CVE Vulnerability Advisory Database

[Affected Scope] SAP systems utilizing the SAP NetWeaver Visual Composer Metadata Uploader component.

[Impact] Unauthenticated remote attackers can upload malicious executable binaries (such as web shells), leading to complete compromise of system confidentiality, integrity, and availability.

[Mitigation] Immediately apply the official security patch (SAP Note 3594142) and restrict external access to the Metadata Uploader endpoints.

[Affected Scope] TeamT5 ThreatSonar Anti-Ransomware platform

[Impact] Remote attackers with administrator privileges can upload malicious files to execute arbitrary system commands on the server

[Mitigation] Immediately apply the official security patches provided by the vendor and restrict access to the admin console

[Affected Scope] FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1

[Impact] A remote, unauthenticated attacker can upload arbitrary files to any location on the filesystem, potentially leading to remote code execution with system privileges

[Mitigation] Immediately upgrade to patched versions (10.1.2r60p92, 10.2.2r44p1 or later) and restrict external access to the web management interface

[Affected Scope] Zoho ManageEngine ServiceDesk Plus versions prior to 10.0 Build 10012

[Impact] Remote authenticated attackers can upload and execute arbitrary files (such as web shells) via the login page customization feature, leading to Remote Code Execution (RCE)

[Mitigation] Immediately upgrade ManageEngine ServiceDesk Plus to Build 10012 or later, and restrict execution permissions on upload directories