CVE Vulnerability Advisory Database

[Affected Scope] WhatsApp and WhatsApp Business prior to specific patched versions across Android, iOS, Windows Phone, and Tizen platforms

[Impact] Remote attackers can execute arbitrary code (RCE) and compromise target devices without user interaction by sending specially crafted RTCP packets

[Mitigation] Immediately update WhatsApp applications to the latest official patched versions via respective app stores

[Affected Scope] ZyXEL P660HN-T1A v1 routers distributed by TrueOnline running TCLinux Firmware v7.3.15.0 v001 / 3.40(ULM.0)b31 or prior

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by manipulating the remote_host parameter in the ViewLog.asp page

[Mitigation] Immediately disable external WAN access to the web management interface, apply the latest firmware updates, or replace legacy end-of-life devices

[Affected Scope] Wireless presentation gateways based on the AWIND OEM platform, including Crestron AM-100/101, Barco wePresent WiPG-1000P/1600W, and Extron ShareLink 200/250.

[Impact] An unauthenticated remote attacker can execute arbitrary operating system commands with root privileges via crafted HTTP requests.

[Mitigation] Apply the latest firmware updates from the respective vendors and restrict network access to the device management interfaces.

[Affected Scope] Oracle WebLogic Server versions 10.3.6.0.0 and 12.1.3.0.0

[Impact] Unauthenticated remote attackers can gain full control of the WebLogic Server and execute arbitrary system commands via malicious HTTP requests

[Mitigation] Apply the official Oracle security patches immediately, or disable/remove the unused wls9-async and wls-wsat components

[Affected Scope] Kentico CMS versions 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and all 9.x versions

[Impact] Unauthenticated remote attackers can bypass authentication and execute arbitrary .NET object deserialization, leading to full remote code execution on the host server

[Mitigation] Immediately apply the official vendor hotfixes or restrict external network access to the Kentico Staging Service endpoints

[Affected Scope] Kibana versions before 5.6.15 and 6.6.1

[Impact] Unauthenticated attackers can exploit a prototype pollution flaw in the Timelion visualizer to execute arbitrary shell commands with the privileges of the Kibana process on the host system.

[Mitigation] Immediately upgrade Kibana to version 5.6.15, 6.6.1, or later, or disable the Timelion application in the configuration file.

[Affected Scope] Atlassian Confluence Server and Data Center before 6.6.12, 6.7.0 to before 6.12.3, 6.13.0 to before 6.13.3, and 6.14.0 to before 6.14.2

[Impact] Unauthenticated remote attackers can achieve path traversal and execute arbitrary code (RCE) on the host server via Server-Side Template Injection (SSTI)

[Mitigation] Immediately upgrade Confluence to the patched versions (6.6.12, 6.12.3, 6.13.3, 6.14.2 or later) or disable the Widget Connector macro

[Affected Scope] Sonatype Nexus Repository Manager versions prior to 3.15.0

[Impact] Unauthenticated remote attackers can execute arbitrary Groovy scripts and gain full system-level control by sending specially crafted HTTP POST requests

[Mitigation] Immediately upgrade to the latest stable version (3.15.0 or higher) or restrict external access to the vulnerable endpoints

[Affected Scope] Microsoft SharePoint Server 2010, 2013, 2016, 2019, and SharePoint Foundation 2013

[Impact] Unauthenticated remote attackers can execute arbitrary code with the privileges of the SharePoint IIS application pool (w3wp.exe) by sending a specially crafted application package, leading to complete system compromise

[Mitigation] Immediately apply the official Microsoft security updates and perform compromise assessments on internet-facing SharePoint servers

[Affected Scope] NoneCms V1.3 and underlying ThinkPHP 5.x framework-based web applications

[Impact] Unauthenticated remote attackers can execute arbitrary PHP code and gain full control of the target server by sending crafted HTTP requests

[Mitigation] Upgrade the ThinkPHP framework to the latest secure version, apply patches to NoneCms, or deploy Web Application Firewall (WAF) rules

[Affected Scope] Jenkins weekly version 2.153 and earlier, LTS version 2.138.3 and earlier utilizing the Stapler web framework.

[Impact] Unauthenticated remote attackers can invoke arbitrary methods on Java objects by sending crafted URLs, leading to full Remote Code Execution (RCE) under system privileges.

[Mitigation] Immediately upgrade Jenkins weekly to version 2.154 or later, and LTS to version 2.138.4 or later.

[Affected Scope] Paessler PRTG Network Monitor versions prior to 18.2.40.1683

[Impact] Unauthenticated remote attackers can exploit a Local File Inclusion (LFI) vulnerability to create unauthorized accounts with administrative privileges, leading to full system compromise

[Mitigation] Immediately upgrade PRTG Network Monitor to version 18.2.40.1683 or later and restrict external access to the web console

[Affected Scope] All Java-based web applications utilizing RichFaces Framework versions 3.0.0 through 3.3.4.

[Impact] A remote, unauthenticated attacker can execute arbitrary system commands and fully compromise the host by sending a crafted chain of serialized Java objects.

[Mitigation] Migrate legacy RichFaces 3.X applications to supported frameworks, or restrict external access to the vulnerable '/org.ajax4jsf.resource.UserResource' path using WAF rules or servlet filters.

[Affected Scope] NUUO NVRmini network video recorder devices

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending crafted HTTP requests

[Mitigation] Apply the latest firmware updates, restrict external internet access to the management interface, and implement firewall rules

[Affected Scope] Drupal Core 7.x and 8.x versions (prior to 7.59, 8.5.3, and 8.4.8)

[Impact] Unauthenticated remote attackers can exploit multiple attack vectors to execute arbitrary code and fully compromise the target Drupal site

[Mitigation] Immediately upgrade Drupal Core to the patched versions (7.59, 8.5.3, 8.4.8, or higher)

[Affected Scope] Quest KACE System Management Appliance (SMA) 8.0.318 and prior versions

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with high privileges by sending specially crafted HTTP requests

[Mitigation] Apply official vendor patches immediately and restrict external internet access to the management interface

[Affected Scope] Adobe ColdFusion 2016 Update 5 and earlier, ColdFusion 11 Update 13 and earlier

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by exploiting a deserialization of untrusted data (CWE-502)

[Mitigation] Immediately apply the official Adobe security patch (APSB18-14) and restrict external access to RMI and management ports

[Affected Scope] Dasan GPON home routers

[Impact] Unauthenticated remote attackers can execute arbitrary system commands and gain full control of the device by sending specially crafted HTTP requests

[Mitigation] Apply the latest firmware updates from the vendor, disable external WAN-side management access, and restrict access to trusted networks

[Affected Scope] Oracle WebLogic Server versions 10.3.6.0, 12.1.3.0, 12.2.1.2, and 12.2.1.3

[Impact] Unauthenticated remote attackers can exploit this vulnerability via the T3 protocol to execute arbitrary code and completely take over the WebLogic Server

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict external T3 protocol access (Port 7001) using connection filters or firewalls

[Affected Scope] Spring Data Commons versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions.

[Impact] Unauthenticated remote attackers can execute arbitrary system commands on the target server by sending specially crafted HTTP request parameters.

[Mitigation] Immediately upgrade Spring Data Commons to version 1.13.11, 2.0.6, or later, and apply input validation controls.