CVE Vulnerability Advisory Database

[Affected Scope] Most supported Windows 10, 11, and Windows Server 2016, 2019, 2022 operating system kernel environments.

[Impact] A local attacker with low privileges can exploit an untrusted pointer dereference (CWE-822) to execute arbitrary code with SYSTEM privileges.

[Mitigation] Immediately apply the latest Windows Cumulative Updates (June 2024 or later) and monitor for Indicators of Compromise (IoCs).

[Affected Scope] Linux kernel versions utilizing the network subsystem, particularly environments running UDP socket-based applications

[Impact] Local attackers can exploit an RCU synchronization race condition to trigger a Use-After-Free (UAF), potentially leading to local privilege escalation (LPE) to root or system-wide Denial of Service (DoS)

[Mitigation] Immediately upgrade the Linux kernel to the latest patched stable release and perform a system reboot

[Affected Scope] Ivanti Endpoint Manager (EPM) 2022 SU5 and prior (Core Server component)

[Impact] Unauthenticated attackers within the same network can exploit an SQL injection vulnerability to execute arbitrary code with SYSTEM privileges

[Mitigation] Immediately apply the official security patch (EPM 2022 SU6 or later) and restrict network access to the Core Server

[Affected Scope] Windows client and server operating systems utilizing the Windows MSHTML platform

[Impact] Attackers can bypass security warnings and protection mechanisms to execute remote code via malicious files loading OLE objects with user interaction

[Mitigation] Immediately apply the official Microsoft cumulative security updates and restrict execution of untrusted files and email attachments

[Affected Scope] Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software

[Impact] An authenticated, local attacker with administrator privileges can execute arbitrary code with root-level privileges and establish persistence across device reboots by preloading crafted files

[Mitigation] Apply the official security updates provided by Cisco immediately and audit the flash file system for unauthorized files

[Affected Scope] Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software with management or VPN web server enabled.

[Impact] An unauthenticated, remote attacker can trigger an unexpected device reload by sending a crafted HTTP request, leading to a complete Denial of Service (DoS) condition.

[Mitigation] Apply official Cisco software patches immediately. Restrict access to management interfaces and monitor VPN ports for anomalous HTTP headers as temporary workarounds.

[Affected Scope] Systems running affected versions of Microsoft .NET Framework and .NET Core, particularly within IIS or web application server environments.

[Impact] Unauthenticated remote attackers can trigger specific exceptions to obtain sensitive debugging information, including internal system paths and memory states.

[Mitigation] Apply the official Microsoft cumulative security updates immediately and disable detailed error messages in the web.config configuration.

[Affected Scope] Progress Kemp LoadMaster OS (LMOS) versions prior to 7.2.48.10, 7.2.54.8, and 7.2.59.2

[Impact] Unauthenticated remote attackers can access the system via the management interface to execute arbitrary OS commands and gain full system control

[Mitigation] Immediately upgrade to patched LMOS versions (7.2.59.2, 7.2.54.8, 7.2.48.10 or higher) and restrict external access to the management interface

[Affected Scope] On-premise deployments of ConnectWise ScreenConnect version 23.9.7 and prior

[Impact] Attackers can exploit a path traversal vulnerability to escape restricted directories, upload malicious files, and achieve arbitrary remote code execution (RCE)

[Mitigation] Immediately upgrade ConnectWise ScreenConnect to the patched version (23.9.8 or higher)

[Affected Scope] Citrix NetScaler ADC and NetScaler Gateway appliances running vulnerable firmware versions

[Impact] Unauthenticated remote attackers can trigger a Denial of Service (DoS) state or perform Out-Of-Bounds Memory Reads to access sensitive data

[Mitigation] Immediately upgrade to the latest patched firmware versions recommended by Citrix and restrict external access

[Affected Scope] Citrix NetScaler ADC and NetScaler Gateway appliances with management interfaces (NSIP, CLIP, or SNIP) exposed and possessing authenticated (low-privileged) credentials

[Impact] Authenticated attackers can perform remote code execution (RCE) on the management interface, potentially leading to full system compromise

[Mitigation] Immediately apply the official security patches provided by Citrix and restrict access to management interfaces (NSIP, CLIP, SNIP)

[Affected Scope] Older versions of Atlassian Confluence Data Center and Server (8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x, 8.5.0-8.5.3)

[Impact] Unauthenticated remote attackers can execute arbitrary system commands (RCE) on the affected instance by sending specially crafted HTTP requests.

[Mitigation] Immediately upgrade to the latest patched versions (8.5.4+ or newer LTS releases) provided by Atlassian.

[Affected Scope] Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) gateway appliances

[Impact] An authenticated administrator can send specially crafted HTTP requests to execute arbitrary OS commands with root privileges, leading to full appliance compromise

[Mitigation] Apply the official vendor security patches immediately, or import the temporary mitigation XML file provided by Ivanti to block vulnerable API endpoints

[Affected Scope] GitLab CE/EE versions 16.1 to 16.7.1 (prior to 16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4, and 16.7.2)

[Impact] An unauthenticated remote attacker can trigger password reset emails to be sent to an arbitrary, unverified email address, leading to complete account takeover.

[Mitigation] Immediately upgrade GitLab instances to the patched versions (16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4, 16.7.2 or later) and enforce Multi-Factor Authentication (MFA).

[Affected Scope] Legacy QNAP VioStor NVR models running QVR Firmware 4.x

[Impact] Authenticated attackers can execute arbitrary OS commands via network requests, potentially leading to full system compromise

[Mitigation] Immediately upgrade QVR Firmware to version 5.0.0 or later, or restrict network access to the device

[Affected Scope] SonicWall SMA100 series (SMA 200, 210, 400, 410, 500v) running firmware versions 10.2.1.11-63sv and below.

[Impact] A remote authenticated attacker with administrative privileges can inject arbitrary OS commands via the management interface, executing them with 'nobody' user privileges.

[Mitigation] Immediately upgrade the SMA100 firmware to the patched version (10.2.1.12-65sv or higher) and restrict access to the management interface.

[Affected Scope] Microsoft Windows operating systems utilizing the CLFS driver, including Windows 10, 11, and Windows Server 2016, 2019, 2022

[Impact] A locally authenticated attacker can execute a specially crafted application to elevate privileges to NT AUTHORITY\SYSTEM, gaining full control over the system

[Mitigation] Immediately apply the latest cumulative security updates provided by Microsoft and monitor unpatched assets

[Affected Scope] Windows 10, 11, and Windows Server operating systems utilizing the Cloud Files Mini Filter Driver (cldflt.sys)

[Impact] Local attackers can exploit this vulnerability to execute arbitrary code in kernel mode, achieving full SYSTEM privileges (actively exploited in the wild)

[Mitigation] Apply the latest Microsoft cumulative security updates immediately, or disable the affected driver service as a temporary workaround

[Affected Scope] Cisco IOS XE Software with the Web UI feature enabled and exposed to the internet

[Impact] Unauthenticated remote attackers can bypass authentication to create a local user with Privilege 15 access, subsequently elevating to root to install a persistent malicious implant

[Mitigation] Immediately disable the Web UI (HTTP/HTTPS Server) feature or restrict access to trusted management networks, and upgrade to the recommended fixed software releases

[Affected Scope] Progress WS_FTP Server versions prior to 8.7.4 and 8.8.2 with Ad Hoc Transfer module enabled

[Impact] A pre-authenticated remote attacker can execute arbitrary OS commands with IIS worker process privileges by sending a crafted .NET serialized payload

[Mitigation] Immediately upgrade to patched versions (8.7.4, 8.8.2, or higher) or disable/remove the Ad Hoc Transfer module