CVE Vulnerability Advisory Database

[Affected Scope] Acronis Backup plugins for Linux-based hosting panels (cPanel, Plesk, DirectAdmin) prior to specific builds.

[Impact] Local attackers can exploit insecure file permissions to gain root-level privileges on the host server, leading to full system compromise.

[Mitigation] Immediate update to the latest plugin versions (cPanel 1.9.3.1021+, Plesk 1.8.11.638+, DirectAdmin 1.2.3.238+).

[Affected Scope] Unpatched VMware vCenter Server versions 6.5, 6.7, and 7.0

[Impact] A malicious actor with non-administrative or local access can read sensitive configuration files and credentials, potentially leading to full infrastructure compromise

[Mitigation] Apply official VMware security patches (VMSA-2022-0009) immediately, or restrict file permissions on sensitive configuration files as a temporary workaround

[Affected Scope] Windows 10 version 1809 and later, and Windows Server 2019 and later

[Impact] Local users can read sensitive registry hives (SAM, SYSTEM, SECURITY) via Volume Shadow Copies, leading to full SYSTEM privilege escalation and credential theft

[Mitigation] Apply the official security update, then manually delete all existing Volume Shadow Copies (VSS) and create new ones to fully mitigate the risk

[Affected Scope] Adobe ColdFusion versions 9.0, 9.0.1, 9.0.2, and 10

[Impact] Remote attackers can bypass authentication using a default empty password on the RDS component, hijack the session to access the administrator interface, and execute arbitrary code

[Mitigation] Apply the official APSB13-03 security patch, disable the RDS component, or enforce strong passwords