CVE Vulnerability Advisory Database

[Affected Scope] Craft CMS installations running versions prior to 4.4.15

[Impact] Unauthenticated remote attackers can execute arbitrary PHP code and fully compromise the underlying server by sending crafted HTTP requests

[Mitigation] Immediately upgrade Craft CMS to version 4.4.15 or later to resolve the vulnerability

[Affected Scope] Ruckus Wireless Admin and AP controller devices running version 10.4 or lower

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending a specially crafted HTTP GET request

[Mitigation] Immediately apply the official vendor firmware patches and restrict access to the management interface from the public internet

[Affected Scope] Citrix ADC and Citrix Gateway versions 12.1 and 13.0 with SAML SP or IdP configuration enabled

[Impact] Unauthenticated remote attackers can execute arbitrary code on the target appliance and gain full system control by sending specially crafted requests

[Mitigation] Immediately upgrade to the patched firmware versions (12.1-65.25, 13.0-88.16, or higher) provided by Citrix

[Affected Scope] WatchGuard Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2 on Firebox and XTM appliances

[Impact] An unauthenticated remote attacker can execute arbitrary code with administrative privileges, leading to complete compromise of the firewall appliance

[Mitigation] Immediately upgrade Fireware OS to the patched versions (12.7.2_U2, 12.5.9_U2, 12.1.3_U8 or higher) and restrict external access to management interfaces

[Affected Scope] Yealink Device Management (DM) server version 3.6.0.20 and prior.

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending crafted requests to a vulnerable API endpoint.

[Mitigation] Immediately apply the latest official security patches and restrict external internet access to the management console.

[Affected Scope] Sunhillo SureLine versions prior to 8.7.0.1.1

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands on the target system using shell metacharacters

[Mitigation] Immediately upgrade Sunhillo SureLine to version 8.7.0.1.1 or later, and restrict external network access

[Affected Scope] SaltStack Salt versions before 2019.2.4 and 3000 before 3000.2

[Impact] Unauthenticated remote attackers can bypass authentication via the ClearFuncs class to retrieve master tokens or execute arbitrary commands on connected salt minions

[Mitigation] Immediately upgrade SaltStack to patched versions (2019.2.4, 3000.2, or higher) and restrict access to salt-master ports (4505, 4506)

[Affected Scope] All PlaySMS installations running versions prior to 1.4.3

[Impact] Unauthenticated remote attackers can inject malicious template payloads to execute arbitrary operating system commands, leading to full system compromise

[Mitigation] Immediately upgrade to PlaySMS version 1.4.3 or higher, restrict external access, and deploy Web Application Firewall (WAF) rules

[Affected Scope] DrayTek Vigor2960 (1.3.1_Beta and prior), Vigor3900 (1.4.4_Beta and prior), and Vigor300B (1.3.3_Beta, 1.4.2.1_Beta, 1.4.4_Beta and prior)

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges via the web management interface, leading to complete device compromise

[Mitigation] Immediately upgrade the device firmware to version v1.5.1 or higher, and disable WAN-side web management access

[Affected Scope] Atlassian Crowd and Crowd Data Center from version 2.1.0 up to 3.4.4 (specific minor version ranges)

[Impact] Unauthenticated remote attackers can upload and install arbitrary plugins, leading to complete remote code execution (RCE) on the host system

[Mitigation] Immediately upgrade to the fixed versions (3.0.5, 3.1.6, 3.2.8, 3.3.5, 3.4.4 or later) or disable/remove the pdkinstall plugin

[Affected Scope] ZyXEL P660HN-T1A v1 routers distributed by TrueOnline running TCLinux Firmware v7.3.15.0 v001 / 3.40(ULM.0)b31 or prior

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by manipulating the remote_host parameter in the ViewLog.asp page

[Mitigation] Immediately disable external WAN access to the web management interface, apply the latest firmware updates, or replace legacy end-of-life devices

[Affected Scope] Wireless presentation gateways based on the AWIND OEM platform, including Crestron AM-100/101, Barco wePresent WiPG-1000P/1600W, and Extron ShareLink 200/250.

[Impact] An unauthenticated remote attacker can execute arbitrary operating system commands with root privileges via crafted HTTP requests.

[Mitigation] Apply the latest firmware updates from the respective vendors and restrict network access to the device management interfaces.