CVE Vulnerability Advisory Database

[Affected Scope] MikroTik RouterOS versions 6.x and 7.x prior to security patches.

[Impact] Unauthenticated remote attackers can manipulate the trusted policy mask via specially crafted SSH usernames, leading to full privilege escalation.

[Mitigation] Immediately upgrade to versions 6.49.21, 7.23.4, or 7.24.2 and restrict SSH access to trusted source IPs.

[Affected Scope] Systems running telnetd from GNU Inetutils versions up to and including 2.7.

[Impact] Remote attackers can bypass authentication and gain complete root access to the target system by injecting '-f root' into the USER environment variable.

[Mitigation] Apply the official vendor patches immediately, or disable the telnetd service and transition to secure protocols like SSH.

[Affected Scope] Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136)

[Impact] An authenticated attacker with administrative privileges can execute arbitrary commands with system privileges via argument injection during the boot process

[Mitigation] Immediately upgrade to the patched firmware version recommended by Mitel and restrict access to the administrative interfaces

[Affected Scope] Atlassian Bitbucket Server and Data Center versions 7.0.0 up to 8.3.0 (excluding specific patched releases)

[Impact] Remote attackers with read permissions to a public or private repository can execute arbitrary OS commands via malicious HTTP requests

[Mitigation] Immediately upgrade Bitbucket instances to the official patched versions (7.6.17, 7.17.10, 7.21.4, 8.0.3, 8.1.3, 8.2.2, 8.3.1 or higher)

[Affected Scope] All PHP web applications utilizing PHPMailer versions prior to 5.2.18

[Impact] Remote attackers can exploit the vulnerability to execute arbitrary code on the target server by manipulating the Sender (From) field

[Mitigation] Immediately upgrade the PHPMailer library to the latest stable version (5.2.18 or higher)