CVE Vulnerability Advisory Database

[Affected Scope] Microsoft SharePoint Server 2016, 2019, and Subscription Edition.

[Impact] Authorized attackers can execute arbitrary code over the network, leading to full server compromise.

[Mitigation] Apply official Microsoft security updates immediately and monitor for unauthorized web shell activity.

[Affected Scope] SonicWall SMA1000 appliances utilizing the Appliance Management Console (AMC)

[Impact] An authenticated remote attacker with administrative privileges can execute arbitrary OS commands under specific conditions, potentially leading to full system compromise

[Mitigation] Immediately apply the latest firmware patches provided by SonicWall and restrict external access to the management console

[Affected Scope] Ivanti Endpoint Manager Mobile (EPMM) affected versions

[Impact] Unauthenticated attackers can execute arbitrary code remotely, potentially leading to full system compromise

[Mitigation] Apply the official security patches immediately and restrict access to exposed management interfaces

[Affected Scope] Ivanti Endpoint Manager Mobile (EPMM)

[Impact] Unauthenticated remote attackers can inject and execute arbitrary code, leading to full system compromise

[Mitigation] Apply the official security patches immediately and restrict access to the management interfaces

[Affected Scope] Sitecore Experience Manager (XM) and Experience Platform (XP) versions up to and including 9.0

[Impact] Unauthenticated remote attackers can execute arbitrary code and fully compromise the host system via deserialization of untrusted data

[Mitigation] Immediately apply the official security patches from the vendor, or implement temporary workarounds such as enforcing ViewState encryption and restricting access

[Affected Scope] On-premises Microsoft SharePoint Server 2016, 2019, and Subscription Edition

[Impact] An authorized attacker can inject and execute arbitrary code over the network, leading to complete system compromise

[Mitigation] Immediately apply the official Microsoft security patches and restrict network access to SharePoint management endpoints

[Affected Scope] Langflow versions prior to 1.3.0

[Impact] A remote, unauthenticated attacker can execute arbitrary Python code and fully compromise the host system by sending crafted HTTP requests.

[Mitigation] Immediately upgrade Langflow to version 1.3.0 or later, and restrict external access to the vulnerable endpoint.

[Affected Scope] Junos OS versions prior to 21.2R3-S9, 21.4R3-S10, 22.2R3-S6, 22.4R3-S6, 23.2R2-S3, 23.4R2-S4, and 24.2R1-S2/24.2R2

[Impact] A highly privileged local attacker with shell access can inject arbitrary code to compromise the integrity of the device

[Mitigation] Immediately upgrade to the recommended patched Junos OS releases and restrict local shell access to authorized administrators only

[Affected Scope] Citrix NetScaler ADC and NetScaler Gateway appliances with management interfaces (NSIP, CLIP, or SNIP) exposed and possessing authenticated (low-privileged) credentials

[Impact] Authenticated attackers can perform remote code execution (RCE) on the management interface, potentially leading to full system compromise

[Mitigation] Immediately apply the official security patches provided by Citrix and restrict access to management interfaces (NSIP, CLIP, SNIP)

[Affected Scope] All on-premises and cloud web application servers running Novi Survey versions prior to 8.9.43676.

[Impact] Unauthenticated remote attackers can execute arbitrary system commands and malicious code under the security context of the web service account.

[Mitigation] Immediately upgrade to the official patched version (8.9.43676 or higher) and restrict external access to the application.

[Affected Scope] Mitel MiVoice Connect 19.3 (version 22.22.6100.0 and prior)

[Impact] Authenticated attackers can execute arbitrary code via crafted database inputs, potentially leading to full system compromise

[Mitigation] Apply the official security patches provided in Mitel Advisory 22-0008 immediately and restrict database access

[Affected Scope] Ivanti Endpoint Manager Cloud Services Appliance (CSA) versions 4.5 and 4.6

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with limited privileges ('nobody') by sending specially crafted HTTP requests.

[Mitigation] Immediately apply the official security patches provided by Ivanti and restrict access to the CSA management interface from the public internet.