CVE Vulnerability Advisory Database

[Affected Scope] Joomla iCagenda extension versions prior to 3.9.15 and 4.0.8

[Impact] Unauthenticated remote attackers can bypass file upload restrictions to upload malicious PHP scripts, leading to complete system compromise via Remote Code Execution (RCE).

[Mitigation] Immediately upgrade the iCagenda extension to the patched versions (3.9.15 / 4.0.8 or higher) and disable script execution in upload directories.

[Affected Scope] Websites utilizing the SP Page Builder extension for Joomla

[Impact] Unauthenticated attackers can upload and execute malicious PHP code, leading to complete takeover of the web server

[Mitigation] Immediately update to the latest patched version, apply WAF rules, and disable PHP execution in upload directories

[Affected Scope] Cleo Harmony, VLTrader, and LexiCom versions prior to 5.8.0.21

[Impact] Unauthenticated remote attackers can upload and download arbitrary files, potentially leading to full Remote Code Execution (RCE) on the target server

[Mitigation] Immediately upgrade to version 5.8.0.21 or later, and restrict external access to the file transfer interfaces

[Affected Scope] OpenPLC ScadaBR through version 0.9.1 on Linux and through version 1.12.4 on Windows

[Impact] Remote authenticated attackers can upload and execute malicious JSP files, leading to complete system compromise and arbitrary code execution

[Mitigation] Apply the latest security patches, restrict external access to the ScadaBR interface, and block unauthorized JSP uploads via WAF rules

[Affected Scope] Sierra Wireless AirLink ES450 firmware version 4.9.3 and its ACEManager web interface

[Impact] An authenticated attacker can upload arbitrary executable files via a crafted HTTP POST request, leading to remote code execution with system privileges

[Mitigation] Apply the latest official firmware security patches and restrict external internet access to the ACEManager interface

[Affected Scope] Adobe ColdFusion 2018 (Release 2018.0.0.310739 and earlier), ColdFusion 2016 Update 6 and earlier, and ColdFusion 11 Update 14 and earlier

[Impact] Unauthenticated remote attackers can upload arbitrary executable files (such as .jsp) and execute them directly to achieve Remote Code Execution (RCE) with system privileges

[Mitigation] Immediately apply the official Adobe security patch (APSB18-33) and restrict execution permissions on publicly accessible upload directories

[Affected Scope] Progress Telerik UI for ASP.NET AJAX versions prior to R2 2017 SP2

[Impact] Unauthenticated remote attackers can exploit the vulnerable RadAsyncUpload component to upload arbitrary malicious files (such as ASPX webshells) and execute arbitrary code with web server privileges

[Mitigation] Immediately upgrade Telerik UI for ASP.NET AJAX to R2 2017 SP2 or later, or apply workarounds by disabling RadAsyncUpload and hardening encryption keys

[Affected Scope] Progress Telerik UI for ASP.NET AJAX versions before R1 2017 and R2 before R2 2017 SP2

[Impact] Remote attackers can exploit weak encryption to perform unrestricted file uploads or execute arbitrary code on the target server

[Mitigation] Upgrade to the latest patched version of Telerik UI, or configure strong custom encryption keys in web.config