CVE Vulnerability Advisory Database

[Affected Scope] Zoho ManageEngine Password Manager Pro before 12101, PAM360 before 5510, and Access Manager Plus before 4303

[Impact] Unauthenticated (or authenticated for Access Manager Plus) attackers can execute arbitrary code with system privileges by sending malicious XML-RPC requests

[Mitigation] Immediately upgrade to the patched versions (Password Manager Pro 12101, PAM360 5510, Access Manager Plus 4303 or higher)

[Affected Scope] dotCMS versions 3.0 through 22.02

[Impact] Unauthenticated attackers can upload malicious JSP files via directory traversal when anonymous content creation is enabled, leading to full Remote Code Execution (RCE)

[Mitigation] Immediately upgrade to patched dotCMS versions (22.03 or higher) and disable anonymous content creation APIs if not required

[Affected Scope] Atlassian Confluence Server and Data Center versions from 1.3.0 before 7.4.17, and specific release lines up to 7.18.1

[Impact] An unauthenticated remote attacker can execute arbitrary Java code on the Confluence instance with system privileges, leading to full host compromise.

[Mitigation] Immediately upgrade Confluence to the patched versions (7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, 7.18.1 or higher) or apply the vendor-provided workaround JAR files.

[Affected Scope] Contec SolarView Compact version 6.00 and prior.

[Impact] Unauthenticated attackers can execute arbitrary OS commands via the web interface, leading to complete system compromise.

[Mitigation] Apply the latest firmware updates immediately and restrict external internet access to the management interface.

[Affected Scope] Zyxel USG FLEX, ATP, and VPN series firewalls running vulnerable firmware versions (with ZTP enabled)

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges by sending crafted HTTP POST requests, leading to complete device compromise

[Mitigation] Immediately upgrade to the patched firmware versions recommended by Zyxel and restrict external access to the management interface

[Affected Scope] F5 BIG-IP versions 16.1.x (prior to 16.1.2.2), 15.1.x (prior to 15.1.5.1), 14.1.x (prior to 14.1.4.6), 13.1.x (prior to 13.1.5), and all end-of-support 12.1.x and 11.6.x versions

[Impact] Unauthenticated remote attackers can bypass iControl REST authentication via crafted HTTP requests, enabling them to execute arbitrary system commands with root privileges on the target system

[Mitigation] Immediately upgrade to the patched versions, restrict access to the management interface, or apply temporary workarounds such as modifying self-IP port lockdown settings

[Affected Scope] Apache CouchDB installations prior to version 3.2.2

[Impact] Unauthenticated attackers can bypass authentication, gain administrative privileges, and execute arbitrary code via Erlang distribution ports

[Mitigation] Upgrade Apache CouchDB to version 3.2.2 or higher, and restrict access to Erlang ports (4369, 9100-9200) using a firewall

[Affected Scope] Mitel MiVoice Connect through 19.2 SP3 Service Appliances (SA 100, SA 400, and Virtual SA).

[Impact] Unauthenticated remote attackers can exploit incorrect data validation to execute arbitrary code and gain full control over the affected appliance.

[Mitigation] Apply the official security patches immediately and restrict access to the management interfaces from the public internet.

[Affected Scope] Oracle Fusion Middleware - Oracle Application Development Framework (ADF) versions 12.2.1.3.0 and 12.2.1.4.0

[Impact] Unauthenticated remote attackers can execute arbitrary code and completely compromise the host system via HTTP network access

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately or restrict external access to vulnerable ADF endpoints

[Affected Scope] WSO2 API Manager (2.2.0 to 4.0.0), Identity Server (5.2.0 to 5.11.0), Enterprise Integrator (6.2.0 to 6.6.0), and other major WSO2 products

[Impact] Unauthenticated attackers can upload and execute arbitrary JSP files via a crafted HTTP request, leading to complete system compromise

[Mitigation] Apply official WSO2 security patches immediately, restrict external access to the '/fileupload' endpoint, and disable execution permissions in web root subdirectories

[Affected Scope] Java applications utilizing JAI-EXT library versions prior to 1.2.22, including downstream GeoServer deployments.

[Impact] Unauthenticated remote attackers can execute arbitrary Java code on the target server by injecting malicious Jiffle scripts, leading to complete system compromise.

[Mitigation] Immediately upgrade JAI-EXT to version 1.2.22 or higher, or temporarily remove the Janino compiler JAR file from the classpath.

[Affected Scope] Specific versions of VMware Workspace ONE Access and Identity Manager

[Impact] Unauthenticated remote attackers with network access can execute arbitrary system commands on the target server, posing a critical risk (CVSS 9.8)

[Mitigation] Immediately apply the official security patches (VMSA-2022-0011) or implement temporary workarounds to restrict external access

[Affected Scope] Spring MVC or Spring WebFlux applications running on JDK 9+ and deployed as a WAR on Apache Tomcat.

[Impact] Unauthenticated remote attackers can manipulate HTTP request parameters to modify Tomcat logging configurations and upload a web shell, leading to complete system compromise.

[Mitigation] Immediately upgrade Spring Framework to secure versions (5.3.18+, 5.2.20+) or update the corresponding Spring Boot parent version.

[Affected Scope] Spring Cloud Function versions 3.1.6, 3.2.2, and older unsupported versions

[Impact] Unauthenticated remote attackers can inject malicious SpEL expressions via HTTP headers to execute arbitrary system commands and access local resources.

[Mitigation] Immediately upgrade Spring Cloud Function to version 3.1.7, 3.2.3, or higher, and block suspicious routing headers using WAF rules.

[Affected Scope] Trend Micro Apex Central On-Premise deployments (SaaS deployments are unaffected)

[Impact] Unauthenticated remote attackers can upload malicious web shells to execute arbitrary commands with system privileges, leading to complete infrastructure compromise

[Mitigation] Immediately apply the official hotfixes/patches provided by Trend Micro and restrict external access to the management console

[Affected Scope] D-Link DIR-820L firmware version 1.05B03 and prior.

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges via crafted HTTP POST requests, leading to full device compromise.

[Mitigation] Since this device is End-of-Life (EOL), immediate replacement of the hardware is highly recommended. Alternatively, disable remote management and restrict access.

[Affected Scope] Sophos Firewall v18.5 MR3 and older versions with User Portal and Webadmin interfaces enabled.

[Impact] Remote attackers can bypass authentication to execute arbitrary code, potentially leading to full firewall compromise and internal network intrusion.

[Mitigation] Apply the official firmware patches immediately and disable WAN-side access to the Webadmin and User Portal interfaces.

[Affected Scope] Apple iOS versions prior to 15.3, iPadOS versions prior to 15.3, macOS Big Sur versions prior to 11.6.3, and macOS Monterey versions prior to 12.2

[Impact] A malicious application can exploit this vulnerability to execute arbitrary code with kernel privileges, leading to complete system compromise. Active exploitation in the wild has been reported

[Mitigation] Immediately apply the official software updates provided by Apple to patch the vulnerable kernel components

[Affected Scope] Veeam Backup & Replication versions 10.x and 11.x

[Impact] Unauthenticated remote attackers can execute arbitrary code with SYSTEM privileges, leading to backup data theft and infrastructure compromise

[Mitigation] Immediately apply the official vendor patch (KB4288) or restrict access to vulnerable ports and services

[Affected Scope] Mitel MiCollab versions prior to 9.4 SP1 FP1 and MiVoice Business Express through version 8.1.

[Impact] Unauthenticated remote attackers can access sensitive system information or abuse the system to launch high-volume DDoS amplification attacks (TP240PhoneHome) globally.

[Mitigation] Apply official vendor security patches immediately and restrict external access to the TP-240 driver port (UDP 10074) via firewalls.