CVE Vulnerability Advisory Database

[Affected Scope] Zammad installations using DEB or RPM packages built via packager.io (Source and Docker excluded).

[Impact] A local attacker with 'zammad' service account access can escalate to full 'root' privileges on the host.

[Mitigation] Immediately update Zammad to the latest patched version via package manager.

[Affected Scope] ConnectWise ScreenConnect client software (Servers are not impacted)

[Impact] Attackers can exploit active remote sessions to transfer and execute malicious files without host confirmation, leading to full system compromise.

[Mitigation] Immediately update all ScreenConnect clients to the latest patched version and enforce session consent policies.

[Affected Scope] Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, specifically the Oracle Payments (File Transmission) component

[Impact] Unauthenticated remote attackers can bypass authentication via HTTP, leading to complete takeover of the Oracle Payments module

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately, and restrict external HTTP access to the Payments module until patched

[Affected Scope] Windows operating systems running Windows Remote Desktop services

[Impact] An authorized local attacker can elevate privileges to SYSTEM level, gaining full control over the target system

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and enforce Network Level Authentication (NLA)

[Affected Scope] Microsoft Partner Center Portal (Partner.Microsoft.com) services and associated API endpoints

[Impact] An unauthenticated remote attacker can elevate privileges over the network, potentially gaining administrative control over partner accounts and sensitive tenant data

[Mitigation] As this is a cloud-hosted service, Microsoft has applied server-side mitigations; however, organizations must immediately audit Partner Center API integrations, permissions, and admin logs

[Affected Scope] Authenticated users within the same Windows Active Directory domain as the Citrix Session Recording server

[Impact] Privilege escalation to 'NetworkService' account, enabling unauthorized system control and potential lateral movement within the AD domain

[Mitigation] Immediately upgrade Citrix Session Recording components to the latest patched versions recommended by the vendor

[Affected Scope] Microsoft Windows operating systems, including Windows 10, Windows 11, and Windows Server editions

[Impact] A locally authenticated attacker can exploit flaws in the Windows Installer service to elevate privileges to NT AUTHORITY\SYSTEM and execute arbitrary code

[Mitigation] Apply the Microsoft September 2024 security updates immediately and restrict Windows Installer privileges for non-administrative users

[Affected Scope] Broad range of Windows operating systems including Windows 10, 11, and Windows Server 2008 through 2022

[Impact] Local authenticated attackers can execute arbitrary code with SYSTEM privileges, leading to complete system compromise

[Mitigation] Immediately apply Microsoft official security patches and monitor for anomalous child processes spawned by the WER service

[Affected Scope] Android OS System Framework

[Impact] Local attackers can bypass background activity launch restrictions to execute arbitrary activities without user interaction, leading to local privilege escalation

[Mitigation] Apply the Google Android September 2023 Security Patch or update to the latest vendor-provided firmware immediately

[Affected Scope] MinIO Multi-Cloud Object Storage deployments prior to RELEASE.2023-03-20T20-16-18Z

[Impact] An attacker can bypass metadata bucket name validation to upload arbitrary objects into any bucket, potentially leading to data tampering or system compromise

[Mitigation] Immediately upgrade MinIO to RELEASE.2023-03-20T20-16-18Z or later, or disable the browser Console API as a temporary workaround

[Affected Scope] Microsoft Exchange Server 2013, 2016, and 2019 on-premises environments.

[Impact] An authenticated attacker can leverage Remote PowerShell sessions to elevate privileges to SYSTEM, potentially leading to Remote Code Execution (RCE).

[Mitigation] Immediately apply the latest Cumulative Updates (CU) and Security Updates (SU) provided by Microsoft, and restrict unnecessary Remote PowerShell access.

[Affected Scope] Windows 7, 8.1, 10, 11 and Windows Server 2008, 2012, 2016, 2019, 2022 with active Print Spooler service

[Impact] Local authenticated attackers can execute arbitrary code with SYSTEM privileges, leading to complete system compromise

[Mitigation] Apply the official Microsoft cumulative security updates immediately, or disable the Print Spooler service on non-printing servers

[Affected Scope] WatchGuard Firebox and XTM appliances running Fireware OS before 12.7.2_U1, 12.x before 12.1.3_U3, and 12.2.x through 12.5.x before 12.5.7_U3

[Impact] A remote attacker with low-privileged credentials can exploit exposed management access to elevate privileges and establish a fully privileged management session

[Mitigation] Immediately upgrade Fireware OS to the patched versions and restrict management interface access from the external internet

[Affected Scope] Windows and Windows Server operating systems running the Windows Print Spooler service

[Impact] A locally authenticated attacker can exploit this vulnerability to execute arbitrary code with SYSTEM privileges, leading to complete system compromise

[Mitigation] Apply the official Microsoft cumulative security updates immediately, or disable the Print Spooler service on non-printing servers

[Affected Scope] Windows Server systems configured as Active Directory Domain Controllers (DCs).

[Impact] A standard domain user can exploit Kerberos name resolution flaws to impersonate a Domain Controller computer account, escalating privileges to Domain Admin and compromising the entire AD forest.

[Mitigation] Apply the latest Microsoft cumulative security updates to all Domain Controllers and enforce Kerberos validation hardening via registry configurations.

[Affected Scope] All Windows Server Domain Controllers (from 2008 to 2022) running Active Directory Domain Services (AD DS)

[Impact] A standard domain user can spoof a Domain Controller's computer account name, escalate privileges to Domain Admin, and achieve full domain compromise

[Mitigation] Apply the latest Microsoft cumulative security updates and ensure the KB5008380 registry settings are transitioned to Enforcement mode

[Affected Scope] Microsoft Windows operating systems utilizing the Win32k kernel driver, including Windows 10, Windows 11, and Windows Server 2016/2019/2022.

[Impact] A local authenticated attacker can execute arbitrary code in kernel mode and elevate privileges to SYSTEM by running a specially crafted application.

[Mitigation] Immediately apply the official cumulative security updates provided by Microsoft and restrict local execution privileges on unpatched systems.

[Affected Scope] Linux virtual machines and Azure service environments running Microsoft Open Management Infrastructure (OMI) versions prior to v1.6.8-1

[Impact] A local attacker with low-privileged access can elevate privileges to root, gaining full control over the target system and executing arbitrary code

[Mitigation] Immediately update the OMI package to the latest version (v1.6.8-1 or higher) and verify the auto-update status of associated Azure agents

[Affected Scope] Microsoft Open Management Infrastructure (OMI) versions prior to 1.6.8-1, commonly deployed in Azure Linux environments

[Impact] Local unprivileged attackers can execute arbitrary commands with root privileges, leading to full system compromise

[Mitigation] Immediately upgrade OMI to version 1.6.8-1 or higher, and restrict access to OMI-related ports

[Affected Scope] Microsoft Exchange Server 2013, 2016, and 2019 on-premises deployments

[Impact] Attackers can elevate privileges to SYSTEM, enabling remote code execution (RCE) when chained with other ProxyShell vulnerabilities

[Mitigation] Immediately apply the official Microsoft Cumulative Updates (CU) and Security Updates (SU), and restrict external access to Exchange IIS ports