CVE Vulnerability Advisory Database

[Affected Scope] WatchGuard Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2 on Firebox and XTM appliances

[Impact] An unauthenticated remote attacker can execute arbitrary code with administrative privileges, leading to complete compromise of the firewall appliance

[Mitigation] Immediately upgrade Fireware OS to the patched versions (12.7.2_U2, 12.5.9_U2, 12.1.3_U8 or higher) and restrict external access to management interfaces

[Affected Scope] Spring Cloud Gateway versions prior to 3.1.1 and 3.0.7, where the Gateway Actuator endpoint is enabled, exposed, and unsecured

[Impact] Unauthenticated remote attackers can execute arbitrary system commands on the host by sending maliciously crafted HTTP requests

[Mitigation] Immediately upgrade Spring Cloud Gateway to version 3.1.1, 3.0.7, or higher, and disable or secure the Gateway Actuator endpoint

[Affected Scope] Redis server instances installed via package managers (apt) on Debian, Ubuntu, and derived Linux distributions

[Impact] Unauthenticated remote attackers can bypass the Lua scripting sandbox to execute arbitrary system commands with the privileges of the Redis process (CVSS 10.0, CISA KEV Listed)

[Mitigation] Apply official OS package updates immediately, or disable EVAL/EVALSHA commands and restrict network access to localhost

[Affected Scope] All hardware revisions of D-Link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges via the DDNS function, leading to full device compromise

[Mitigation] Since these devices have reached End of Life (EOL), no official patches will be released; immediate device replacement or strict access control is required

[Affected Scope] Adobe Commerce and Magento Open Source versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier)

[Impact] Unauthenticated attackers can exploit improper input validation during the checkout process to execute arbitrary code (RCE) without user interaction, potentially leading to full system compromise

[Mitigation] Immediately apply the official Adobe security patches (APSB22-12) and update Web Application Firewall (WAF) rules

[Affected Scope] Apache APISIX versions 1.3 through 2.12.1 (including LTS versions prior to 2.10.4)

[Impact] Remote attackers can bypass IP restrictions on the Admin API and execute arbitrary code on the target server by exploiting default configurations

[Mitigation] Immediately upgrade Apache APISIX to version 2.12.1, 2.10.4 LTS, or later, and rotate default Admin Keys

[Affected Scope] Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers

[Impact] Unauthenticated remote attackers can execute arbitrary code, elevate privileges, bypass authentication, and run unsigned software to fully compromise the device

[Mitigation] Immediately apply the latest firmware patches provided by Cisco and disable remote WAN management access

[Affected Scope] Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers

[Impact] Unauthenticated remote attackers can execute arbitrary code with root privileges or cause a complete system compromise via the SSL VPN gateway

[Mitigation] Immediately upgrade to the latest patched firmware versions provided by Cisco, and restrict access to the SSL VPN port from untrusted networks

[Affected Scope] SAP NetWeaver AS ABAP, AS Java, ABAP Platform, SAP Content Server 7.53, and SAP Web Dispatcher

[Impact] Unauthenticated attackers can prepend arbitrary data to a victim's request, enabling session hijacking, cache poisoning, and complete compromise of system Confidentiality, Integrity, and Availability

[Mitigation] Immediately apply the official SAP security patches (SAP Note 3123396) and restrict anomalous HTTP request headers at the reverse proxy or WAF level

[Affected Scope] Oracle Access Manager within Oracle Fusion Middleware, versions 11.1.2.3.0, 12.2.1.3.0, and 12.2.1.4.0

[Impact] Unauthenticated remote attackers can gain full control of the Oracle Access Manager system and execute arbitrary code via HTTP network access

[Mitigation] Immediately apply the official Oracle Critical Patch Update (CPU) and restrict external access to OpenSSO Agent endpoints

[Affected Scope] NUUO NVRmini2 firmware versions up to and including 3.11.

[Impact] Unauthenticated attackers can add arbitrary users and, when chained with CVE-2011-5325, overwrite files under the web root to execute arbitrary code as root.

[Mitigation] Immediately restrict external access to the device, apply the latest firmware updates, or implement strict access control lists.

[Affected Scope] Zabbix Frontend versions 4.0.36, 5.0.18, 5.4.8, 6.0.0-alpha7 and below with SAML SSO enabled

[Impact] Unauthenticated remote attackers can modify session data to bypass authentication, escalating privileges to gain full administrative access

[Mitigation] Immediately upgrade Zabbix Frontend to patched versions (4.0.37, 5.0.19, 5.4.9, 6.0.0-beta1 or later) or disable SAML authentication

[Affected Scope] Apache Log4j versions 2.0-beta9 to 2.15.0 (including 2.15.0 for Java 8 and 2.12.1 or below for Java 7)

[Impact] Attackers can exploit JNDI Lookup patterns via Thread Context Map (MDC) inputs in non-default configurations to achieve remote code execution (RCE) or information leakage

[Mitigation] Immediately upgrade Apache Log4j to version 2.16.0 (for Java 8+) or 2.12.2 (for Java 7+), which disables JNDI by default and removes message lookup support

[Affected Scope] Zoho ManageEngine Desktop Central and Desktop Central MSP (Enterprise/MSP builds 10.1.2127.17 and earlier, and 10.1.2128.0 through 10.1.2137.2)

[Impact] Unauthenticated remote attackers can bypass authentication filters to execute arbitrary code with SYSTEM privileges on the server, actively exploited in the wild

[Mitigation] Immediately upgrade to the patched versions (10.1.2127.18 or 10.1.2137.3 or later) depending on your current build branch

[Affected Scope] Java applications utilizing Apache Log4j2 (log4j-core) versions 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1)

[Impact] Unauthenticated remote attackers can execute arbitrary code by forcing the application to load malicious Java classes from attacker-controlled LDAP or other JNDI-related endpoints, leading to full system compromise (CVSS 10.0 Critical)

[Mitigation] Immediately upgrade Log4j2 to the latest secure version (2.17.1 or higher; or 2.12.4 / 2.3.2 depending on Java version), or apply workarounds such as removing the JndiLookup class

[Affected Scope] Ivanti Endpoint Manager Cloud Services Appliance (CSA) versions 4.5 and 4.6

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with limited privileges ('nobody') by sending specially crafted HTTP requests.

[Mitigation] Immediately apply the official security patches provided by Ivanti and restrict access to the CSA management interface from the public internet.

[Affected Scope] SonicWall SMA 200, 210, 400, 410, and 500v appliances running firmware versions 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv, and earlier

[Impact] A remote unauthenticated attacker can execute arbitrary code with 'nobody' user privileges on the appliance by sending a specially crafted HTTP request, potentially leading to full system compromise

[Mitigation] Immediately upgrade the appliance firmware to the patched version (10.2.1.3-27sv or higher) and restrict external access to the management interface

[Affected Scope] All versions of the ajaxpro.2 (Ajax.NET Professional) package

[Impact] Unauthenticated remote attackers can exploit the deserialization of untrusted data to instantiate arbitrary .NET classes, leading to Remote Code Execution (RCE)

[Mitigation] Apply the official security patch from the upstream repository, restrict unused AjaxPro handlers, or deploy WAF rules

[Affected Scope] Zoho ManageEngine ServiceDesk Plus (before 11306), ServiceDesk Plus MSP (before 10530), and SupportCenter Plus (before 11014).

[Impact] Unauthenticated remote attackers can bypass authentication to upload and execute malicious files, gaining full system-level control over the target server.

[Mitigation] Immediately apply the official vendor patches, restrict external access to vulnerable endpoints, and perform a comprehensive log audit for Indicators of Compromise (IoCs).

[Affected Scope] Roundcube versions before 1.3.17 and 1.4.x versions before 1.4.12

[Impact] Unauthenticated attackers can manipulate search parameters to extract sensitive database information or potentially achieve remote code execution (RCE)

[Mitigation] Immediately upgrade Roundcube to the latest stable releases (1.3.17, 1.4.12, or higher)