CVE Vulnerability Advisory Database

[Affected Scope] Routers and embedded devices utilizing the Realtek SDK with the miniigd UPnP SOAP service enabled

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending crafted SOAP requests, leading to complete device compromise

[Mitigation] Disable the UPnP service, block external access to port 52869/TCP, and apply the latest firmware updates from the device vendor

[Affected Scope] Microsoft Word 2007/2010/2013, Office 2010/2013, Word for Mac 2011, SharePoint Server 2010/2013, and Office Web Apps Server 2010/2013

[Impact] Remote attackers can execute arbitrary code with the privileges of the active user by enticing them to open a specially crafted RTF document

[Mitigation] Immediately apply the official Microsoft security updates (MS15-033) or implement registry-based File Block policies to restrict RTF parsing

[Affected Scope] Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 R2 running IIS (Internet Information Services).

[Impact] Remote unauthenticated attackers can execute arbitrary code with SYSTEM privileges or trigger a Blue Screen of Death (BSOD), leading to complete system compromise or infrastructure denial of service.

[Mitigation] Apply the official Microsoft MS15-034 security patch immediately, or disable IIS Kernel Caching as a temporary workaround.

[Affected Scope] Adobe Flash Player before 13.0.0.269, 14.x through 16.x before 16.0.0.305 on Windows and OS X, and before 11.2.202.442 on Linux

[Impact] Remote attackers can execute arbitrary code (RCE) and gain full system control via specially crafted malicious Flash content (SWF) without user interaction

[Mitigation] Since Adobe Flash Player has reached End-of-Life (EOL), the only secure mitigation is to completely uninstall Flash Player from all systems

[Affected Scope] Windows Server 2003/2008/2012, Windows Vista, Windows 7, Windows 8/8.1, and Windows RT environments

[Impact] Remote attackers can execute arbitrary code with user privileges and fully compromise the target system via a crafted website

[Mitigation] Immediately apply the MS14-064 security patch, restrict Internet Explorer usage, and disable VBScript execution on legacy systems

[Affected Scope] Rejetto HTTP File Server (HFS) 2.3x versions prior to 2.3c

[Impact] Unauthenticated remote attackers can execute arbitrary system commands and gain full control of the host by sending crafted HTTP requests

[Mitigation] Immediately upgrade to a patched version (2.3c or later) or decommission the legacy HFS service in favor of secure alternatives

[Affected Scope] All Linux and Unix-like systems running GNU Bash versions up to and including 4.3

[Impact] Remote unauthenticated attackers can execute arbitrary system commands and gain full control of the target server by manipulating environment variables

[Mitigation] Immediately update GNU Bash to the latest patched version using your operating system package manager

[Affected Scope] Elasticsearch installations prior to version 1.2 running with default configurations

[Impact] Unauthenticated remote attackers can execute arbitrary MVEL expressions and Java code via the source parameter of the _search API, leading to complete system compromise

[Mitigation] Upgrade Elasticsearch to version 1.2 or higher, or explicitly disable dynamic scripting in the elasticsearch.yml configuration file

[Affected Scope] NTWebServer component in InduSoft Web Studio versions prior to 7.1 SP2 Patch 4

[Impact] Unauthenticated remote attackers can exploit directory traversal to read administrative passwords in APP files, leading to arbitrary remote code execution (RCE)

[Mitigation] Upgrade InduSoft Web Studio to version 7.1 SP2 Patch 4 or later, and restrict external access to the NTWebServer port

[Affected Scope] Microsoft Internet Explorer 9 and 10 browsers

[Impact] Remote attackers can execute arbitrary code with user privileges when a victim visits a specially crafted webpage

[Mitigation] Apply official cumulative security updates, disable Internet Explorer, and migrate to modern secure browsers

[Affected Scope] Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X

[Impact] Successful exploitation allows remote attackers to execute arbitrary code and gain full control of the target system via crafted PDF files

[Mitigation] Immediately upgrade Adobe Reader and Acrobat to version 10.1.9, 11.0.06, or later to mitigate the vulnerability

[Affected Scope] Internet Explorer and the icardie.dll ActiveX control running on Windows XP, Vista, 7, 8, 8.1, and Windows Server 2003, 2008, 2012

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (system crash) by enticing users to visit a specially crafted malicious web page

[Mitigation] Apply the official Microsoft MS13-090 security patch or configure the ActiveX Kill Bit for the icardie.dll control via the registry

[Affected Scope] Microsoft Internet Explorer versions 6 through 11

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (memory corruption) via crafted JavaScript code leveraging the onpropertychange event handler

[Mitigation] Apply the official MS13-080 security update immediately, transition to modern browsers, or implement temporary workarounds such as unregistering VGX.dll

[Affected Scope] Microsoft Internet Explorer versions 6 through 11

[Impact] Remote attackers can execute arbitrary code with the privileges of the active user via crafted JavaScript and ms-help: protocol handlers

[Mitigation] Apply the MS13-080 cumulative security update, or implement workarounds such as disabling hxds.dll loading

[Affected Scope] HP ProCurve Manager (PCM) 3.20/4.0, PCM+ 3.20/4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management.

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending a specially crafted marshalled object.

[Mitigation] Restrict external access to the vulnerable EJBInvokerServlet and JMXInvokerServlet endpoints and apply official security patches.

[Affected Scope] Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03

[Impact] Attackers can execute arbitrary code or cause a denial of service (memory corruption) via crafted PDF files

[Mitigation] Immediately upgrade to patched versions (9.5.5, 10.1.7, 11.0.03 or later) and enforce sandbox security policies

[Affected Scope] Apache Struts framework versions 2.0.0 through 2.3.15

[Impact] Remote attackers can execute arbitrary OGNL expressions via crafted 'action:', 'redirect:', or 'redirectAction:' parameter prefixes, leading to full system compromise

[Mitigation] Immediately upgrade Apache Struts to version 2.3.15.1 or higher, or implement strict WAF rules to block vulnerable parameter prefixes

[Affected Scope] Microsoft Internet Explorer (IE) versions 8, 9, and 10 running on Windows environments.

[Impact] Successful exploitation allows remote attackers to execute arbitrary code with the privileges of the current user or cause a denial of service (memory corruption) via a crafted malicious website.

[Mitigation] Apply the official Microsoft security update (MS13-055), transition to modern secure browsers, or implement temporary workarounds such as disabling Active Scripting.

[Affected Scope] Microsoft Internet Explorer versions 6, 7, 8, 9, and 10

[Impact] Remote attackers can execute arbitrary code with the privileges of the active user by enticing them to visit a specially crafted malicious website that triggers a Use-After-Free condition.

[Mitigation] Apply the official Microsoft MS13-037 security update, transition to modern browsers (e.g., Microsoft Edge), or unregister the VML rendering engine (vgx.dll) as a temporary workaround.

[Affected Scope] Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (system crash) via a specially crafted PDF document

[Mitigation] Immediately upgrade Adobe Reader and Acrobat to the latest patched versions (9.5.4, 10.1.6, 11.0.02 or higher)