CVE Vulnerability Advisory Database

[Affected Scope] Apache Tomcat versions before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12, when JmxRemoteLifecycleListener is enabled

[Impact] Remote attackers with network access to JMX ports can trigger untrusted deserialization without authentication, leading to arbitrary Remote Code Execution (RCE) with system privileges

[Mitigation] Upgrade Apache Tomcat to the latest secure release, or disable JmxRemoteLifecycleListener in server.xml and restrict network access to JMX ports using firewalls

[Affected Scope] Microsoft Internet Information Services (IIS) 6.0 with WebDAV service enabled on Windows Server 2003 R2.

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges and fully compromise the host by sending a specially crafted HTTP PROPFIND request.

[Mitigation] Since Windows Server 2003 is End-of-Life (EoL), immediately migrate to a supported OS version or disable the IIS WebDAV service.

[Affected Scope] Cisco IOS and IOS XE-based Catalyst switches and embedded service modules configured to accept Telnet connections and utilizing CMP

[Impact] Unauthenticated, remote attackers can execute arbitrary code with elevated privileges or cause a device reload by sending malformed CMP-specific Telnet options

[Mitigation] Apply official Cisco software updates immediately, or disable Telnet services and restrict VTY access using infrastructure ACLs

[Affected Scope] Web applications built on Apache Struts 2.3.x (before 2.3.32) and 2.5.x (before 2.5.10.1)

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with system privileges via crafted HTTP headers such as Content-Type

[Mitigation] Immediately upgrade Apache Struts to a secure version (2.3.32, 2.5.10.1, or higher) and apply WAF rules to block malicious OGNL payloads

[Affected Scope] All PHP web applications utilizing PHPMailer versions prior to 5.2.18

[Impact] Remote attackers can exploit the vulnerability to execute arbitrary code on the target server by manipulating the Sender (From) field

[Mitigation] Immediately upgrade the PHPMailer library to the latest stable version (5.2.18 or higher)

[Affected Scope] All Java applications utilizing Apache Shiro versions prior to 1.2.5

[Impact] Remote attackers can leverage the hardcoded default AES encryption key to send malicious serialized objects, leading to arbitrary code execution (RCE) or access control bypass

[Mitigation] Immediately upgrade Apache Shiro to version 1.2.5 or higher, and explicitly configure a unique, secure random cipher key for the RememberMe service

[Affected Scope] Apache ActiveMQ 5.x before 5.14.0 with the Fileserver web application enabled

[Impact] Unauthenticated remote attackers can upload and execute arbitrary JSP files via HTTP PUT and MOVE requests, leading to complete system compromise

[Mitigation] Upgrade Apache ActiveMQ to version 5.14.0 or later, or disable the Fileserver web application in the jetty.xml configuration

[Affected Scope] SAP NetWeaver Application Server Java platforms, typically prior to version 7.3

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands and Java code via crafted HTTP/HTTPS requests (CVSS 10.0)

[Mitigation] Apply SAP Note 1445998 and disable the Invoker Servlet globally in the web.xml configuration

[Affected Scope] Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9

[Impact] Remote attackers can execute arbitrary code without authentication by sending malicious serialized objects to the JMX service port, leading to complete system compromise

[Mitigation] Apply the latest Oracle Java SE security updates, restrict external access to JMX ports, and enforce robust authentication and SSL/TLS

[Affected Scope] IBM WebSphere Application Server and associated business, analytics, and mobile solutions utilizing vulnerable Apache Commons Collections library versions

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with system privileges by sending crafted serialized Java objects to exposed interfaces

[Mitigation] Apply official IBM security patches (Interim Fixes) immediately, or implement JVM-level deserialization filters to block the InvokerTransformer class

[Affected Scope] Oracle WebLogic Server versions 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0

[Impact] Unauthenticated remote attackers can execute arbitrary system commands via a crafted serialized Java object sent over the T3 protocol to TCP port 7001

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict external access to the T3 protocol using WebLogic Connection Filters

[Affected Scope] Adobe Flash Player 13.x through 18.x and 11.x legacy versions on Windows, OS X, and Linux

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content

[Mitigation] Since Adobe Flash Player has reached End-of-Life (EOL), the recommended mitigation is to completely uninstall Flash Player from all systems

[Affected Scope] Routers and embedded devices utilizing the Realtek SDK with the miniigd UPnP SOAP service enabled

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending crafted SOAP requests, leading to complete device compromise

[Mitigation] Disable the UPnP service, block external access to port 52869/TCP, and apply the latest firmware updates from the device vendor

[Affected Scope] Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 R2 running IIS (Internet Information Services).

[Impact] Remote unauthenticated attackers can execute arbitrary code with SYSTEM privileges or trigger a Blue Screen of Death (BSOD), leading to complete system compromise or infrastructure denial of service.

[Mitigation] Apply the official Microsoft MS15-034 security patch immediately, or disable IIS Kernel Caching as a temporary workaround.

[Affected Scope] Adobe Flash Player before 13.0.0.269, 14.x through 16.x before 16.0.0.305 on Windows and OS X, and before 11.2.202.442 on Linux

[Impact] Remote attackers can execute arbitrary code (RCE) and gain full system control via specially crafted malicious Flash content (SWF) without user interaction

[Mitigation] Since Adobe Flash Player has reached End-of-Life (EOL), the only secure mitigation is to completely uninstall Flash Player from all systems

[Affected Scope] Rejetto HTTP File Server (HFS) 2.3x versions prior to 2.3c

[Impact] Unauthenticated remote attackers can execute arbitrary system commands and gain full control of the host by sending crafted HTTP requests

[Mitigation] Immediately upgrade to a patched version (2.3c or later) or decommission the legacy HFS service in favor of secure alternatives

[Affected Scope] All Linux and Unix-like systems running GNU Bash versions up to and including 4.3

[Impact] Remote unauthenticated attackers can execute arbitrary system commands and gain full control of the target server by manipulating environment variables

[Mitigation] Immediately update GNU Bash to the latest patched version using your operating system package manager

[Affected Scope] NTWebServer component in InduSoft Web Studio versions prior to 7.1 SP2 Patch 4

[Impact] Unauthenticated remote attackers can exploit directory traversal to read administrative passwords in APP files, leading to arbitrary remote code execution (RCE)

[Mitigation] Upgrade InduSoft Web Studio to version 7.1 SP2 Patch 4 or later, and restrict external access to the NTWebServer port

[Affected Scope] HP ProCurve Manager (PCM) 3.20/4.0, PCM+ 3.20/4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management.

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending a specially crafted marshalled object.

[Mitigation] Restrict external access to the vulnerable EJBInvokerServlet and JMXInvokerServlet endpoints and apply official security patches.

[Affected Scope] Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03

[Impact] Attackers can execute arbitrary code or cause a denial of service (memory corruption) via crafted PDF files

[Mitigation] Immediately upgrade to patched versions (9.5.5, 10.1.7, 11.0.03 or later) and enforce sandbox security policies