CVE Vulnerability Advisory Database

[Affected Scope] Apache Kylin versions 2.3.0 through 2.6.5, and version 3.0.1

[Impact] Authenticated attackers can exploit the lack of input validation to execute arbitrary OS commands and gain full control over the hosting server

[Mitigation] Immediately upgrade to Apache Kylin 2.6.6, 3.0.2, or later, or apply configuration workarounds to disable vulnerable features

[Affected Scope] Plex Media Server versions prior to 1.19.3 running on Windows operating systems

[Impact] An authenticated remote attacker with administrative privileges can execute arbitrary Python code via deserialization of untrusted data

[Mitigation] Immediately upgrade Plex Media Server to the latest secure version (1.19.3 or higher) and restrict administrative access

[Affected Scope] Cisco ASA Software and Cisco FTD Software with AnyConnect VPN or WebVPN configurations enabled

[Impact] An unauthenticated, remote attacker can retrieve sensitive memory contents (such as user credentials and session tokens) by sending crafted HTTP GET requests

[Mitigation] Apply the official firmware patches provided by Cisco immediately, or restrict access to the web services interface if patching is delayed

[Affected Scope] Roundcube Webmail versions before 1.4.4

[Impact] Unauthenticated attackers can execute arbitrary OS commands and gain full control of the mail server via shell metacharacters

[Mitigation] Immediately upgrade Roundcube Webmail to version 1.4.4 or later and restrict ImageMagick configuration paths

[Affected Scope] Juniper Networks Junos OS devices with HTTP/HTTPS services (J-Web, Web Authentication, Dynamic-VPN, etc.) enabled

[Impact] Unauthenticated attackers can read arbitrary system files, hijack active administrator session tokens, or inject commands into web logs to execute limited commands

[Mitigation] Upgrade Junos OS to the recommended patched release, or disable HTTP/HTTPS and J-Web services if they are not business-critical

[Affected Scope] jQuery versions greater than or equal to 1.0.3 and before 3.5.0

[Impact] Passing untrusted HTML to jQuery's DOM manipulation methods (e.g., .html(), .append()) can execute arbitrary JavaScript code even after sanitization

[Mitigation] Upgrade jQuery to the patched version 3.5.0 or higher, or apply a workaround to bypass the vulnerable htmlPrefilter function

[Affected Scope] Multiple versions of Windows OS including Windows 7, 8.1, 10, and Windows Server 2008, 2012, 2016, 2019

[Impact] A local attacker can execute arbitrary code in kernel mode and gain full SYSTEM privileges on the target machine

[Mitigation] Apply the official Microsoft security updates immediately and restrict local execution privileges for non-privileged users

[Affected Scope] Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0

[Impact] Unauthenticated remote attackers can execute arbitrary code and take full control of the Oracle WebLogic Server by sending malicious serialized data via T3 or IIOP protocols

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately, or restrict external access to T3/IIOP protocols using connection filters and firewalls

[Affected Scope] D-Link DCS-930L network camera devices running firmware versions prior to 2.12.

[Impact] An authenticated remote attacker with administrative privileges can execute arbitrary OS commands via the 'SystemCommand' parameter in the 'setSystemCommand' API, leading to complete device compromise.

[Mitigation] Immediately upgrade the device firmware to version 2.12 or higher, and restrict external access to the camera's management interface.

[Affected Scope] D-Link DWL-2600AP hardware Rev A, firmware version 4.2.0.15 and prior

[Impact] Authenticated attackers can execute arbitrary OS commands with root privileges via the Save Configuration functionality, leading to complete device compromise

[Mitigation] Apply the official firmware patch from the vendor, restrict access to the web management interface, or replace end-of-life devices

[Affected Scope] ZyXEL NAS devices (NAS326, NAS520, NAS540, NAS542) running firmware versions prior to 5.21, and all end-of-support NSA series models

[Impact] An unauthenticated remote attacker can execute arbitrary OS commands with root privileges by sending a specially crafted HTTP request

[Mitigation] Immediately upgrade active models to the patched firmware versions, and isolate or replace end-of-support (EoL) models from the network

[Affected Scope] Apple iOS before 13.3.1, iPadOS before 13.3.1, macOS Catalina before 10.15.3, tvOS before 13.3.1, and watchOS before 6.1.2

[Impact] A local application may exploit this vulnerability to execute arbitrary code with elevated kernel privileges, leading to complete system compromise

[Mitigation] Immediately apply the official software updates provided by Apple to patch the affected systems

[Affected Scope] Cisco AnyConnect Secure Mobility Client for Windows versions 4.8.01090 and prior

[Impact] An authenticated local attacker can copy arbitrary malicious DLL files to system-level directories, leading to arbitrary code execution with SYSTEM privileges

[Mitigation] Immediately upgrade to the patched official release (version 4.8.02042 or later)

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions prior to 8.8.15 Patch 7 with WebEx zimlet installed and zimlet JSP enabled

[Impact] Unauthenticated remote attackers can exploit Server-Side Request Forgery (SSRF) to access internal network resources, extract sensitive data, or pivot to further remote code execution (RCE)

[Mitigation] Immediately upgrade Zimbra Collaboration Suite to 8.8.15 Patch 7 or later, or disable and undeploy the unused WebEx zimlet

[Affected Scope] Microsoft SQL Server Reporting Services (SSRS) 2012, 2014, and 2016

[Impact] An authenticated attacker can execute arbitrary remote code under the context of the SSRS service account by sending a crafted HTTP POST request

[Mitigation] Immediately apply the official Microsoft security patches and restrict network access to the SSRS web portal

[Affected Scope] OpenSMTPD version 6.6 running with the default 'uncommented' configuration on OpenBSD 6.6 and other platforms.

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by injecting shell metacharacters into the MAIL FROM field of an SMTP session.

[Mitigation] Immediately upgrade OpenSMTPD to the patched version 6.6.1p1, 6.6.2p1, or later.

[Affected Scope] WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10

[Impact] Cross-site scripting (XSS) and local file reading, potentially leading to remote code execution (RCE) and sensitive data exfiltration upon user interaction

[Mitigation] Immediately update WhatsApp Desktop to version 0.3.9309 or higher and WhatsApp for iPhone to version 2.20.10 or higher

[Affected Scope] Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0

[Impact] Unauthenticated remote attackers can execute arbitrary code and fully compromise the WebLogic Server via malicious IIOP requests

[Mitigation] Apply the official Oracle CPU patches immediately, or disable the IIOP protocol and restrict access to port 7001

[Affected Scope] Update Notification Manager service running on Windows 10 and Windows Server operating systems

[Impact] A local attacker can exploit symbolic link creation to overwrite system files, leading to arbitrary code execution with SYSTEM privileges

[Mitigation] Apply the official Microsoft cumulative security updates immediately, or disable associated scheduled tasks as a temporary workaround

[Affected Scope] D-Link DIR-859 Wi-Fi router firmware versions 1.05 and 1.06B01 Beta01

[Impact] An unauthenticated remote attacker on the local network can execute arbitrary system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service

[Mitigation] Apply the official firmware security patches, disable the UPnP service, and restrict access to the router management interface