CVE Vulnerability Advisory Database

[Affected Scope] Laravel applications running versions prior to 8.4.2 and utilizing facade/ignition versions prior to 2.5.2 with debug mode (APP_DEBUG=true) enabled

[Impact] Unauthenticated remote attackers can execute arbitrary PHP code on the target server, leading to complete system compromise and data exfiltration

[Mitigation] Upgrade the facade/ignition package to version 2.5.2 or higher, and ensure that Laravel debug mode (APP_DEBUG) is set to 'false' in production environments

[Affected Scope] Apache Struts framework versions 2.0.0 through 2.5.25

[Impact] Unauthenticated remote attackers can execute arbitrary code on the host system by exploiting forced double OGNL evaluation in tag attributes

[Mitigation] Immediately upgrade Apache Struts to version 2.5.26 or higher, and avoid evaluating raw user input inside Struts tag attributes

[Affected Scope] VMware Workspace ONE Access, Access Connector, Identity Manager, and Identity Manager Connector

[Impact] An authenticated attacker with administrative access to the configurator interface can execute arbitrary OS commands with escalated privileges

[Mitigation] Apply the official security patches specified in VMware Advisory VMSA-2020-0027 immediately, or implement the recommended workaround scripts

[Affected Scope] Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0

[Impact] Unauthenticated remote attackers with network access via HTTP can bypass authentication on the administration console and achieve full remote code execution (RCE)

[Mitigation] Immediately apply the official Oracle security patches and restrict network access to the WebLogic Administration Console (/console)

[Affected Scope] QNAP QTS versions prior to 4.4.2.1231 Build 20200302, 4.4.1.1201 Build 20200130, 4.3.6.1218 Build 20200214, 4.3.4.1190 Build 20200107, 4.3.3.1161 Build 20200109, and 4.2.6 Build 20200109

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges on the target NAS device, leading to complete system compromise

[Mitigation] Immediately upgrade QTS to the latest patched firmware version and restrict external internet access to the NAS management interface

[Affected Scope] Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0

[Impact] Unauthenticated remote attackers can bypass authentication via HTTP and gain complete control (RCE) over the Oracle WebLogic Server

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately, or restrict external network access to the administration console (/console)

[Affected Scope] Oracle Solaris 10 and Solaris 11 (prior to version 11.1)

[Impact] Unauthenticated remote attackers can exploit this vulnerability over the network to gain full root privileges and take over the system

[Mitigation] Apply the official vendor patches immediately, or disable Keyboard-Interactive authentication and PAM usage in the SSH configuration

[Affected Scope] VMware ESXi 7.0 (prior to ESXi_7.0.1-0.0.16850804), 6.7 (prior to ESXi670-202010401-SG), and 6.5 (prior to ESXi650-202010401-SG)

[Impact] A malicious actor with access to port 427 on the management network can trigger a Use-After-Free in the OpenSLP service, leading to unauthenticated Remote Code Execution (RCE)

[Mitigation] Apply the official VMware security patches immediately, or disable the OpenSLP service on ESXi hosts as a temporary workaround

[Affected Scope] SonicWall firewall appliances running SonicOS Gen 6 (prior to 6.5.4.7, 6.5.1.12, 6.0.5.3), SonicOSv (prior to 6.5.4.v), and Gen 7 (prior to 7.0.0.0)

[Impact] An unauthenticated remote attacker can trigger a Denial of Service (DoS) or potentially execute arbitrary code with root privileges by sending a specially crafted HTTP request to the firewall

[Mitigation] Immediately upgrade to the patched firmware versions provided by SonicWall and restrict external access to the management interface

[Affected Scope] NETGEAR JGS516PE devices running firmware versions prior to 2.6.0.43

[Impact] Unauthenticated remote attackers can bypass authentication to access sensitive management functions, potentially leading to arbitrary command execution and full device compromise

[Mitigation] Immediately upgrade the JGS516PE firmware to version 2.6.0.43 or later and restrict access to the management interface

[Affected Scope] Sophos SG UTM versions prior to v9.705 MR5, v9.607 MR7, and v9.511 MR11 with WebAdmin enabled

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges by sending specially crafted HTTP requests

[Mitigation] Immediately upgrade to patched firmware versions (v9.705 MR5, v9.607 MR7, v9.511 MR11 or later) and restrict external access to WebAdmin (TCP 4444)

[Affected Scope] WordPress File Manager (wp-file-manager) plugin versions 6.0 through 6.8

[Impact] Unauthenticated remote attackers can upload and execute arbitrary PHP code, leading to complete compromise of the underlying web server

[Mitigation] Immediately update the File Manager plugin to version 6.9 or higher, or completely deactivate and remove the plugin if not required

[Affected Scope] FUEL CMS versions 1.4.7 and prior

[Impact] Unauthenticated remote attackers can exploit this vulnerability to extract sensitive database information, hijack administrator sessions, or escalate to Remote Code Execution (RCE).

[Mitigation] Immediately upgrade FUEL CMS to the latest stable release (1.4.8 or higher) and apply WAF rules to block malicious payloads.

[Affected Scope] vBulletin versions 5.5.4 through 5.6.2

[Impact] Unauthenticated remote attackers can execute arbitrary PHP code and system commands on the target server via crafted HTTP requests

[Mitigation] Apply the official security patches immediately or restrict access to the vulnerable PHP template rendering module

[Affected Scope] Oracle WebLogic Server versions 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0

[Impact] Unauthenticated remote attackers can exploit T3 or IIOP protocols to achieve complete takeover and execute arbitrary code on the target server

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict/block T3 and IIOP protocol access using connection filters

[Affected Scope] All Windows Server versions from 2008 through 2019 with the DNS Server role enabled.

[Impact] Successful exploitation allows unauthenticated remote attackers to execute arbitrary code with SYSTEM privileges, potentially leading to full Active Directory domain compromise.

[Mitigation] Apply the official Microsoft security updates immediately, or implement the registry-based workaround to restrict maximum DNS packet size.

[Affected Scope] Windows Server host and guest virtual machine (VM) environments with Hyper-V RemoteFX vGPU enabled

[Impact] An authenticated attacker on a guest OS can bypass VM isolation boundaries to execute arbitrary code on the host OS, leading to full host compromise

[Mitigation] Apply official Microsoft security patches immediately, or disable the deprecated and high-risk RemoteFX vGPU feature in favor of Discrete Device Assignment (DDA)

[Affected Scope] SAP NetWeaver AS JAVA (LM Configuration Wizard) versions 7.30, 7.31, 7.40, and 7.50

[Impact] Unauthenticated remote attackers can execute configuration tasks, create administrative accounts, and fully compromise system confidentiality, integrity, and availability

[Mitigation] Apply SAP Security Note 2934135 immediately or disable/restrict access to the CTC Web Service

[Affected Scope] MobileIron Core & Connector versions 10.6.0.0 and earlier, Sentry versions 9.8.0 and earlier, Monitor & RDB versions 2.0.0.1 and earlier

[Impact] Unauthenticated remote attackers can execute arbitrary code with system administrator privileges by sending specially crafted Hessian serialized data

[Mitigation] Immediately apply the official security patches provided by the vendor and restrict external access to sensitive service endpoints

[Affected Scope] Traffic Management User Interface (TMUI), also known as the Configuration utility, in F5 BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1

[Impact] Unauthenticated remote attackers can exploit directory traversal to read arbitrary system files or execute remote commands with administrative privileges, leading to complete system compromise

[Mitigation] Immediately upgrade to the patched versions provided by F5, or apply temporary workarounds to restrict external access to the TMUI management interface