CVE Vulnerability Advisory Database

[Affected Scope] SonicWall SMA100 series firmware versions 9.0.0.3-17sv and prior

[Impact] Unauthenticated remote attackers can exploit directory traversal to test for the presence of arbitrary files on the server, mapping out sensitive system structures

[Mitigation] Immediately upgrade the SMA100 firmware to the latest secure version (9.0.0.4 or higher) as recommended by SonicWall

[Affected Scope] Apple iOS versions prior to 12.3, macOS Mojave prior to 10.14.5, tvOS prior to 12.3, and watchOS prior to 5.2.1

[Impact] A local malicious application can exploit this vulnerability to execute arbitrary code with elevated system/kernel privileges

[Mitigation] Immediately upgrade to patched OS versions (iOS 12.3, macOS 10.14.5, tvOS 12.3, watchOS 5.2.1 or later)

[Affected Scope] All Apple Mac systems running macOS Mojave versions prior to 10.14.4

[Impact] A local attacker can execute a malicious application to gain elevated kernel privileges and fully compromise the system

[Mitigation] Immediately apply the official operating system security update to macOS Mojave 10.14.4 or later

[Affected Scope] Systems running versions prior to iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, and iCloud for Windows 7.11

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution (RCE) on the target system

[Mitigation] Immediately update all affected operating systems and applications to their latest patched versions

[Affected Scope] All Apple iOS and iPadOS devices running versions prior to iOS 12.1.4

[Impact] Local attackers can execute arbitrary code with kernel privileges, leading to complete device compromise; actively exploited in the wild

[Mitigation] Immediately update affected devices to iOS 12.1.4 or later

[Affected Scope] Apple iOS devices prior to version 12.1.4 and macOS Mojave systems prior to 10.14.3 Supplemental Update

[Impact] A local application can exploit a memory corruption vulnerability to bypass sandboxing and gain elevated system privileges

[Mitigation] Immediately apply the official security patches (iOS 12.1.4, macOS 10.14.3 Supplemental Update, or later)

[Affected Scope] QNAP Photo Station versions and associated QTS operating system environments

[Impact] Unauthenticated remote attackers can access or modify critical system files, potentially leading to full Remote Code Execution (RCE)

[Mitigation] Immediately update QNAP Photo Station to the latest secure version and restrict external access

[Affected Scope] QNAP Photo Station and QTS specific versions

[Impact] Unauthenticated remote attackers can access/modify system files and execute arbitrary commands, leading to full system compromise

[Mitigation] Immediately update Photo Station and QTS firmware to the latest recommended security patch versions

[Affected Scope] QNAP QTS operating system and Photo Station application

[Impact] Unauthenticated remote attackers can inject arbitrary system commands via crafted HTTP requests, leading to complete system compromise

[Mitigation] Immediately update QTS and Photo Station to the latest patched versions recommended by QNAP

[Affected Scope] QNAP Photo Station versions running on QTS operating system environments

[Impact] Unauthenticated remote attackers can bypass access control mechanisms to gain unauthorized system access, potentially leading to Remote Code Execution (RCE)

[Mitigation] Immediately update QNAP Photo Station and QTS to the latest official security-patched versions

[Affected Scope] Web-based management interface of certain Cisco Small Business RV Series Routers (including RV110W, RV130, RV130W, RV215W).

[Impact] An authenticated, remote attacker with valid credentials or an active session token can execute arbitrary commands with root privileges.

[Mitigation] Apply the official firmware updates from the vendor, or disable remote WAN management and restrict access to the web interface.

[Affected Scope] Google Chrome prior to version 73.0.3683.86

[Impact] A remote attacker can exploit heap corruption via a crafted HTML page, potentially leading to arbitrary code execution within the browser renderer process

[Mitigation] Immediately update Google Chrome to the latest stable version (73.0.3683.86 or higher)

[Affected Scope] Google Chrome prior to version 78.0.3904.87

[Impact] A remote attacker can exploit heap corruption via a crafted HTML page to execute arbitrary code on the target system

[Mitigation] Immediately update Google Chrome to the latest stable version (78.0.3904.87 or higher)

[Affected Scope] Sangoma FreePBX versions 15.0.16.26 and below, 14.0.13.11 and below, and 13.0.197.13 and below

[Impact] Remote attackers can bypass authentication entirely to gain full administrative access, leading to complete system compromise and unauthorized call routing

[Mitigation] Immediately upgrade the FreePBX framework module to the patched version using the fwconsole utility

[Affected Scope] FortiOS versions 6.0.4 and below, and 5.6.8 and below, when configuration backups are taken without a custom password

[Impact] An attacker with access to the backup file can decrypt sensitive data, including user passwords, private key passphrases, and High Availability (HA) passwords, using the hard-coded key

[Mitigation] Upgrade FortiOS to patched versions and enforce custom password encryption for all configuration backups

[Affected Scope] Multiple legacy Windows operating systems including Windows 7, 8.1, 10, and Windows Server 2008, 2012, 2016, 2019

[Impact] A local authenticated attacker can bypass User Account Control (UAC) and execute arbitrary code with NT AUTHORITY\SYSTEM privileges by exploiting a design flaw in the Windows Certificate Dialog

[Mitigation] Apply the official Microsoft cumulative security updates immediately, or restrict UAC behavior and standard user privileges if patching is delayed

[Affected Scope] Windows AppX Deployment Extensions component running on Windows 10 and Windows Server environments.

[Impact] An authenticated local attacker can execute a specially crafted application to access system files, leading to full SYSTEM privilege escalation.

[Mitigation] Apply the official Microsoft cumulative security updates immediately and restrict symbolic link creation privileges for non-administrative users.

[Affected Scope] PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24, and 7.3.x below 7.3.11 running in certain Nginx + PHP-FPM configurations

[Impact] Unauthenticated remote attackers can trigger an out-of-bounds memory write in the PHP-FPM process, leading to arbitrary remote code execution (RCE) on the target web server

[Mitigation] Immediately upgrade PHP to patched versions (7.1.33, 7.2.24, 7.3.11 or higher) and configure Nginx with 'try_files' to verify file existence before passing requests to FastCGI

[Affected Scope] Oracle Solaris 11 operating system environments running the XScreenSaver component.

[Impact] A low-privileged local attacker can exploit this vulnerability to escalate privileges to root, leading to a complete takeover of the system.

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or temporarily remove the setuid bit from the xscreensaver binary.

[Affected Scope] Nostromo nhttpd web server versions 1.9.6 and prior

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with the privileges of the web server process via crafted HTTP requests

[Mitigation] Immediately upgrade to the patched version (1.9.7 or later), or restrict web server execution privileges and block anomalous directory traversal paths