CVE Vulnerability Advisory Database

[Affected Scope] Atlassian Confluence Server and Data Center versions from 1.3.0 before 7.4.17, and specific release lines up to 7.18.1

[Impact] An unauthenticated remote attacker can execute arbitrary Java code on the Confluence instance with system privileges, leading to full host compromise.

[Mitigation] Immediately upgrade Confluence to the patched versions (7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, 7.18.1 or higher) or apply the vendor-provided workaround JAR files.

[Affected Scope] Spring Cloud Function versions 3.1.6, 3.2.2, and older unsupported versions

[Impact] Unauthenticated remote attackers can inject malicious SpEL expressions via HTTP headers to execute arbitrary system commands and access local resources.

[Mitigation] Immediately upgrade Spring Cloud Function to version 3.1.7, 3.2.3, or higher, and block suspicious routing headers using WAF rules.

[Affected Scope] Spring Cloud Gateway versions prior to 3.1.1 and 3.0.7, where the Gateway Actuator endpoint is enabled, exposed, and unsecured

[Impact] Unauthenticated remote attackers can execute arbitrary system commands on the host by sending maliciously crafted HTTP requests

[Mitigation] Immediately upgrade Spring Cloud Gateway to version 3.1.1, 3.0.7, or higher, and disable or secure the Gateway Actuator endpoint

[Affected Scope] Apache Log4j versions 2.0-beta9 to 2.15.0 (including 2.15.0 for Java 8 and 2.12.1 or below for Java 7)

[Impact] Attackers can exploit JNDI Lookup patterns via Thread Context Map (MDC) inputs in non-default configurations to achieve remote code execution (RCE) or information leakage

[Mitigation] Immediately upgrade Apache Log4j to version 2.16.0 (for Java 8+) or 2.12.2 (for Java 7+), which disables JNDI by default and removes message lookup support

[Affected Scope] Java applications utilizing Apache Log4j2 (log4j-core) versions 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1)

[Impact] Unauthenticated remote attackers can execute arbitrary code by forcing the application to load malicious Java classes from attacker-controlled LDAP or other JNDI-related endpoints, leading to full system compromise (CVSS 10.0 Critical)

[Mitigation] Immediately upgrade Log4j2 to the latest secure version (2.17.1 or higher; or 2.12.4 / 2.3.2 depending on Java version), or apply workarounds such as removing the JndiLookup class

[Affected Scope] Atlassian Confluence Server and Data Center versions prior to 6.13.23, 6.14.0 to < 7.4.11, 7.5.0 to < 7.11.6, and 7.12.0 to < 7.12.5

[Impact] An unauthenticated, remote attacker can execute arbitrary OS commands with system privileges on the target instance by sending a specially crafted HTTP request.

[Mitigation] Immediately upgrade Confluence instances to the patched versions (6.13.23, 7.4.11, 7.11.6, 7.12.5, or later) or apply the vendor-provided workaround scripts.

[Affected Scope] Apache Struts framework versions 2.0.0 through 2.5.25

[Impact] Unauthenticated remote attackers can execute arbitrary code on the host system by exploiting forced double OGNL evaluation in tag attributes

[Mitigation] Immediately upgrade Apache Struts to version 2.5.26 or higher, and avoid evaluating raw user input inside Struts tag attributes

[Affected Scope] Sonatype Nexus Repository Manager versions prior to 3.21.2

[Impact] An authenticated attacker with low privileges can execute arbitrary system commands on the server by sending a specially crafted request.

[Mitigation] Immediately upgrade Nexus Repository Manager to the latest stable version (3.21.2 or higher).

[Affected Scope] JBoss Seam 2 (jboss-seam2) framework as integrated in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux

[Impact] Remote attackers can execute arbitrary Java code and system commands via crafted URLs when the Java Security Manager is not properly configured

[Mitigation] Upgrade to the patched version of JBoss Seam/EAP, enable the Java Security Manager, and implement strict input validation filters