CVE Vulnerability Advisory Database

[Affected Scope] All WordPress installations running vulnerable core versions and specific themes.

[Impact] Unauthenticated attackers can include and execute arbitrary local PHP files, leading to full server compromise.

[Mitigation] Immediate update to the latest WordPress security release and deployment of WAF filtering rules.

[Affected Scope] Zimbra Collaboration (ZCS) versions 10.0 and 10.1 utilizing the Webmail Classic UI

[Impact] Unauthenticated remote attackers can exploit the /h/rest endpoint to include and execute arbitrary files from the WebRoot directory, potentially leading to sensitive information disclosure and Remote Code Execution (RCE)

[Mitigation] Immediately apply the official security patches from Zimbra, or restrict external access to the vulnerable /h/rest endpoint as a temporary workaround

[Affected Scope] Gladinet CentreStack and Triofox solutions prior to version 16.12.10420.56791

[Impact] Unauthenticated remote attackers can exploit hardcoded AES keys to read arbitrary local files and potentially achieve full system compromise

[Mitigation] Immediately upgrade to version 16.12.10420.56791 or later and restrict access to publicly exposed endpoints

[Affected Scope] All versions of Gladinet CentreStack and Triofox prior to and including 16.7.10368.56560

[Impact] Unauthenticated remote attackers can exploit this flaw to read sensitive system and configuration files, leading to critical information disclosure

[Mitigation] Immediately upgrade to the patched version (16.7.10368.56561 or higher) and restrict external access to the management console

[Affected Scope] Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier

[Impact] A remote unauthenticated attacker can read arbitrary system files and sensitive account credentials by sending specially crafted XML requests

[Mitigation] Immediately upgrade to the latest patched versions provided by the vendor and disable external entity resolution in XML parsers

[Affected Scope] Metabase versions prior to 0.40.5 and 1.40.5 (including all 0.40.x and 1.40.x releases below these versions)

[Impact] Unauthenticated remote attackers can exploit directory traversal to read arbitrary system files and environment variables from the server

[Mitigation] Immediately upgrade to patched Metabase versions (0.40.5, 1.40.5 or later) or block the vulnerable API path using a reverse proxy or WAF

[Affected Scope] DrayTek VigorConnect version 1.6.0-B3 and prior

[Impact] Unauthenticated remote attackers can download arbitrary system files with root privileges via directory traversal

[Mitigation] Immediately upgrade VigorConnect to the latest patched version (1.6.0-RC1 or higher) and restrict access to the management interface

[Affected Scope] DrayTek VigorConnect version 1.6.0-B3 and prior

[Impact] Unauthenticated remote attackers can download arbitrary system files with root privileges, leading to full exposure of sensitive host operating system data

[Mitigation] Immediately upgrade VigorConnect to the latest secure version and restrict access to the management interface from the public internet

[Affected Scope] Oracle Business Intelligence Enterprise Edition (OBIEE) versions 5.5.0.0.0, 12.2.1.3.0, and 12.2.1.4.0

[Impact] Unauthenticated remote attackers can access sensitive system files and configuration data via crafted HTTP requests

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or implement path traversal blocking rules on Web Application Firewalls (WAF)

[Affected Scope] Citrix ADC and Gateway versions prior to 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14, 10.5-70.18, and SD-WAN WAN-OP versions prior to 11.1.1a, 11.0.3d, 10.2.7

[Impact] A low-privileged authenticated attacker can bypass access controls to read sensitive system files and configuration data, potentially leading to further privilege escalation

[Mitigation] Immediately apply the official firmware updates provided by Citrix and restrict access to the management interface

[Affected Scope] Citrix ADC and Gateway versions prior to 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14, 10.5-70.18, and SD-WAN WAN-OP versions prior to 11.1.1a, 11.0.3d, 10.2.7

[Impact] Low-privileged authenticated attackers can exploit improper input validation to access sensitive system files and disclose confidential information

[Mitigation] Immediately apply the official security patches and upgrade to the recommended secure firmware versions

[Affected Scope] Citrix ADC and Gateway versions prior to 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14, 10.5-70.18, and Citrix SDWAN WAN-OP

[Impact] Unauthenticated remote attackers can bypass access controls to access sensitive endpoints, potentially leading to Local File Inclusion (LFI) and information disclosure

[Mitigation] Immediately apply the official firmware updates provided by Citrix to resolve the vulnerability

[Affected Scope] Juniper Networks Junos OS devices with HTTP/HTTPS services (J-Web, Web Authentication, Dynamic-VPN, etc.) enabled

[Impact] Unauthenticated attackers can read arbitrary system files, hijack active administrator session tokens, or inject commands into web logs to execute limited commands

[Mitigation] Upgrade Junos OS to the recommended patched release, or disable HTTP/HTTPS and J-Web services if they are not business-critical

[Affected Scope] Apache Tomcat versions 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50, and 7.0.0 to 7.0.99

[Impact] Attackers with access to the AJP port (default 8009) can read arbitrary files from the web application or execute arbitrary code (RCE) if file upload is permitted

[Mitigation] Upgrade to Apache Tomcat 9.0.31, 8.5.51, 7.0.100 or later, or disable/restrict the AJP Connector in the configuration

[Affected Scope] TIBCO JasperReports Library (<= 6.3.4, 6.4.21, 7.2.0), JasperReports Server (<= 6.3.4, 6.4.3, 7.1.0), and Jaspersoft for AWS

[Impact] An authenticated remote attacker can exploit directory traversal to access sensitive host system files and configuration data

[Mitigation] Upgrade to the latest patched versions immediately, or implement WAF rules to block directory traversal patterns (../)

[Affected Scope] Paessler PRTG Network Monitor versions prior to 18.2.40.1683

[Impact] Unauthenticated remote attackers can exploit a Local File Inclusion (LFI) vulnerability to create unauthorized accounts with administrative privileges, leading to full system compromise

[Mitigation] Immediately upgrade PRTG Network Monitor to version 18.2.40.1683 or later and restrict external access to the web console

[Affected Scope] TIBCO JasperReports Server versions up to and including 6.2.4, 6.3.0, 6.3.2, 6.3.3, 6.4.0, 6.4.2, and related Community/AWS/BPM editions

[Impact] Authenticated attackers can exploit Spring Web Flow parameter handling to gain unauthorized read-only access to sensitive web application configuration files, including database credentials

[Mitigation] Apply official security patches from TIBCO, upgrade to the latest stable release, or implement strict input validation and WAF rules to block path traversal patterns

[Affected Scope] Ruby on Rails versions before 3.2.22.1, 4.0.x, 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1

[Impact] Remote attackers can read arbitrary files or potentially execute arbitrary code by exploiting unrestricted input parameters passed to the render method

[Mitigation] Immediately upgrade the Ruby on Rails framework and Action View gem to the patched official release versions

[Affected Scope] TP-LINK router models including Archer C5/C7/C8/C9, TL-WDR3500/3600/4300, TL-WR740N/741ND/841N/841ND running vulnerable firmware versions

[Impact] Unauthenticated remote attackers can read arbitrary system files and sensitive configuration data by injecting directory traversal sequences (..) into the PATH_INFO parameter

[Mitigation] Immediately upgrade to the patched firmware versions provided by TP-LINK and disable WAN-side remote management interfaces

[Affected Scope] Adobe ColdFusion 9.0.1 and earlier versions containing the CFIDE/administrator console

[Impact] Unauthenticated remote attackers can exploit directory traversal to read arbitrary system and configuration files, potentially retrieving administrator password hashes and fully compromising the server

[Mitigation] Apply the official APSB10-18 security patch, restrict external access to the CFIDE directory, or upgrade to a supported secure version