CVE Vulnerability Advisory Database

[Affected Scope] Developers running Ray AI compute engine versions prior to 2.52.0 in local or development environments

[Impact] Remote Code Execution (RCE) on the developer's machine via DNS rebinding and browser-based request forgery when visiting malicious websites or viewing malvertisements

[Mitigation] Immediately upgrade the Ray package to version 2.52.0 or higher

[Affected Scope] PaperCut NG and MF systems with an active administrator login session.

[Impact] Attackers can trick administrators into clicking malicious links, leading to unauthorized security setting modifications and arbitrary code execution.

[Mitigation] Apply the official vendor security patches immediately and restrict external access to the admin interface.

[Affected Scope] Sumavision Enhanced Multimedia Router (EMR) version 3.0.4.27 and potentially prior firmware versions.

[Impact] Unauthenticated remote attackers can create arbitrary accounts with administrative privileges via CSRF or direct HTTP requests, leading to complete device compromise.

[Mitigation] Restrict external access to the web management interface, deploy WAF rules to block malicious parameter patterns, and apply the latest secure firmware from the vendor.

[Affected Scope] Multiple NETGEAR router models including R6250, R6400, R6700, R6900, R7000, R7100LG, R7300DST, R7900, R8000, D6220, D6400, and D7000

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by injecting shell metacharacters into the cgi-bin path info

[Mitigation] Apply the latest official firmware patches provided by the vendor, or temporarily disable the web server as a workaround

[Affected Scope] D-Link DIR-600 router (hardware revision Bx) with firmware versions prior to 2.17b02.

[Impact] Remote attackers can hijack administrator sessions to create unauthorized admin accounts, enable remote management, apply malicious configurations, or trigger arbitrary ping requests.

[Mitigation] Upgrade to firmware version 2.17b02 or later, disable remote management, and restrict access to the administration interface.

[Affected Scope] Cisco 871 Integrated Services Routers (ISR) running Cisco IOS 12.4 with the HTTP Administration component enabled.

[Impact] Remote attackers can execute arbitrary commands with privilege level 15 by tricking an authenticated administrator into visiting a malicious link, leading to complete device compromise.

[Mitigation] Disable the HTTP/HTTPS server on the router, restrict access using IP-based Access Control Lists (ACLs), or upgrade to a patched Cisco IOS release.