CVE Vulnerability Advisory Database

[Affected Scope] GPCIDrv and GDrv drivers bundled with GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08

[Impact] Local attackers can exploit the exposed IO port read/write functionality to execute arbitrary code with kernel-level privileges (SYSTEM) and bypass security controls

[Mitigation] Update the affected GIGABYTE utilities to their latest secure versions, or block and remove the vulnerable drivers using Windows Defender Application Control (WDAC)

[Affected Scope] Red Hat JBoss Enterprise Application Platform (JBoss EAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08.

[Impact] Remote attackers can bypass authentication and access sensitive administrative information within the Web Console by utilizing non-standard HTTP methods (such as HEAD or PUT).

[Mitigation] Apply the official Cumulative Patch (CP) or modify the web.xml configuration to enforce authentication across all HTTP methods.

[Affected Scope] Red Hat JBoss Enterprise Application Platform (JBoss EAP) 4.2 (prior to 4.2.0.CP09) and 4.3 (prior to 4.3.0.CP08).

[Impact] Remote attackers can bypass authentication on the JMX-Console by utilizing non-standard HTTP methods (such as HEAD), allowing unauthorized administrative actions.

[Mitigation] Apply the official Cumulative Patch (CP), or modify the web.xml configuration to enforce authentication across all HTTP methods.

[Affected Scope] Apache Struts versions prior to 1.2.9 deployed with Commons BeanUtils 1.7

[Impact] Remote attackers can trigger a Denial of Service (DoS) state by exhausting server resources via specially crafted multipart/form-data requests

[Mitigation] Upgrade Apache Struts to version 1.2.9 or higher, or implement input validation filters to block malicious parameter names