CVE Vulnerability Advisory Database

[Affected Scope] NextGen Healthcare Mirth Connect versions prior to 4.4.1

[Impact] Unauthenticated remote attackers can bypass authentication to execute arbitrary OS commands with system privileges, leading to full host compromise

[Mitigation] Immediately upgrade Mirth Connect to version 4.4.1 or later, and restrict access to administrative ports

[Affected Scope] Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier), and 2023u1 (and earlier)

[Impact] Unauthenticated remote attackers can exploit a Deserialization of Untrusted Data vulnerability (CWE-502) to execute arbitrary code with system privileges

[Mitigation] Immediately apply the official Adobe security patches (APSB23-41), restrict external access, and enable WAF rules

[Affected Scope] Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier), and 2023.0.0.330468 (and earlier)

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending malicious serialized data

[Mitigation] Immediately apply the official Adobe security patch (APSB23-40) and restrict external access to serialization endpoints

[Affected Scope] All on-premises and cloud web application servers running Novi Survey versions prior to 8.9.43676.

[Impact] Unauthenticated remote attackers can execute arbitrary system commands and malicious code under the security context of the web service account.

[Mitigation] Immediately upgrade to the official patched version (8.9.43676 or higher) and restrict external access to the application.

[Affected Scope] Adobe ColdFusion 2018 Update 15 (and earlier) and ColdFusion 2021 Update 5 (and earlier).

[Impact] Successful exploitation allows unauthenticated remote attackers to execute arbitrary code in the context of the current user without any user interaction.

[Mitigation] Immediately apply the official Adobe security patches to upgrade to ColdFusion 2018 Update 16, ColdFusion 2021 Update 6, or later.

[Affected Scope] Zoho ManageEngine Password Manager Pro before 12101, PAM360 before 5510, and Access Manager Plus before 4303

[Impact] Unauthenticated (or authenticated for Access Manager Plus) attackers can execute arbitrary code with system privileges by sending malicious XML-RPC requests

[Mitigation] Immediately upgrade to the patched versions (Password Manager Pro 12101, PAM360 5510, Access Manager Plus 4303 or higher)

[Affected Scope] Oracle Fusion Middleware - Oracle Application Development Framework (ADF) versions 12.2.1.3.0 and 12.2.1.4.0

[Impact] Unauthenticated remote attackers can execute arbitrary code and completely compromise the host system via HTTP network access

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately or restrict external access to vulnerable ADF endpoints

[Affected Scope] All versions of the ajaxpro.2 (Ajax.NET Professional) package

[Impact] Unauthenticated remote attackers can exploit the deserialization of untrusted data to instantiate arbitrary .NET classes, leading to Remote Code Execution (RCE)

[Mitigation] Apply the official security patch from the upstream repository, restrict unused AjaxPro handlers, or deploy WAF rules

[Affected Scope] Sitecore Experience Platform (XP) 7.5 Initial Release to Sitecore XP 8.2 Update-7.

[Impact] Unauthenticated remote attackers can execute arbitrary commands with system privileges on the hosting server by sending specially crafted serialized payloads.

[Mitigation] Apply official security patches immediately or restrict external access to the vulnerable '/sitecore/shell/ClientBin/Reporting/ReportService.asmx' endpoint.

[Affected Scope] ForgeRock Access Manager (AM) versions prior to 7.0 (including OpenAM 14.6.3 and earlier)

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending a single crafted HTTP request

[Mitigation] Immediately upgrade to ForgeRock AM 7.0 or later, or restrict external access to JATO-related endpoints such as /ccversion/*

[Affected Scope] Checkbox Survey versions prior to 7.0, specifically affecting the CheckboxWeb.dll component

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges on the target server via untrusted data deserialization

[Mitigation] Immediately upgrade Checkbox Survey to version 7.0 or higher, and restrict external access to vulnerable endpoints

[Affected Scope] Oracle WebLogic Server versions 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0

[Impact] Unauthenticated remote attackers can exploit T3 or IIOP protocols to achieve complete takeover and execute arbitrary code on the target server

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict/block T3 and IIOP protocol access using connection filters

[Affected Scope] MobileIron Core & Connector versions 10.6.0.0 and earlier, Sentry versions 9.8.0 and earlier, Monitor & RDB versions 2.0.0.1 and earlier

[Impact] Unauthenticated remote attackers can execute arbitrary code with system administrator privileges by sending specially crafted Hessian serialized data

[Mitigation] Immediately apply the official security patches provided by the vendor and restrict external access to sensitive service endpoints

[Affected Scope] Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0

[Impact] Unauthenticated remote attackers can execute arbitrary code and take full control of the Oracle WebLogic Server by sending malicious serialized data via T3 or IIOP protocols

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately, or restrict external access to T3/IIOP protocols using connection filters and firewalls

[Affected Scope] Liferay Portal versions prior to 7.2.1 CE GA2

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by exploiting the JSON web services (JSONWS) API to deserialize untrusted Java objects

[Mitigation] Immediately upgrade Liferay Portal to version 7.2.1 CE GA2 or later, and restrict external access to the JSONWS API endpoints

[Affected Scope] Zoho ManageEngine Desktop Central versions prior to 10.0.474

[Impact] Unauthenticated remote attackers can execute arbitrary code with SYSTEM/Administrator privileges by sending specially crafted serialized Java objects

[Mitigation] Immediately upgrade to version 10.0.474 or higher, and restrict external access to the management ports

[Affected Scope] Oracle Coherence versions 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0, including WebLogic Server environments utilizing these components

[Impact] Unauthenticated remote attackers can exploit this vulnerability via the T3 protocol to execute arbitrary code and achieve complete takeover of the target system

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict external access to the T3/T3S protocols (default port 7001) using connection filters

[Affected Scope] Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0

[Impact] Unauthenticated remote attackers can execute arbitrary code and fully compromise the WebLogic Server via malicious IIOP requests

[Mitigation] Apply the official Oracle CPU patches immediately, or disable the IIOP protocol and restrict access to port 7001

[Affected Scope] Progress Telerik UI for ASP.NET AJAX versions through 2019.3.1023 (and certain configurations prior to 2020.1.114)

[Impact] If encryption keys are compromised or known, attackers can exploit the RadAsyncUpload function to deserialize malicious .NET objects, resulting in unauthorized Remote Code Execution (RCE) on the target web server.

[Mitigation] Upgrade Telerik UI to version 2020.1.114 or later, or immediately modify web.config to disable RadAsyncUpload or rotate the encryption keys.

[Affected Scope] SAP Commerce Cloud (formerly Hybris) versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, and 1905 with the virtualjdbc extension enabled

[Impact] Unauthenticated remote attackers can exploit insecure deserialization to execute arbitrary system commands with 'Hybris' user privileges on the target host

[Mitigation] Apply the official SAP security patch (SAP Note 2786035), disable the unused virtualjdbc extension, or restrict external access to the endpoint