CVE Vulnerability Advisory Database

[Affected Scope] Specific API endpoints of Cisco Identity Services Engine (ISE) and Cisco ISE-PIC

[Impact] An unauthenticated, remote attacker can execute arbitrary code with root privileges on the underlying operating system

[Mitigation] Immediately apply the official security patches provided by Cisco and restrict access to the API ports from untrusted networks

[Affected Scope] Specific API endpoints of Cisco Identity Services Engine (ISE) and Cisco ISE-PIC

[Impact] An unauthenticated, remote attacker can execute arbitrary code with root privileges on the underlying operating system by sending a crafted API request

[Mitigation] Immediately apply the official security patches provided by Cisco and restrict access to the management API ports

[Affected Scope] Older versions of Atlassian Confluence Data Center and Server (8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x, 8.5.0-8.5.3)

[Impact] Unauthenticated remote attackers can execute arbitrary system commands (RCE) on the affected instance by sending specially crafted HTTP requests.

[Mitigation] Immediately upgrade to the latest patched versions (8.5.4+ or newer LTS releases) provided by Atlassian.

[Affected Scope] Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x

[Impact] Remote attackers can inject malicious Spring templates via specific web services, leading to Server-Side Template Injection (SSTI) and arbitrary code execution.

[Mitigation] Immediately upgrade affected Pentaho instances to patched versions (9.4.0.1, 9.3.0.2 or higher) and restrict external access.

[Affected Scope] Cacti versions 1.2.x up to 1.2.22, and 1.3.x development branches

[Impact] Unauthenticated remote attackers can bypass authentication via HTTP header manipulation and execute arbitrary OS commands with the privileges of the web server

[Mitigation] Immediately upgrade Cacti to version 1.2.23 or later, and restrict access to the monitoring interface

[Affected Scope] GLPI versions up to and including 10.0.2, specifically within the bundled htmLawed module

[Impact] Unauthenticated remote attackers can inject and execute arbitrary PHP code, leading to full system compromise

[Mitigation] Immediately upgrade GLPI to version 10.0.3 or higher, or delete the vulnerable test script (htmLawedTest.php)

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 8.8.15 and 9.0.

[Impact] Unauthenticated remote attackers can inject arbitrary Memcached commands, leading to cache poisoning, session hijacking, and credential theft.

[Mitigation] Immediately apply the official Zimbra security patches (9.0.0 Patch 24 / 8.8.15 Patch 31 or higher).

[Affected Scope] vBulletin versions 5.5.4 through 5.6.2

[Impact] Unauthenticated remote attackers can execute arbitrary PHP code and system commands on the target server via crafted HTTP requests

[Mitigation] Apply the official security patches immediately or restrict access to the vulnerable PHP template rendering module

[Affected Scope] Trend Micro Apex One (2019), OfficeScan XG, and Worry-Free Business Security (9.0, 9.5, 10.0) agents

[Impact] Authenticated attackers can bypass content validation to manipulate agent client components, potentially leading to arbitrary code execution

[Mitigation] Apply official critical patches and hotfixes immediately and enforce automatic agent updates via the management console

[Affected Scope] Apache Solr versions 5.0.0 through 8.3.1

[Impact] Remote attackers can modify Solr configurations via the Config API to enable the Velocity template loader and execute arbitrary system commands on the host

[Mitigation] Upgrade to Apache Solr 8.4.0 or later, or disable the 'params.resource.loader.enabled' setting and restrict access to the Config API

[Affected Scope] Jira Server and Data Center versions from 4.4.0 before 7.6.14, 7.7.0 before 7.13.5, 8.0.0 before 8.0.3, 8.1.0 before 8.1.2, and 8.2.0 before 8.2.3

[Impact] Unauthenticated remote attackers can exploit the email template rendering logic to execute arbitrary system commands, leading to full system compromise

[Mitigation] Immediately upgrade Jira Server and Data Center to the patched versions (7.6.14, 7.13.5, 8.0.3, 8.1.2, 8.2.3 or later)

[Affected Scope] Oracle WebLogic Server versions 10.3.6.0.0 and 12.1.3.0.0

[Impact] Unauthenticated remote attackers can gain full control of the WebLogic Server and execute arbitrary system commands via malicious HTTP requests

[Mitigation] Apply the official Oracle security patches immediately, or disable/remove the unused wls9-async and wls-wsat components

[Affected Scope] Embedthis GoAhead versions prior to 3.6.5, when CGI is enabled and CGI programs are dynamically linked

[Impact] Unauthenticated remote attackers can inject environment variables such as LD_PRELOAD via HTTP request parameters, executing malicious shared object (.so) payloads sent in the request body to gain full system control

[Mitigation] Immediately upgrade GoAhead to version 3.6.5 or later, or disable CGI services and deploy WAF rules to block malicious query parameters

[Affected Scope] Apache Struts framework versions 2.0.0 through 2.3.15

[Impact] Remote attackers can execute arbitrary OGNL expressions via crafted 'action:', 'redirect:', or 'redirectAction:' parameter prefixes, leading to full system compromise

[Mitigation] Immediately upgrade Apache Struts to version 2.3.15.1 or higher, or implement strict WAF rules to block vulnerable parameter prefixes