CVE Vulnerability Advisory Database

[Affected Scope] Apache Struts framework versions 2.0.0 through 2.3.15

[Impact] Remote attackers can execute arbitrary OGNL expressions via crafted 'action:', 'redirect:', or 'redirectAction:' parameter prefixes, leading to full system compromise

[Mitigation] Immediately upgrade Apache Struts to version 2.3.15.1 or higher, or implement strict WAF rules to block vulnerable parameter prefixes

[Affected Scope] Oracle Java 7 Update 10 and earlier versions (all versions prior to Java 7 Update 11).

[Impact] Remote attackers can completely bypass the JVM security sandbox and execute arbitrary system commands with the privileges of the running user by enticing them to visit a malicious web page containing a crafted Java applet.

[Mitigation] Immediately upgrade to Oracle Java 7 Update 11 or later (or migrate to modern LTS versions like Java 8/11/17), and disable the Java browser plug-in across all enterprise endpoints.

[Affected Scope] Oracle Fusion Middleware versions 11.1.1.4, 11.1.1.6, and 11.1.2.0 within the Oracle Reports Developer component.

[Impact] Unauthenticated remote attackers can read or upload arbitrary files via the URLPARAMETER functionality, which can be chained with CVE-2012-3153 to achieve Remote Code Execution (RCE) via JSP web shell upload.

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict external access to the rwservlet endpoint and implement strict URL filtering.

[Affected Scope] Oracle Java SE 7 Update 7 and earlier versions of the JRE (Java Runtime Environment)

[Impact] Unauthenticated remote attackers can completely compromise system confidentiality, integrity, and availability, leading to Remote Code Execution (RCE)

[Mitigation] Immediately upgrade to Java SE 7 Update 9 or later, and restrict JAX-WS class loading in legacy environments

[Affected Scope] Oracle Java SE 7 Update 6 and earlier JRE (Java Runtime Environment) versions

[Impact] Remote attackers can completely bypass SecurityManager restrictions and execute arbitrary code with elevated privileges via a crafted malicious applet

[Mitigation] Immediately upgrade to Java SE 7 Update 7 or later, or disable the Java browser plugin across all endpoints

[Affected Scope] PHP versions before 5.3.12 and 5.4.x before 5.4.2, configured to run as a CGI script (php-cgi)

[Impact] Unauthenticated remote attackers can execute arbitrary code by injecting command-line options via HTTP query strings

[Mitigation] Upgrade to patched PHP versions or configure web server rewrite rules to block malicious query strings

[Affected Scope] Apache Struts versions prior to 2.2.3.1

[Impact] Unauthenticated remote attackers can execute arbitrary Java code with system privileges on the target server by sending crafted HTTP request parameters.

[Mitigation] Immediately upgrade Apache Struts to version 2.2.3.1 or later secure releases.

[Affected Scope] Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (memory corruption) via a specially crafted PDF document containing malicious U3D data

[Mitigation] Apply the official security patches immediately, or disable the vulnerable U3D parsing component (rt3d.dll) as a temporary workaround

[Affected Scope] Oracle Java SE and Java for Business 6 Update 18 and earlier, 5.0 Update 23 and earlier, and 1.4.2_25 and earlier

[Impact] Remote attackers can completely bypass Java sandbox restrictions and execute arbitrary code with the privileges of the running process, compromising confidentiality, integrity, and availability

[Mitigation] Immediately upgrade to the latest patched Java SE versions, disable Java browser plugins, and decommission unsupported legacy JRE environments

[Affected Scope] phpMyAdmin versions 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1

[Impact] Unauthenticated remote attackers can inject arbitrary PHP code into the configuration file via the setup.php save action, leading to full system compromise

[Mitigation] Upgrade to patched versions immediately, or delete/restrict access to the setup.php script in production environments

[Affected Scope] Unified Maintenance Tool in Alcatel-Lucent OmniPCX Enterprise Communication Server R7.1 and earlier.

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending crafted HTTP requests containing shell metacharacters.

[Mitigation] Immediately upgrade to the patched firmware version and restrict external network access to the management CGI interface.

[Affected Scope] HP OpenView Network Node Manager (NNM) versions 6.2 through 7.50 are affected.

[Impact] Remote attackers can execute arbitrary system commands with web server privileges without authentication by injecting shell metacharacters into vulnerable OVPL scripts.

[Mitigation] Restrict external access to the vulnerable OVPL scripts immediately and apply official vendor patches or upgrade to a supported version.