remote attackers to execute arbitrary code with the privileges of the logged-in user via a crafted .mcl file

[Mitigation] Apply the official MS16-059 security update, restrict execution of untrusted .mcl files, or disassociate the .mcl file extension

[Affected Scope] All systems running ImageMagick versions prior to 6.9.3-10 and 7.x prior to 7.0.1-1

[Impact] Remote attackers can execute arbitrary system commands with the privileges of the web server by uploading or processing a specially crafted image file

[Mitigation] Upgrade ImageMagick to the latest secure version (6.9.3-10+ or 7.0.1-1+) or disable vulnerable coders (MVG, MSL, etc.) via the policy.xml configuration file

[Affected Scope] Apache Struts versions 2.3.19 through 2.3.28 with Dynamic Method Invocation (DMI) enabled.

[Impact] Remote attackers can execute arbitrary code (RCE) with server privileges via specially crafted HTTP requests, leading to full system compromise.

[Mitigation] Immediately upgrade to Struts 2.3.20.3, 2.3.24.3, or 2.3.28.1 and set 'struts.enable.DynamicMethodInvocation' to 'false'.

[Affected Scope] Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9

[Impact] Remote attackers can execute arbitrary code without authentication by sending malicious serialized objects to the JMX service port, leading to complete system compromise

[Mitigation] Apply the latest Oracle Java SE security updates, restrict external access to JMX ports, and enforce robust authentication and SSL/TLS

[Affected Scope] Ruby on Rails versions before 3.2.22.1, 4.0.x, 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1

[Impact] Remote attackers can read arbitrary files or potentially execute arbitrary code by exploiting unrestricted input parameters passed to the render method

[Mitigation] Immediately upgrade the Ruby on Rails framework and Action View gem to the patched official release versions

[Affected Scope] IBM WebSphere Application Server and associated business, analytics, and mobile solutions utilizing vulnerable Apache Commons Collections library versions

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with system privileges by sending crafted serialized Java objects to exposed interfaces

[Mitigation] Apply official IBM security patches (Interim Fixes) immediately, or implement JVM-level deserialization filters to block the InvokerTransformer class

[Affected Scope] Oracle WebLogic Server versions 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0

[Impact] Unauthenticated remote attackers can execute arbitrary system commands via a crafted serialized Java object sent over the T3 protocol to TCP port 7001

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict external access to the T3 protocol using WebLogic Connection Filters

[Affected Scope] Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1

[Impact] Remote attackers can execute arbitrary code with the privileges of the active user and compromise the host system by tricking a user into opening a document containing a malformed EPS image

[Mitigation] Apply the official MS15-099 security update immediately, or disable the EPS graphics filter via registry modifications to prevent exploitation

[Affected Scope] Microsoft Internet Explorer versions 7 through 11

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (memory corruption) via a crafted website

[Mitigation] Immediately apply the MS15-093 cumulative security update and transition from legacy browsers to modern secure alternatives

[Affected Scope] Windows endpoint environments running Microsoft Office 2007 SP3, 2010 SP2, and 2013 SP1.

[Impact] Remote attackers can execute arbitrary code (RCE) with the privileges of the logged-in user by tricking them into opening a specially crafted Office document.

[Mitigation] Immediately apply the official Microsoft security updates (MS15-081) and enforce strict security policies on untrusted email attachments.

[Affected Scope] Windows Vista SP2, 7 SP1, 8, 8.1, RT, and Windows Server 2008/2012

[Impact] Remote attackers can execute arbitrary code with kernel-level privileges by tricking users into rendering a specially crafted OpenType font

[Mitigation] Apply the official Microsoft MS15-078 security patch immediately, or disable the Adobe Type Manager Font Driver (atmfd.dll) as a temporary workaround

[Affected Scope] Microsoft Internet Explorer 11 browser environments.

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (DoS) via memory corruption by enticing users to visit a crafted website.

[Mitigation] Apply the MS15-065 cumulative security update, disable Internet Explorer 11, and transition to modern browsers like Microsoft Edge.

[Affected Scope] Adobe Flash Player 13.x through 18.x and 11.x legacy versions on Windows, OS X, and Linux

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content

[Mitigation] Since Adobe Flash Player has reached End-of-Life (EOL), the recommended mitigation is to completely uninstall Flash Player from all systems

[Affected Scope] Microsoft .NET Framework, Office 2007/2010, Lync 2010/2013, and Silverlight 5 utilizing the DirectWrite library

[Impact] Remote attackers can execute arbitrary code (RCE) with the privileges of the active user by tricking the system into rendering a specially crafted TrueType font

[Mitigation] Immediately apply the official Microsoft security updates (MS15-044) and restrict the loading of untrusted fonts via system policies