CVE Vulnerability Advisory Database

[Affected Scope] Vulnerable versions of the JCE (Joomla Content Editor) extension for Joomla CMS

[Impact] Unauthenticated remote attackers can create unauthorized editor profiles, bypass file upload restrictions, and upload malicious PHP scripts to achieve full Remote Code Execution (RCE)

[Mitigation] Immediately upgrade JCE to the latest patched version and deploy Web Application Firewall (WAF) rules to block unauthorized profile modification requests

[Affected Scope] Trend Micro Apex One (on-premise) management console

[Impact] A pre-authenticated remote attacker can upload malicious code and execute arbitrary commands with system privileges, leading to full server compromise

[Mitigation] Immediately apply the official security patch (KA-0020652) and restrict network access to the management console

[Affected Scope] Advantive VeraCore solutions prior to version 2024.4.2.1

[Impact] Remote authenticated attackers can upload malicious files to unintended web-accessible directories via upload.aspx, leading to arbitrary code execution

[Mitigation] Immediately upgrade VeraCore to version 2024.4.2.1 or later, and restrict execution permissions on upload directories

[Affected Scope] Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.11, specifically the Upload component of Web Applications Desktop Integrator.

[Impact] Unauthenticated remote attackers can exploit this vulnerability via HTTP to upload arbitrary files and achieve full system takeover (RCE).

[Mitigation] Immediately apply the official Oracle Critical Patch Update (CPU) patches and restrict external access to vulnerable endpoints.

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 8.8.15 and 9.0

[Impact] An authenticated administrator can upload a malicious ZIP archive to write arbitrary files, leading to Remote Code Execution (RCE)

[Mitigation] Immediately apply the official Zimbra security patches (9.0.0 Patch 24 / 8.8.15 Patch 31 or later)