CVE Vulnerability Advisory Database

[Affected Scope] Cisco Catalyst SD-WAN Manager releases prior to 20.18

[Impact] Unauthenticated, remote attackers can retrieve the DCA password file via crafted HTTP requests and gain unauthorized DCA user privileges

[Mitigation] Immediately upgrade Cisco Catalyst SD-WAN Manager to release 20.18 or later

[Affected Scope] TeleMessage services and associated JSP applications through 2025-05-05

[Impact] Local attackers can extract plaintext passwords and sensitive credentials previously transmitted over HTTP by analyzing memory heap dumps

[Mitigation] Apply the latest security patches, restrict access to heap dump files, and optimize JVM garbage collection to prevent sensitive data from persisting in memory

[Affected Scope] All deployments of Veeam Backup & Replication versions 11 and 12 (prior to patched builds).

[Impact] Unauthenticated remote attackers can obtain encrypted credentials stored in the configuration database, potentially gaining full access to backup infrastructure hosts.

[Mitigation] Apply the official security patches immediately, or restrict access to the Veeam Backup Service port (TCP 9401) using firewall rules.

[Affected Scope] D-Link DIR-300 wireless router devices

[Impact] Adjacent or context-dependent attackers can retrieve plaintext administrator credentials stored on the device, leading to complete compromise of the router

[Mitigation] Since this is a legacy End-of-Life (EoL) device, immediately replace it with a modern supported router, or restrict administrative access to the absolute minimum