CVE Vulnerability Advisory Database

[Affected Scope] Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0

[Impact] An attacker can achieve arbitrary remote code execution (RCE) within the browser's content process, with active exploitation reported in the wild

[Mitigation] Immediately update all affected installations to the latest patched versions (Firefox 131.0.2+, ESR 128.3.1+, ESR 115.16.1+, Thunderbird 131.0.1+, 128.3.1+, 115.16.0+)

[Affected Scope] All supported versions of Windows client and server operating systems utilizing the MSHTML (Internet Explorer) engine.

[Impact] Attackers can bypass security warnings and spoof trusted domains to steal sensitive credentials or execute malicious payloads by tricking users into visiting crafted web content.

[Mitigation] Immediately apply the October 2024 Microsoft cumulative security updates and restrict MSHTML execution via registry hardening.

[Affected Scope] Microsoft Windows operating systems utilizing Microsoft Management Console (MMC) and .msc console files

[Impact] Successful exploitation allows an attacker to execute arbitrary code with the privileges of the active user by tricking them into opening a crafted .msc file

[Mitigation] Apply the official Microsoft security updates immediately and restrict the execution of untrusted .msc files

[Affected Scope] Ivanti CSA (Cloud Services Appliance) versions prior to 5.0.2

[Impact] A remote authenticated attacker with administrative privileges can execute arbitrary SQL statements, potentially leading to sensitive data exposure and further system compromise.

[Mitigation] Immediately upgrade Ivanti CSA to version 5.0.2 or higher, and restrict external access to the admin console.

[Affected Scope] PTZOptics PT30X-SDI/NDI-xx camera devices running firmware versions prior to 6.3.40

[Impact] Attackers can manipulate the 'ntp_addr' configuration to execute arbitrary OS commands with system privileges when 'ntp_client' starts, which can lead to unauthenticated remote code execution when chained with CVE-2024-8956

[Mitigation] Immediately upgrade the camera firmware to version 6.3.40 or later via the official PTZOptics portal and restrict network access

[Affected Scope] VMware vCenter Server 7.0 and 8.0 families, VMware Cloud Foundation 4.x and 5.x families

[Impact] An unauthenticated attacker with network access can escalate privileges to root by sending a specially crafted network packet

[Mitigation] Immediately upgrade to the patched versions (vCenter 8.0 U3b or later, 7.0 U3t or later) as recommended by Broadcom

[Affected Scope] Ivanti Cloud Services Appliance (CSA) versions 4.6 Patch 518 and prior

[Impact] A remote authenticated attacker with admin-level privileges can inject arbitrary OS commands, leading to remote code execution and full system compromise

[Mitigation] Immediately upgrade to the supported Ivanti CSA 5.0 version or apply the latest security patches to mitigate active exploitation risks

[Affected Scope] Microsoft Windows operating systems, including Windows 10, Windows 11, and Windows Server editions

[Impact] A locally authenticated attacker can exploit flaws in the Windows Installer service to elevate privileges to NT AUTHORITY\SYSTEM and execute arbitrary code

[Mitigation] Apply the Microsoft September 2024 security updates immediately and restrict Windows Installer privileges for non-administrative users

[Affected Scope] Authenticated Versa Director systems with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges

[Impact] Authenticated attackers can exploit the 'Change Favicon' feature to upload malicious files masquerading as .png images, leading to arbitrary code execution on the host system

[Mitigation] Apply the official security patches from Versa Networks immediately and restrict access to the management GUI to trusted IP addresses only

[Affected Scope] SolarWinds Web Help Desk (WHD) 12.8.3 and all prior versions

[Impact] Successful exploitation allows remote attackers to execute arbitrary commands on the host machine via unsafe Java deserialization, potentially leading to full system compromise

[Mitigation] Immediately apply the official SolarWinds Web Help Desk 12.8.3 Hotfix 1 or upgrade to the latest patched version

[Affected Scope] All supported versions of Windows 10, 11, and Windows Server

[Impact] Attackers can bypass Mark of the Web (MotW) security warnings, leading users to execute malicious files without any security prompts

[Mitigation] Apply the official Microsoft security updates immediately and harden SmartScreen policies

[Affected Scope] Microsoft Project 2016, LTSC Professional Plus 2021, and Microsoft 365 Apps for Enterprise

[Impact] Successful exploitation allows an attacker to execute arbitrary code with the privileges of the active user by tricking them into opening a specially crafted Project (.mpp) file

[Mitigation] Apply the official Microsoft security updates immediately and enforce strict policies to block untrusted macro and external content execution

[Affected Scope] Windows 10, 11, and Windows Server 2008 through 2022 environments

[Impact] A local attacker with low privileges can exploit a race condition to execute arbitrary code with SYSTEM privileges, leading to complete system compromise

[Mitigation] Immediately apply the Microsoft August 2024 security updates and restrict local access on unpatched systems

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 9.0 and 10.0 utilizing the classic webmail user interface.

[Impact] Successful exploitation allows remote attackers to execute arbitrary JavaScript code in the context of the victim's browser session, potentially leading to session hijacking and unauthorized data access.

[Mitigation] Apply official security patches (9.0.0 Patch 39, 10.0.7 or higher) immediately, or restrict access to the classic UI.

[Affected Scope] Roundcube Webmail versions through 1.5.7 and 1.6.x through 1.6.7

[Impact] A remote attacker can execute malicious scripts in the victim's browser session by sending a crafted email, enabling unauthorized access, theft, and transmission of the victim's emails.

[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions (1.5.8, 1.6.8, or later).

[Affected Scope] Acronis Cyber Infrastructure (ACI) versions prior to 5.0.1-61, 5.1.1-71, 5.2.1-69, 5.3.1-53, and 5.4.4-132

[Impact] Unauthenticated remote attackers can exploit default credentials to execute arbitrary commands and gain full control over the infrastructure

[Mitigation] Immediately upgrade to the patched versions (5.0.1-61, 5.1.1-71, 5.2.1-69, 5.3.1-53, 5.4.4-132 or later)

[Affected Scope] ServiceNow Now Platform Washington DC, Vancouver, and earlier releases

[Impact] An unauthenticated remote attacker can execute arbitrary code within the context of the Now Platform due to improper input validation

[Mitigation] Apply the official security patches and hotfixes released during the June 2024 patching cycle immediately

[Affected Scope] ServiceNow Now Platform Vancouver and Washington DC releases

[Impact] Unauthenticated remote attackers can execute arbitrary code within the context of the Now Platform, potentially leading to full system compromise

[Mitigation] Apply official security patches and hotfixes immediately, and restrict external access for self-hosted instances while monitoring for IoCs

[Affected Scope] End-of-Life (EOL) GeoVision devices including GV-VS12, GV-VS11, and GV-DSP LPR V3

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges, potentially leading to full device takeover and integration into IoT botnets like Mirai

[Mitigation] Since these devices are EOL and no official patches are available, immediately isolate the affected devices from the internet or replace them with supported models

[Affected Scope] Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier

[Impact] Unauthenticated remote attackers can exploit this vulnerability to read arbitrary files and potentially achieve Remote Code Execution (RCE)

[Mitigation] Apply the official Adobe security patches (APSB24-40) or upgrade to the latest secure releases immediately