CVE Vulnerability Advisory Database

[Affected Scope] Juniper Networks Junos OS on SRX Series devices with the J-Web interface enabled in specific vulnerable versions

[Impact] Unauthenticated network-based attackers can send crafted requests to webauth_operation.php to upload or download arbitrary files, compromising file system integrity and potentially chaining to remote code execution (RCE)

[Mitigation] Immediately upgrade Junos OS to the recommended patched release, or disable the J-Web interface / restrict access to trusted IP addresses

[Affected Scope] Apple devices running iOS versions prior to 16.7, iPadOS versions prior to 16.7, and macOS Ventura versions prior to 13.6

[Impact] A malicious application can bypass signature and certificate validation, allowing it to execute with elevated privileges and compromise the system. This has been actively exploited in the wild

[Mitigation] Immediately update all affected devices to iOS/iPadOS 16.7 or later, and macOS Ventura 13.6 or later

[Affected Scope] Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier), and 2023u2 (and earlier)

[Impact] Unauthenticated remote attackers can bypass security filters to access administrative CFM and CFC endpoints, potentially leading to remote code execution (RCE)

[Mitigation] Immediately apply the official Adobe security patch (APSB23-47) and restrict external access to ColdFusion administrator consoles

[Affected Scope] Adobe Acrobat and Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier), and 20.005.30514 (and earlier)

[Impact] Successful exploitation allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious PDF file

[Mitigation] Immediately apply the official security patches provided by Adobe and restrict opening untrusted PDF documents

[Affected Scope] Remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software.

[Impact] Improper AAA separation allows unauthenticated remote attackers to conduct brute-force attacks to identify valid credentials or establish unauthorized clientless SSL VPN sessions.

[Mitigation] Apply official software updates from Cisco, or implement workarounds by redirecting default connection profile authentication to a loopback address and enforcing MFA.

[Affected Scope] Qlik Sense Enterprise for Windows (May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier)

[Impact] An unauthenticated remote attacker can exploit a path traversal vulnerability to generate an anonymous session and transmit unauthorized HTTP requests to internal endpoints

[Mitigation] Immediately upgrade to the official patched versions (August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, or August 2022 Patch 13 and later)

[Affected Scope] All Windows endpoint environments running RARLAB WinRAR versions prior to 6.23.

[Impact] Attackers can execute arbitrary code in the background when a user attempts to open a seemingly benign file within a crafted ZIP archive, leading to full system compromise.

[Mitigation] Immediately upgrade WinRAR to version 6.23 or higher, and restrict execution of untrusted archive files.

[Affected Scope] Ivanti MobileIron Sentry versions 9.18.0 and below with MICS (Mobile IT Connector System) Admin Portal enabled

[Impact] Unauthenticated attackers can bypass authentication controls on the administrative interface, leading to remote code execution (RCE) and full system compromise

[Mitigation] Immediately apply the official vendor patches and restrict external access to the MICS administrative port (default TCP 8443)

[Affected Scope] Ivanti EPMM (Endpoint Manager Mobile) 11.10 and older, and MobileIron Core 11.2 and older

[Impact] Unauthenticated remote attackers can bypass authentication to access restricted API endpoints, compromise sensitive data, or execute arbitrary commands

[Mitigation] Immediately upgrade to the latest supported release and restrict external access to administrative API endpoints

[Affected Scope] Ivanti EPMM versions 11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2, and 11.8.x < 11.8.1.2

[Impact] An authenticated administrator can write arbitrary files to the appliance via path traversal, potentially leading to Remote Code Execution (RCE)

[Mitigation] Immediately apply the official security patches provided by the vendor and restrict external access to the admin portal

[Affected Scope] Apple iOS before 16.6, iPadOS before 16.6, macOS Ventura before 13.5, Safari before 16.5.2, tvOS before 16.6, and watchOS before 9.6

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution (RCE) within the sandbox context, and this vulnerability has been actively exploited in the wild

[Mitigation] Immediately apply the official software updates provided by Apple to patch the operating systems and Safari browser

[Affected Scope] Ivanti Endpoint Manager Mobile (EPMM, formerly MobileIron Core) versions 11.4, 11.10, 11.11, and all older/supported releases

[Impact] Unauthenticated remote attackers can bypass authentication to access restricted API endpoints, allowing them to harvest sensitive personally identifiable information (PII) or create unauthorized administrative accounts

[Mitigation] Immediately apply the official security patches or upgrade to Ivanti EPMM version 11.12 or higher, and restrict external access to administrative interfaces

[Affected Scope] Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier), and 2023u1 (and earlier)

[Impact] Unauthenticated remote attackers can exploit a Deserialization of Untrusted Data vulnerability (CWE-502) to execute arbitrary code with system privileges

[Mitigation] Immediately apply the official Adobe security patches (APSB23-41), restrict external access, and enable WAF rules

[Affected Scope] Citrix NetScaler ADC and NetScaler Gateway appliances configured as a SAML SP or SAML IdP

[Impact] Unauthenticated remote attackers can execute arbitrary code with elevated privileges on the appliance, leading to full system compromise

[Mitigation] Immediately apply the official security patches provided by Citrix and run compromise assessment scripts to detect potential Indicators of Compromise (IoCs)

[Affected Scope] Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier), and 2023.0.0.330468 (and earlier)

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending malicious serialized data

[Mitigation] Immediately apply the official Adobe security patch (APSB23-40) and restrict external access to serialization endpoints

[Affected Scope] All supported versions of Windows Operating Systems, including Windows 10, Windows 11, and Windows Server

[Impact] Attackers can bypass the Windows SmartScreen warning dialog when executing downloaded malicious files, leading to immediate code execution without user consent

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and restrict execution of untrusted files

[Affected Scope] Windows client and server operating systems utilizing the MSHTML platform

[Impact] Attackers can bypass security boundaries (including AppContainer restrictions) and execute arbitrary code with the privileges of the logged-in user by tricking them into opening crafted files

[Mitigation] Apply the official Microsoft cumulative security updates immediately and restrict opening untrusted email attachments or web links

[Affected Scope] Zimbra Collaboration Suite (ZCS) version 8.8.15

[Impact] A remote authenticated attacker can execute arbitrary code and hijack sessions by injecting malicious scripts into the '/h/autoSaveDraft' function

[Mitigation] Immediately apply the official Zimbra security patches and restrict access to the affected endpoint using WAF rules

[Affected Scope] Barracuda Email Security Gateway (appliance form factor only) versions 5.1.3.001 through 9.2.0.006

[Impact] A remote attacker can execute arbitrary system commands with the privileges of the ESG product by sending a specially crafted .tar archive, leading to complete system compromise

[Mitigation] Verify the automatic application of patch BNSF-36456, perform a thorough compromise assessment (IoC search), and immediately replace compromised appliances

[Affected Scope] Microsoft Windows operating systems including Windows 10, Windows 11, and Windows Server 2016/2019/2022 utilizing the Win32k kernel driver.

[Impact] A local attacker can exploit a Use-After-Free (UAF) vulnerability to corrupt kernel memory, leading to arbitrary code execution with SYSTEM privileges.

[Mitigation] Immediately apply the official Microsoft Cumulative Updates (LCU) and enhance monitoring for Indicators of Compromise (IoCs).