CVE Vulnerability Advisory Database

[Affected Scope] JFrog Artifactory Self-Hosted versions prior to 7.133.11

[Impact] Low-privileged users can escalate to administrative privileges by exploiting insufficient token scope validation, leading to full system compromise

[Mitigation] Immediately upgrade to version 7.133.11 or later and conduct a comprehensive audit of all existing access tokens

[Affected Scope] Triofox versions prior to 16.7.10368.56560

[Impact] Unauthenticated remote attackers can access initial setup pages even after installation is complete, potentially leading to full administrative takeover.

[Mitigation] Immediately upgrade Triofox to version 16.7.10368.56560 or later.

[Affected Scope] Microsoft Partner Center Portal (Partner.Microsoft.com) services and associated API endpoints

[Impact] An unauthenticated remote attacker can elevate privileges over the network, potentially gaining administrative control over partner accounts and sensitive tenant data

[Mitigation] As this is a cloud-hosted service, Microsoft has applied server-side mitigations; however, organizations must immediately audit Partner Center API integrations, permissions, and admin logs

[Affected Scope] Apache OFBiz versions prior to 18.12.16

[Impact] Unauthenticated remote attackers can bypass authorization checks to access internal business logic and sensitive data directly, potentially leading to Remote Code Execution (RCE).

[Mitigation] Immediately upgrade Apache OFBiz to the official patched version 18.12.16 or higher.

[Affected Scope] On-premise deployments of Atlassian Confluence Data Center and Confluence Server (Atlassian Cloud instances are not affected)

[Impact] Unauthenticated remote attackers can bypass access controls to access setup endpoints, create unauthorized administrator accounts, and achieve full system compromise

[Mitigation] Immediately upgrade to the patched official versions, or restrict external access to the vulnerable /setup/* endpoints if patching cannot be applied immediately

[Affected Scope] All Strapi deployments running version 4.5.5 or earlier.

[Impact] Authenticated attackers with admin panel access can leak sensitive user data, including password hashes and reset tokens, via side-channel inference.

[Mitigation] Immediately upgrade Strapi to version 4.6.0 or later.

[Affected Scope] Veeam Backup & Replication versions 10.x and 11.x

[Impact] Unauthenticated remote attackers can execute arbitrary code with SYSTEM privileges, leading to backup data theft and infrastructure compromise

[Mitigation] Immediately apply the official vendor patch (KB4288) or restrict access to vulnerable ports and services

[Affected Scope] Sangoma FreePBX versions 15.0.16.26 and below, 14.0.13.11 and below, and 13.0.197.13 and below

[Impact] Remote attackers can bypass authentication entirely to gain full administrative access, leading to complete system compromise and unauthorized call routing

[Mitigation] Immediately upgrade the FreePBX framework module to the patched version using the fwconsole utility

[Affected Scope] Hikvision DS-2CD2xx2F-I, DS-2CD2xx0F-I, DS-2CD2xx2FWD, DS-2CD4x2xFWD, DS-2CD4xx5, DS-2DFx, and DS-2CD63xx series IP camera devices

[Impact] Unauthenticated remote attackers can bypass authentication mechanisms via crafted HTTP requests to escalate privileges and gain unauthorized access to sensitive system configuration and credentials

[Mitigation] Immediately upgrade device firmware to the latest patched version and restrict access to the camera management interface from the public internet

[Affected Scope] Jenkins weekly versions prior to 1.638 and LTS versions prior to 1.625.2

[Impact] Unauthenticated remote attackers can obtain sensitive job and build name information via direct HTTP requests to fingerprint pages.

[Mitigation] Immediately upgrade Jenkins to LTS 1.625.2+ or weekly 1.638+, and restrict unauthorized access to the fingerprint endpoints.