CVE Vulnerability Advisory Database

[Affected Scope] Ubiquiti UniFi OS devices accessible via the network

[Impact] Unauthenticated remote attackers can make unauthorized system changes, gain administrative control, and potentially enlist devices into botnets

[Mitigation] Apply the official vendor security patches immediately, restrict access to management interfaces, and monitor for unauthorized configuration changes

[Affected Scope] Fortinet FortiClientEMS versions 7.4.5 through 7.4.6

[Impact] An unauthenticated remote attacker can execute unauthorized code or commands with system privileges via crafted network requests.

[Mitigation] Apply the official Fortinet security patch (version 7.4.7 or higher) immediately and restrict external network access to the EMS server.

[Affected Scope] Triofox versions prior to 16.7.10368.56560

[Impact] Unauthenticated remote attackers can access initial setup pages even after installation is complete, potentially leading to full administrative takeover.

[Mitigation] Immediately upgrade Triofox to version 16.7.10368.56560 or later.

[Affected Scope] Adobe ColdFusion 2023 Update 6 and earlier, and ColdFusion 2021 Update 12 and earlier

[Impact] Unauthenticated attackers can bypass access controls to read or modify arbitrary files on the host system, potentially exposing sensitive configuration data

[Mitigation] Apply the official Adobe APSB24-14 security patch immediately and restrict external internet access to the ColdFusion administrator panel

[Affected Scope] Adobe ColdFusion 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier)

[Impact] Unauthenticated remote attackers can execute arbitrary code or access sensitive files in the context of the current user without any user interaction

[Mitigation] Immediately apply official vendor patches (ColdFusion 2018 Update 16, ColdFusion 2021 Update 6 or later) and restrict external access

[Affected Scope] Samsung Android devices prior to SMR (Samsung Maintenance Release) March 2021 Release 1

[Impact] Local attackers can bypass critical kernel protections like KASLR by reading sensitive kernel memory addresses and structures from the improperly secured sec_log file

[Mitigation] Apply the official Samsung SMR March 2021 Release 1 (or later) firmware update immediately, or restrict access permissions to the debug log node

[Affected Scope] Samsung mobile devices running software versions prior to SMR (Samsung Security Maintenance Release) Mar-2021 Release 1

[Impact] Untrusted local applications can bypass sandbox boundaries to read or write sensitive local files, potentially leading to data theft or privilege escalation

[Mitigation] Immediately apply the official Samsung security update (SMR Mar-2021 Release 1 or later)

[Affected Scope] QNAP Photo Station versions running on QTS operating system environments

[Impact] Unauthenticated remote attackers can bypass access control mechanisms to gain unauthorized system access, potentially leading to Remote Code Execution (RCE)

[Mitigation] Immediately update QNAP Photo Station and QTS to the latest official security-patched versions

[Affected Scope] Enterprise network environments running FortiOS 6.0.2, 5.6.7 and before, or FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4

[Impact] An authenticated attacker can redirect LDAP connectivity test requests to a rogue LDAP server, exposing configured LDAP administrator credentials in plaintext or reversible format

[Mitigation] Upgrade FortiOS and FortiADC to the latest patched versions immediately and restrict administrative access using trusted host configurations