CVE Vulnerability Advisory Database

[Affected Scope] Wireless presentation gateways based on the AWIND OEM platform, including Crestron AM-100/101, Barco wePresent WiPG-1000P/1600W, and Extron ShareLink 200/250.

[Impact] An unauthenticated remote attacker can execute arbitrary operating system commands with root privileges via crafted HTTP requests.

[Mitigation] Apply the latest firmware updates from the respective vendors and restrict network access to the device management interfaces.

[Affected Scope] Zimbra Collaboration Suite before 8.6 Patch 13, 8.7.x before 8.7.11 Patch 10, and 8.8.x before 8.8.10 Patch 7 or 8.8.x before 8.8.11 Patch 3

[Impact] Unauthenticated remote attackers can exploit the ProxyServlet to access internal network resources, or chain it with other vulnerabilities (such as XXE) to steal admin credentials and achieve Remote Code Execution (RCE).

[Mitigation] Immediately apply the official security patches corresponding to your Zimbra version and restrict external access to the ProxyServlet endpoint.

[Affected Scope] Microsoft Windows operating systems including Windows 7, 8.1, 10 and Windows Server 2008, 2012, 2016, 2019 utilizing SMBv1/v2/v3 protocols

[Impact] An authenticated remote attacker can disclose sensitive kernel memory information by sending specially crafted SMB requests, potentially bypassing ASLR to facilitate remote code execution (RCE)

[Mitigation] Apply the official Microsoft cumulative security updates and completely disable the legacy SMBv1 protocol across the infrastructure

[Affected Scope] Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices running firmware versions up to and including 1.0.227.

[Impact] An authenticated administrator can inject and execute arbitrary OS commands with root privileges via shell metacharacters in the 'addr1' field of the 'TestEmail' functionality.

[Mitigation] Immediately upgrade to the latest official firmware provided by the manufacturer and restrict network access to the camera's management interface.

[Affected Scope] Apple operating systems prior to iOS 12, macOS Mojave 10.14, tvOS 12, and watchOS 5

[Impact] Local attackers or malicious applications can trigger memory corruption to execute arbitrary code with kernel privileges, leading to complete system compromise

[Mitigation] Immediately update affected devices to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5, or later versions

[Affected Scope] Ruby on Rails Action View versions prior to 5.2.2.1, 5.1.6.2, 5.0.7.2, 4.2.11.1, and all v3 versions

[Impact] Unauthenticated remote attackers can exploit specially crafted Accept headers to read arbitrary files from the target system's filesystem, leading to sensitive data exposure

[Mitigation] Immediately upgrade Ruby on Rails and Action View to the patched versions, or apply temporary web server filtering rules

[Affected Scope] Jenkins Script Security Plugin 1.53 and earlier

[Impact] Attackers with Overall/Read permission can bypass the Groovy sandbox to execute arbitrary code on the Jenkins master JVM

[Mitigation] Immediately update the Script Security Plugin to version 1.54 or later, and restrict unnecessary user permissions

[Affected Scope] TIBCO JasperReports Library (<= 6.3.4, 6.4.21, 7.2.0), JasperReports Server (<= 6.3.4, 6.4.3, 7.1.0), and Jaspersoft for AWS

[Impact] An authenticated remote attacker can exploit directory traversal to access sensitive host system files and configuration data

[Mitigation] Upgrade to the latest patched versions immediately, or implement WAF rules to block directory traversal patterns (../)

[Affected Scope] Microsoft Internet Explorer 11 running on various Windows operating system environments

[Impact] An attacker can remotely test and verify the presence of specific files on the local disk, gathering critical intelligence for multi-stage targeted attacks

[Mitigation] Apply the official Microsoft cumulative security updates or disable Internet Explorer in favor of modern secure browsers

[Affected Scope] Kaseya VSA R9.3 (before 9.3.0.35), R9.4 (before 9.4.0.36), and R9.5 (before 9.5.0.5)

[Impact] Unprivileged remote attackers can execute arbitrary PowerShell payloads with SYSTEM privileges on all managed endpoints

[Mitigation] Immediately upgrade Kaseya VSA servers to patched versions (9.3.0.35, 9.4.0.36, 9.5.0.5 or higher) and restrict external access

[Affected Scope] ConnectWise ManagedITSync integration through 2017 for Kaseya VSA with exposed ManagedIT.asmx page

[Impact] Unauthenticated remote attackers can execute arbitrary SQL queries (read/write) on the Kaseya VSA database, leading to full system compromise and ransomware deployment across all managed endpoints

[Mitigation] Immediately restrict external access to the ManagedIT.asmx page, apply official security patches, or disable the integration if not in use

[Affected Scope] Enterprise network environments running FortiOS 6.0.2, 5.6.7 and before, or FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4

[Impact] An authenticated attacker can redirect LDAP connectivity test requests to a rogue LDAP server, exposing configured LDAP administrator credentials in plaintext or reversible format

[Mitigation] Upgrade FortiOS and FortiADC to the latest patched versions immediately and restrict administrative access using trusted host configurations

[Affected Scope] GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08

[Impact] Local attackers can read and write Machine Specific Registers (MSRs) at the kernel level, enabling Driver Signature Enforcement (DSE) bypass and arbitrary Ring 0 code execution

[Mitigation] Immediately uninstall vulnerable GIGABYTE utilities or upgrade to patched versions, and enforce WDAC policies to block the loading of the vulnerable GDrv.sys driver

[Affected Scope] GPCIDrv and GDrv drivers bundled with GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08

[Impact] Local attackers can exploit the exposed IO port read/write functionality to execute arbitrary code with kernel-level privileges (SYSTEM) and bypass security controls

[Mitigation] Update the affected GIGABYTE utilities to their latest secure versions, or block and remove the vulnerable drivers using Windows Defender Application Control (WDAC)

[Affected Scope] GPCIDrv and GDrv kernel drivers bundled with GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08

[Impact] A local attacker can exploit the exposed IOCTL interfaces to read/write arbitrary physical memory, leading to full kernel-level privilege escalation (SYSTEM)

[Mitigation] Upgrade the affected GIGABYTE software to the latest secure versions, or completely uninstall the utilities and block the vulnerable driver files

[Affected Scope] GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 containing the GDrv.sys driver

[Impact] A local attacker with low privileges can perform arbitrary kernel-mode (Ring 0) memory read/write operations, leading to complete system takeover and security agent bypass

[Mitigation] Update the affected GIGABYTE utilities to their latest secure versions and enforce Windows Defender Application Control (WDAC) or driver blocklists to prevent the vulnerable driver from loading

[Affected Scope] Broad range of Windows operating systems including Windows 7, 8.1, 10, and Windows Server 2008, 2012, 2016, 2019 utilizing the Win32k component

[Impact] Local attackers can execute arbitrary code in kernel mode, completely compromising the system and escalating privileges from local user to SYSTEM

[Mitigation] Immediately apply the official Microsoft cumulative security updates and restrict local interactive login permissions on unpatched assets

[Affected Scope] Broad range of Microsoft OS versions including Windows 7, 8.1, 10, and Windows Server 2008, 2012, 2016, 2019

[Impact] Local attackers can execute arbitrary code in kernel mode, gaining complete control over the system and bypassing security boundaries

[Mitigation] Immediately apply the official Microsoft Cumulative Updates (LCU) and restrict local user privileges on unpatched systems

[Affected Scope] Google Chrome prior to version 71.0.3578.80

[Impact] Remote attackers can execute arbitrary code inside the browser sandbox by enticing a user to visit a specially crafted HTML page.

[Mitigation] Immediately update Google Chrome to the latest stable version (71.0.3578.80 or higher) across all enterprise endpoints.

[Affected Scope] Paessler PRTG Network Monitor versions prior to 18.2.40.1683

[Impact] Unauthenticated remote attackers can exploit a Local File Inclusion (LFI) vulnerability to create unauthorized accounts with administrative privileges, leading to full system compromise

[Mitigation] Immediately upgrade PRTG Network Monitor to version 18.2.40.1683 or later and restrict external access to the web console