CVE Vulnerability Advisory Database

[Affected Scope] SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before version 15.2.3 HF2

[Impact] Unauthenticated remote attackers can exploit this vulnerability to gain SYSTEM-level privileged access and execute arbitrary code on the host machine

[Mitigation] Immediately upgrade to Serv-U version 15.2.3 HF2 or later, and restrict external access to the service ports

[Affected Scope] Microsoft Exchange Server 2013, 2016, and 2019 on-premises deployments

[Impact] Unauthenticated attackers can bypass security controls to execute arbitrary PowerShell commands with SYSTEM privileges

[Mitigation] Immediately apply the official Microsoft Cumulative Updates (CU) and Security Updates (SU), and restrict external access to Exchange management ports

[Affected Scope] Checkbox Survey versions prior to 7.0, specifically affecting the CheckboxWeb.dll component

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges on the target server via untrusted data deserialization

[Mitigation] Immediately upgrade Checkbox Survey to version 7.0 or higher, and restrict external access to vulnerable endpoints

[Affected Scope] VMware vCenter Server versions 6.5, 6.7, and 7.0 with the default-enabled Virtual SAN Health Check plug-in

[Impact] An unauthenticated attacker with network access to port 443 can execute arbitrary commands with root privileges on the underlying operating system

[Mitigation] Apply official security patches immediately, or disable the vulnerable vSAN Health Check plug-in as a temporary workaround

[Affected Scope] HTTP.sys services running on Windows 10 versions 2004, 20H2 and Windows Server versions 2004, 20H2

[Impact] Unauthenticated remote attackers can execute arbitrary code in the kernel context or trigger an immediate Blue Screen of Death (BSOD) leading to Denial of Service (DoS) by sending specially crafted HTTP packets

[Mitigation] Apply the official Microsoft cumulative security updates immediately, and restrict external exposure of HTTP.sys-dependent services prior to patching

[Affected Scope] Tenda AC11 wireless routers running firmware versions up to and including 02.03.01.104_CN

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending a specially crafted HTTP POST request

[Mitigation] Immediately upgrade to the latest patched firmware version and disable external WAN-side HTTP management interfaces

[Affected Scope] Systems running Cisco HyperFlex HX Data Platform with the web-based management interface enabled

[Impact] Unauthenticated, remote attackers can execute arbitrary system commands with root privileges on the affected device by sending crafted HTTP requests

[Mitigation] Immediately apply the official security patches provided by Cisco and restrict external access to the web management interface

[Affected Scope] Web-based management interface of Cisco HyperFlex HX Data Platform

[Impact] Unauthenticated, remote attackers can execute arbitrary OS commands with system privileges, leading to complete device compromise

[Mitigation] Apply official Cisco security patches immediately, or restrict network access to TCP ports 80/443 to trusted administrative networks

[Affected Scope] All GitLab Community Edition (CE) and Enterprise Edition (EE) versions starting from 11.9

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with the privileges of the GitLab user by uploading a specially crafted image file

[Mitigation] Immediately upgrade the GitLab instance to the latest patched versions (13.10.3, 13.9.6, 13.8.8, or higher)

[Affected Scope] QNAP QTS (prior to 4.5.2, 4.5.1, 4.3.6, 4.3.4, 4.3.3, 4.2.6) and QuTS hero (prior to h4.5.1)

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with elevated privileges on the compromised NAS device

[Mitigation] Immediately upgrade QNAP firmware to the patched versions and restrict external internet access to the NAS management interface

[Affected Scope] Systems running iOS versions prior to 14.4, iPadOS versions prior to 14.4, macOS Big Sur versions prior to 11.2, and Catalina/Mojave without Security Update 2021-001

[Impact] A remote attacker can execute arbitrary code on the target system, and active exploitation in the wild has been reported

[Mitigation] Immediately apply the official Apple software updates to upgrade to iOS/iPadOS 14.4, macOS Big Sur 11.2, or later

[Affected Scope] F5 BIG-IP versions 16.0.x, 15.1.x, 14.1.x, 13.1.x, and 12.1.x prior to patched releases

[Impact] Unauthenticated remote attackers can trigger a buffer overflow via crafted URI requests, leading to TMM Denial of Service (DoS), URL-based access control bypass, or potential Remote Code Execution (RCE)

[Mitigation] Immediately upgrade to the designated hotfix/patched versions recommended by F5, or apply temporary traffic filtering workarounds

[Affected Scope] F5 BIG-IP (16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x) and BIG-IQ (7.1.0.x, 7.0.0.x) management interfaces running iControl REST.

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with elevated privileges, leading to complete compromise of the target device.

[Mitigation] Immediately upgrade to the patched versions provided by F5 and restrict access to the iControl REST interface (TCP 443) from untrusted networks.

[Affected Scope] On-premises Microsoft Exchange Server 2013, 2016, and 2019

[Impact] Unauthenticated remote attackers can bypass authentication, access sensitive mailbox data, and chain with other vulnerabilities to execute arbitrary code (RCE)

[Mitigation] Immediately apply the official Microsoft Cumulative Update (CU) and Security Update (SU), or implement IIS URL Rewrite rules to block malicious requests

[Affected Scope] VMware vCenter Server versions 7.0, 6.7, 6.5 and VMware Cloud Foundation versions 4.x, 3.x

[Impact] Unauthenticated remote attackers with network access to port 443 can execute arbitrary commands with unrestricted privileges on the underlying operating system

[Mitigation] Immediately upgrade to the patched versions or apply the official workaround to disable the vulnerable plugin

[Affected Scope] Accellion FTA versions 9_12_370 and earlier

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands and gain full system control by sending crafted POST requests to various admin endpoints

[Mitigation] Immediately upgrade to Accellion FTA version 9_12_380 or later, or migrate to a supported secure file transfer platform

[Affected Scope] Micro Focus Operations Bridge Reporter (OBR) version 10.40.

[Impact] Unauthenticated remote attackers can execute arbitrary system commands on the OBR server, leading to complete system compromise.

[Mitigation] Apply the official vendor security patch (KM03775947) immediately and restrict external access to the OBR management ports.

[Affected Scope] D-Link DNS-320 ShareCenter NAS devices (Firmware v2.06B01 Revision Ax and prior)

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending specially crafted HTTP requests, leading to full system compromise

[Mitigation] Since this product is End-of-Life (EOL), immediately isolate the device from the network and replace it with a supported model

[Affected Scope] D-Link DIR-825 R1 devices running firmware versions up to 3.0.1 before 2020-11-20

[Impact] Remote unauthenticated attackers can execute arbitrary code with root privileges by sending crafted HTTP requests, leading to complete device compromise

[Mitigation] Apply the latest official firmware patch immediately, disable WAN-side remote management, or replace end-of-life hardware

[Affected Scope] ONLYOFFICE Document Server versions prior to 5.6.3 (when JWT is enabled)

[Impact] Attackers can achieve Remote Code Execution (RCE) by uploading malicious files to arbitrary directories.

[Mitigation] Immediately update ONLYOFFICE Document Server to version 5.6.3 or later.