CVE Vulnerability Advisory Database

[Affected Scope] ConnectWise ScreenConnect versions 25.2.3 and earlier

[Impact] If machine keys are compromised by an attacker with privileged system-level access, they can inject a malicious ViewState to execute arbitrary code on the server

[Mitigation] Immediately upgrade to ScreenConnect 2025.4, which completely disables ViewState and removes its dependency

[Affected Scope] Commvault Web Server versions prior to 11.36.46, 11.32.89, 11.28.141, and 11.20.217 on Windows and Linux platforms

[Impact] An authenticated remote attacker can compromise the web server by creating and executing malicious webshells, leading to full system takeover.

[Mitigation] Immediately upgrade Commvault Web Server to the patched versions (11.36.46, 11.32.89, 11.28.141, or 11.20.217 or higher).

[Affected Scope] Craft CMS versions 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17

[Impact] Unauthenticated remote attackers can execute arbitrary PHP code on the target server via crafted HTTP requests, leading to complete system compromise.

[Mitigation] Immediately upgrade your Craft CMS installation to the patched versions (3.9.15, 4.14.15, or 5.6.17) depending on your major version branch.

[Affected Scope] All mail server environments running Qualitia Active! mail 6 BuildInfo: 6.60.05008561 and earlier

[Impact] Unauthenticated remote attackers can execute arbitrary code or trigger a Denial-of-Service (DoS) condition by sending specially crafted HTTP requests

[Mitigation] Immediately apply the latest security patch provided by the vendor (Qualitia) and restrict external access to the webmail interface until patched

[Affected Scope] Apple iOS and iPadOS prior to 18.4.1, macOS Sequoia prior to 15.4.1, tvOS prior to 18.4.1, visionOS prior to 2.4.1, and watchOS prior to 11.5

[Impact] Processing a maliciously crafted media file containing an audio stream may lead to arbitrary remote code execution (RCE) on the target system

[Mitigation] Immediately apply the official software updates provided by Apple to patch the vulnerability

[Affected Scope] Yii 2 framework versions prior to 2.0.52

[Impact] Remote attackers can execute arbitrary PHP code on the server and fully compromise the system via specially crafted requests.

[Mitigation] Immediately upgrade the Yii2 framework to the patched version 2.0.52 or higher.

[Affected Scope] Windows 10, Windows 11, and Windows Server operating systems utilizing the Common Log File System (CLFS.sys) driver.

[Impact] An authorized local attacker can execute arbitrary code in kernel mode and elevate privileges to NT AUTHORITY\SYSTEM.

[Mitigation] Immediately apply the latest cumulative security updates released by Microsoft (March 2025 Patch Tuesday or later).

[Affected Scope] CrushFTP 10 before 10.8.4 and CrushFTP 11 before 11.3.1

[Impact] Unauthenticated attackers can bypass authentication via HTTP(S) ports to take over the 'crushadmin' account and fully compromise the system

[Mitigation] Immediately upgrade CrushFTP to version 10.8.4 / 11.3.1 or later, and enforce DMZ proxy configurations

[Affected Scope] D-Link DIR-823X router firmware versions 240126 and 240802.

[Impact] An authorized attacker can execute arbitrary system commands with root privileges and fully compromise the device by sending a crafted HTTP POST request to the /goform/set_prohibiting endpoint.

[Mitigation] Apply the official firmware patch immediately, disable remote WAN management, and enforce strong administrator credentials.

[Affected Scope] Kentico Xperience through version 13.0.178

[Impact] Authenticated attackers can exploit the Staging Sync Server to upload arbitrary files to relative paths, leading to server-side execution and full Remote Code Execution (RCE)

[Mitigation] Apply the official Kentico hotfix immediately and restrict access to the Staging Sync Server endpoints

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 9.0, 10.0, and 10.1 utilizing the Classic Web Client

[Impact] Viewing an email containing a malicious ICS calendar file triggers arbitrary JavaScript execution within the victim's session, enabling unauthorized email redirection and data exfiltration

[Mitigation] Apply official Zimbra security patches (9.0.0 Patch 44, 10.0.13, 10.1.5 or later) immediately, and restrict the use of the Classic Web Client until patched

[Affected Scope] Junos OS versions prior to 21.2R3-S9, 21.4R3-S10, 22.2R3-S6, 22.4R3-S6, 23.2R2-S3, 23.4R2-S4, and 24.2R1-S2/24.2R2

[Impact] A highly privileged local attacker with shell access can inject arbitrary code to compromise the integrity of the device

[Mitigation] Immediately upgrade to the recommended patched Junos OS releases and restrict local shell access to authorized administrators only

[Affected Scope] Microsoft Management Console (MMC) component across various supported Microsoft Windows operating systems

[Impact] Local attackers can bypass critical security boundaries and Mark-of-the-Web (MotW) protections via user interaction, potentially leading to privilege escalation and arbitrary code execution

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and restrict the execution of untrusted .msc files using AppLocker or WDAC

[Affected Scope] Windows 10, Windows 11, and Windows Server families utilizing the NTFS file system driver

[Impact] Local authorized attackers can disclose sensitive kernel memory information, potentially facilitating subsequent privilege escalation (EoP) attacks

[Mitigation] Immediately apply the February 2025 Microsoft Patch Tuesday security updates and restrict local access for unauthorized users

[Affected Scope] All Windows operating system deployments utilizing the NTFS file system

[Impact] An unauthorized attacker with physical access can extract sensitive information written in plaintext within NTFS system log files

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and enforce BitLocker Full Disk Encryption (FDE)

[Affected Scope] Systems running Microsoft Windows operating systems utilizing the Win32k kernel subsystem

[Impact] An authorized local attacker can elevate privileges to SYSTEM level, gaining full control over the affected system

[Mitigation] Immediately apply the latest cumulative security updates provided by Microsoft and restrict unauthorized local access

[Affected Scope] Active Directory environments and Windows operating systems utilizing the NTLM authentication protocol

[Impact] Unauthorized remote attackers can control file names or paths to perform network-based spoofing and credential relay attacks

[Mitigation] Apply the latest Microsoft cumulative security updates and restrict NTLM authentication traffic

[Affected Scope] Edimax IC-7100 IP camera devices

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges and fully compromise the device by sending specially crafted HTTP requests

[Mitigation] Apply official vendor patches immediately, or restrict management interface access from the public internet and isolate the affected devices

[Affected Scope] VMware ESXi and Workstation products

[Impact] A malicious actor with local administrative privileges on a guest VM can execute arbitrary code within the host's VMX process, leading to a virtual machine escape

[Mitigation] Apply the latest security patches provided by Broadcom and restrict administrative access within guest virtual machines

[Affected Scope] PAN-OS firewalls with the management web interface enabled and accessible via the network (excluding Cloud NGFW and Prisma Access)

[Impact] Authenticated attackers can read sensitive system files on the PAN-OS filesystem that are readable by the 'nobody' user, potentially exposing configuration details

[Mitigation] Apply the latest PAN-OS security patches immediately and restrict management interface access to trusted internal IP addresses