CVE Vulnerability Advisory Database

[Affected Scope] Windows and Windows Server systems running the Remote Access Connection Manager (RasMan) service

[Impact] An authorized local attacker can elevate privileges to SYSTEM, gaining full administrative control over the affected host

[Mitigation] Apply the latest Microsoft cumulative security updates immediately, or disable the RasMan service as a temporary workaround

[Affected Scope] SolarWinds Web Help Desk (WHD) versions 12.8.3 Hotfix 3 and prior

[Impact] Unauthenticated remote attackers can execute arbitrary commands with system privileges on the host machine by sending specially crafted serialized data

[Mitigation] Immediately upgrade to SolarWinds Web Help Desk 12.8.7 Hotfix 1 or later as recommended by the vendor advisory

[Affected Scope] License Servlet component of Fortra GoAnywhere MFT

[Impact] Unauthenticated attackers with a validly forged license response signature can deserialize arbitrary objects, potentially leading to remote command injection and full system compromise

[Mitigation] Immediately apply the official security patches provided by Fortra and restrict external access to the license servlet interfaces

[Affected Scope] N-able N-central versions prior to 2025.3.1

[Impact] An authenticated attacker with low privileges can exploit improper input validation to execute arbitrary OS commands and fully compromise the system

[Mitigation] Immediately upgrade N-able N-central to version 2025.3.1 or later

[Affected Scope] N-able N-central versions prior to 2025.3.1

[Impact] Local attackers can execute arbitrary code and potentially compromise the entire management server

[Mitigation] Immediately upgrade N-able N-central to version 2025.3.1 or later

[Affected Scope] Fortinet FortiWeb versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10, and 7.0.0 through 7.0.10

[Impact] An unauthenticated remote attacker can execute unauthorized SQL commands via crafted HTTP/HTTPS requests, potentially leading to sensitive data exposure, system compromise, and remote code execution (RCE).

[Mitigation] Immediately upgrade to the patched versions (7.6.4, 7.4.8, 7.2.11, 7.0.11 or higher) and restrict access to the management interface.

[Affected Scope] All Wing FTP Server installations running versions prior to 7.4.4

[Impact] Attackers can disclose the full local installation path of the application by supplying an excessively long value in the UID cookie, facilitating subsequent targeted attacks

[Mitigation] Immediately upgrade Wing FTP Server to version 7.4.4 or later, and deploy WAF rules to restrict anomalous cookie lengths in the interim

[Affected Scope] On-premises Microsoft SharePoint Server 2016, 2019, and Subscription Edition

[Impact] An authorized attacker can inject and execute arbitrary code over the network, leading to complete system compromise

[Mitigation] Immediately apply the official Microsoft security patches and restrict network access to SharePoint management endpoints

[Affected Scope] Specific API endpoints of Cisco Identity Services Engine (ISE) and Cisco ISE-PIC

[Impact] An unauthenticated, remote attacker can execute arbitrary code with root privileges on the underlying operating system by sending a crafted API request

[Mitigation] Immediately apply the official security patches provided by Cisco and restrict access to the management API ports

[Affected Scope] Quest KACE Systems Management Appliance (SMA) versions 13.0, 13.1, 13.2, 14.0, and 14.1

[Impact] Unauthenticated remote attackers can bypass SSO authentication to impersonate legitimate users and achieve complete administrative takeover

[Mitigation] Immediately upgrade to the patched versions (13.0.385, 13.1.81, 13.2.183, 14.0.341, or 14.1.101 and above)

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 8.8.15, 9.0, 10.0, and 10.1 utilizing the Classic UI

[Impact] Attackers can execute arbitrary JavaScript within the victim's session by sending a crafted email, potentially leading to session hijacking and unauthorized access to sensitive data without requiring user interaction beyond viewing the email

[Mitigation] Immediately apply the latest security patches provided by Zimbra, or temporarily restrict the use of the Classic UI and deploy WAF rules

[Affected Scope] Apple operating systems including iOS 15/16/17/18, iPadOS 15/16/17/18, macOS Ventura/Sonoma/Sequoia, visionOS, and watchOS

[Impact] A logic issue in processing maliciously crafted photos or videos shared via iCloud Links allows unauthorized data access and modification, with active exploitation observed in highly targeted attacks

[Mitigation] Immediately apply the official security updates released by Apple (e.g., iOS 18.3.1, macOS 15.3.1) and exercise caution when opening untrusted iCloud shared links

[Affected Scope] All Windows and Windows Server systems utilizing the SMBv3 protocol within Active Directory domains or workgroups

[Impact] An authenticated attacker with network access can exploit improper access control in SMB to elevate privileges to SYSTEM and execute arbitrary code

[Mitigation] Apply the latest Microsoft Cumulative Updates immediately and restrict SMB (TCP 445) inbound traffic using firewalls

[Affected Scope] Dassault Systèmes DELMIA Apriso from Release 2020 through Release 2025.

[Impact] Successful exploitation allows unauthenticated remote attackers to execute arbitrary code with system privileges via specially crafted serialized payloads.

[Mitigation] Immediately apply the official vendor security patches, restrict external network exposure, and perform compromise assessment using IoC logs.

[Affected Scope] Web management interface of Smartbedded Meteobridge weather station devices

[Impact] Adjacent unauthenticated attackers can execute arbitrary system commands with root privileges, leading to full device compromise

[Mitigation] Apply the latest firmware patches immediately and restrict network access to the web administration interface

[Affected Scope] Windows and Windows Server operating systems utilizing the WinSock Ancillary Function Driver (afd.sys)

[Impact] An authorized local attacker can execute arbitrary code in kernel mode, elevating privileges to SYSTEM, which is actively exploited in the wild

[Mitigation] Immediately apply the official Microsoft security updates and restrict unauthorized local access to critical systems

[Affected Scope] Microsoft Windows 10, 11, and Windows Server operating systems utilizing the Common Log File System (CLFS) driver

[Impact] An authorized local attacker can exploit this vulnerability to elevate privileges to SYSTEM level and gain full control of the host

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and monitor for anomalous CLFS log file activities

[Affected Scope] All supported versions of Microsoft Windows and Windows Server utilizing the Common Log File System (CLFS) driver.

[Impact] An authorized local attacker can exploit this vulnerability to execute arbitrary code with SYSTEM privileges, leading to complete host compromise.

[Mitigation] Immediately apply the latest cumulative security updates provided by Microsoft and restrict unauthorized local interactive access.

[Affected Scope] Windows operating systems and applications utilizing the Microsoft Scripting Engine

[Impact] Unauthorized remote attackers can execute arbitrary code and compromise system integrity via crafted web content or documents

[Mitigation] Immediately apply the official Microsoft security updates and restrict untrusted script execution policies

[Affected Scope] SysAid On-Prem versions 23.3.40 and below

[Impact] Unauthenticated remote attackers can read arbitrary system files and perform administrator account takeover, leading to full system compromise.

[Mitigation] Immediately upgrade SysAid On-Prem to version 24.4.60 or higher, and restrict external access to the Checkin endpoint prior to patching.