CVE Vulnerability Advisory Database

[Affected Scope] Apache Log4j versions 2.0-beta9 to 2.15.0 (including 2.15.0 for Java 8 and 2.12.1 or below for Java 7)

[Impact] Attackers can exploit JNDI Lookup patterns via Thread Context Map (MDC) inputs in non-default configurations to achieve remote code execution (RCE) or information leakage

[Mitigation] Immediately upgrade Apache Log4j to version 2.16.0 (for Java 8+) or 2.12.2 (for Java 7+), which disables JNDI by default and removes message lookup support

[Affected Scope] Java applications utilizing Apache Log4j2 (log4j-core) versions 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1)

[Impact] Unauthenticated remote attackers can execute arbitrary code by forcing the application to load malicious Java classes from attacker-controlled LDAP or other JNDI-related endpoints, leading to full system compromise (CVSS 10.0 Critical)

[Mitigation] Immediately upgrade Log4j2 to the latest secure version (2.17.1 or higher; or 2.12.4 / 2.3.2 depending on Java version), or apply workarounds such as removing the JndiLookup class

[Affected Scope] Ivanti Endpoint Manager Cloud Services Appliance (CSA) versions 4.5 and 4.6

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with limited privileges ('nobody') by sending specially crafted HTTP requests.

[Mitigation] Immediately apply the official security patches provided by Ivanti and restrict access to the CSA management interface from the public internet.

[Affected Scope] SonicWall SMA 200, 210, 400, 410, and 500v appliances running firmware versions 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv, and earlier

[Impact] A remote unauthenticated attacker can execute arbitrary code with 'nobody' user privileges on the appliance by sending a specially crafted HTTP request, potentially leading to full system compromise

[Mitigation] Immediately upgrade the appliance firmware to the patched version (10.2.1.3-27sv or higher) and restrict external access to the management interface

[Affected Scope] All versions of the ajaxpro.2 (Ajax.NET Professional) package

[Impact] Unauthenticated remote attackers can exploit the deserialization of untrusted data to instantiate arbitrary .NET classes, leading to Remote Code Execution (RCE)

[Mitigation] Apply the official security patch from the upstream repository, restrict unused AjaxPro handlers, or deploy WAF rules

[Affected Scope] Zoho ManageEngine ServiceDesk Plus (before 11306), ServiceDesk Plus MSP (before 10530), and SupportCenter Plus (before 11014).

[Impact] Unauthenticated remote attackers can bypass authentication to upload and execute malicious files, gaining full system-level control over the target server.

[Mitigation] Immediately apply the official vendor patches, restrict external access to vulnerable endpoints, and perform a comprehensive log audit for Indicators of Compromise (IoCs).

[Affected Scope] Sitecore Experience Platform (XP) 7.5 Initial Release to Sitecore XP 8.2 Update-7.

[Impact] Unauthenticated remote attackers can execute arbitrary commands with system privileges on the hosting server by sending specially crafted serialized payloads.

[Mitigation] Apply official security patches immediately or restrict external access to the vulnerable '/sitecore/shell/ClientBin/Reporting/ReportService.asmx' endpoint.

[Affected Scope] Apache HTTP Server versions 2.4.49 and 2.4.50

[Impact] Unauthenticated remote attackers can exploit this vulnerability to access sensitive files outside the document root or execute arbitrary commands if CGI scripts are enabled

[Mitigation] Immediately upgrade Apache HTTP Server to version 2.4.51 or later, and enforce strict directory access controls

[Affected Scope] Citrix ShareFile Storage Zones Controller versions prior to 5.11.20

[Impact] Unauthenticated remote attackers can bypass access controls to compromise the storage zones controller, potentially leading to arbitrary code execution and data exfiltration

[Mitigation] Immediately upgrade to Citrix ShareFile Storage Zones Controller 5.11.20 or later, and restrict external access to administrative endpoints

[Affected Scope] VMware vCenter Server versions 6.7 and 7.0 running the Analytics (CEIP) service

[Impact] Unauthenticated attackers with network access to port 443/TCP can upload arbitrary files and execute remote code with system privileges

[Mitigation] Apply official vendor patches immediately, or implement the temporary workaround to disable the vulnerable Analytics endpoint

[Affected Scope] Web server software embedded in various Hikvision IP cameras and Network Video Recorders (NVRs)

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending specially crafted HTTP requests, leading to full device compromise

[Mitigation] Immediately upgrade to the latest patched firmware version provided by the vendor and restrict direct internet access to the devices

[Affected Scope] Certain Dahua IP cameras, NVRs, DVRs, and associated firmware versions

[Impact] Attackers can completely bypass the identity authentication process during login and gain full administrative control of the device

[Mitigation] Immediately apply the latest firmware updates provided by the vendor and restrict external network access to the devices

[Affected Scope] Open Management Infrastructure (OMI) versions prior to 1.6.8-1, commonly deployed automatically on Microsoft Azure Linux Virtual Machines

[Impact] Unauthenticated remote attackers can execute arbitrary commands with root privileges on the target system by sending a specially crafted HTTP/S request

[Mitigation] Immediately upgrade the OMI package to version 1.6.8-1 or higher, and restrict network access to OMI ports (5985, 5986) using firewalls

[Affected Scope] Aviatrix Controller 6.x versions prior to 6.5-1804.1922

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by exploiting directory traversal and unrestricted file upload vulnerabilities

[Mitigation] Immediately upgrade Aviatrix Controller to version 6.5-1804.1922 or later, and restrict external access to the management interface

[Affected Scope] Zoho ManageEngine ADSelfService Plus version 6113 and prior

[Impact] Unauthenticated remote attackers can bypass REST API authentication and execute arbitrary code with SYSTEM privileges

[Mitigation] Immediately upgrade to build 6114 or later and inspect systems for Indicators of Compromise (IoCs)

[Affected Scope] Atlassian Confluence Server and Data Center versions prior to 6.13.23, 6.14.0 to < 7.4.11, 7.5.0 to < 7.11.6, and 7.12.0 to < 7.12.5

[Impact] An unauthenticated, remote attacker can execute arbitrary OS commands with system privileges on the target instance by sending a specially crafted HTTP request.

[Mitigation] Immediately upgrade Confluence instances to the patched versions (6.13.23, 7.4.11, 7.11.6, 7.12.5, or later) or apply the vendor-provided workaround scripts.

[Affected Scope] IoT and network devices utilizing Realtek Jungle SDK versions v2.x through v3.4.14B

[Impact] Unauthenticated remote attackers can exploit stack buffer overflows and command injection flaws to execute arbitrary code with root privileges, leading to full device compromise

[Mitigation] Apply the latest firmware updates from the respective device manufacturers and restrict external access to the web management interface

[Affected Scope] Embedded IoT devices utilizing Realtek Jungle SDK versions v2.x through v3.4.14B containing the 'MP Daemon' (UDPServer) diagnostic tool

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges or trigger memory corruption on the target device

[Mitigation] Apply the official vendor firmware patch, disable the UDPServer service, or restrict external access to the diagnostic UDP ports using firewall rules

[Affected Scope] Sunhillo SureLine versions prior to 8.7.0.1.1

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands on the target system using shell metacharacters

[Mitigation] Immediately upgrade Sunhillo SureLine to version 8.7.0.1.1 or later, and restrict external network access

[Affected Scope] ForgeRock Access Manager (AM) versions prior to 7.0 (including OpenAM 14.6.3 and earlier)

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending a single crafted HTTP request

[Mitigation] Immediately upgrade to ForgeRock AM 7.0 or later, or restrict external access to JATO-related endpoints such as /ccversion/*