CVE Vulnerability Advisory Database

[Affected Scope] All on-premises and cloud web application servers running Novi Survey versions prior to 8.9.43676.

[Impact] Unauthenticated remote attackers can execute arbitrary system commands and malicious code under the security context of the web service account.

[Mitigation] Immediately upgrade to the official patched version (8.9.43676 or higher) and restrict external access to the application.

[Affected Scope] Sophos Web Appliance versions prior to 4.3.10.4

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges by sending specially crafted HTTP requests.

[Mitigation] Immediately upgrade Sophos Web Appliance to version 4.3.10.4 or higher, or migrate to a supported alternative solution due to the product's End-of-Life (EOL) status.

[Affected Scope] Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x

[Impact] Unauthenticated attackers can bypass security restrictions to gain administrative access and chain it with Server-Side Template Injection (SSTI) to execute arbitrary code

[Mitigation] Immediately upgrade to patched versions (9.4.0.1, 9.3.0.2 or later) and restrict external access to the Pentaho management interface

[Affected Scope] Cobalt Strike version 4.7.1

[Impact] Remote attackers can execute arbitrary code within the Cobalt Strike UI context by injecting crafted HTML payloads

[Mitigation] Immediately upgrade to Cobalt Strike version 4.7.2 or later, and restrict access to the Teamserver

[Affected Scope] Adobe ColdFusion 2018 Update 15 (and earlier) and ColdFusion 2021 Update 5 (and earlier).

[Impact] Successful exploitation allows unauthenticated remote attackers to execute arbitrary code in the context of the current user without any user interaction.

[Mitigation] Immediately apply the official Adobe security patches to upgrade to ColdFusion 2018 Update 16, ColdFusion 2021 Update 6, or later.

[Affected Scope] IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending a specially crafted API request

[Mitigation] Immediately upgrade to IBM Aspera Faspex 4.4.2 Patch Level 2 or later, or restrict access to the obsolete API endpoints

[Affected Scope] Ruckus Wireless Admin and AP controller devices running version 10.4 or lower

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending a specially crafted HTTP GET request

[Mitigation] Immediately apply the official vendor firmware patches and restrict access to the management interface from the public internet

[Affected Scope] Zoho ManageEngine on-premise products with SAML SSO configured or previously enabled (e.g., ServiceDesk Plus through 14003, ADSelfService Plus through 6210, Endpoint Central through 10.1.2228.10)

[Impact] Unauthenticated remote attackers can execute arbitrary code with SYSTEM/Administrator privileges by sending a specially crafted SAML response containing malicious XSLT payloads

[Mitigation] Immediately upgrade the affected ManageEngine products to the latest patched versions, or temporarily disable SAML SSO and restrict access to SAML endpoints

[Affected Scope] CentOS Web Panel (CWP) 7 versions prior to 0.9.8.1147

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges on the target server by injecting shell metacharacters into the login parameter.

[Mitigation] Immediately upgrade CWP 7 to version 0.9.8.1147 or later, and restrict access to the management ports using firewalls.

[Affected Scope] FortiOS versions 7.2.0 to 7.2.2, 7.0.0 to 7.0.8, 6.4.0 to 6.4.10, 6.2.0 to 6.2.11, 6.0.15 and earlier; FortiProxy versions 7.2.0 to 7.2.1, 7.0.7 and earlier

[Impact] An unauthenticated remote attacker can execute arbitrary code or commands with root privileges on the target system by sending specifically crafted HTTP/HTTPS requests

[Mitigation] Immediately upgrade to the patched firmware versions or disable the SSL-VPN service and restrict access using local-in policies if patching is delayed

[Affected Scope] Citrix ADC and Citrix Gateway versions 12.1 and 13.0 with SAML SP or IdP configuration enabled

[Impact] Unauthenticated remote attackers can execute arbitrary code on the target appliance and gain full system control by sending specially crafted requests

[Mitigation] Immediately upgrade to the patched firmware versions (12.1-65.25, 13.0-88.16, or higher) provided by Citrix

[Affected Scope] Netwrix Auditor server and User Activity Video Recording agents installed on monitored systems

[Impact] Unauthenticated remote attackers can execute arbitrary code with 'NT AUTHORITY\SYSTEM' privileges on affected servers and monitored hosts

[Mitigation] Immediately upgrade Netwrix Auditor to the latest secure version and restrict network access to agent communication ports

[Affected Scope] D-Link DSL-2750B devices running firmware versions prior to 1.05

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges via the 'cli' parameter in login.cgi

[Mitigation] Apply the official firmware patch (v1.05 or later) or immediately disable WAN-side access to the web management interface

[Affected Scope] FortiOS (7.2.0 to 7.2.1, 7.0.0 to 7.0.6), FortiProxy (7.2.0, 7.0.0 to 7.0.6), FortiSwitchManager (7.2.0, 7.0.0)

[Impact] An unauthenticated remote attacker can bypass authentication via specially crafted HTTP/HTTPS requests, gaining full administrative access to perform arbitrary operations

[Mitigation] Immediately upgrade to patched versions (FortiOS 7.2.2 / 7.0.7 or higher) or disable HTTP/HTTPS administrative access from untrusted networks

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 8.8.15 and 9.0 running on Red Hat-based distributions (RHEL/CentOS) where the 'pax' utility is missing.

[Impact] Unauthenticated attackers can upload arbitrary files to the web root directory via a cpio path traversal loophole during amavis scanning, leading to full system compromise.

[Mitigation] Immediately install the 'pax' utility via the OS package manager or upgrade Zimbra to the latest patched version.

[Affected Scope] Sophos Firewall version v19.0 MR1 and older affecting User Portal and Webadmin interfaces

[Impact] Unauthenticated remote attackers can execute arbitrary code and fully compromise the firewall device by sending specially crafted HTTP requests

[Mitigation] Immediately upgrade to the latest firmware version (v19.0 MR2 or later) and disable WAN access to Webadmin and User Portal

[Affected Scope] GLPI versions up to and including 10.0.2, specifically within the bundled htmLawed module

[Impact] Unauthenticated remote attackers can inject and execute arbitrary PHP code, leading to full system compromise

[Mitigation] Immediately upgrade GLPI to version 10.0.3 or higher, or delete the vulnerable test script (htmLawedTest.php)

[Affected Scope] D-Link GO-RT-AC750 hardware revA (firmware v101b03 and prior) and revB (firmware FWv200b02 and prior).

[Impact] Unauthenticated remote attackers can execute arbitrary code with root privileges or cause a complete system compromise by sending crafted HTTP requests to the WAN/LAN interface.

[Mitigation] Apply the latest firmware updates immediately, or replace end-of-life (EoL) devices and disable remote WAN management interfaces.

[Affected Scope] Zoho ManageEngine Password Manager Pro before 12101, PAM360 before 5510, and Access Manager Plus before 4303

[Impact] Unauthenticated (or authenticated for Access Manager Plus) attackers can execute arbitrary code with system privileges by sending malicious XML-RPC requests

[Mitigation] Immediately upgrade to the patched versions (Password Manager Pro 12101, PAM360 5510, Access Manager Plus 4303 or higher)

[Affected Scope] dotCMS versions 3.0 through 22.02

[Impact] Unauthenticated attackers can upload malicious JSP files via directory traversal when anonymous content creation is enabled, leading to full Remote Code Execution (RCE)

[Mitigation] Immediately upgrade to patched dotCMS versions (22.03 or higher) and disable anonymous content creation APIs if not required