CVE Vulnerability Advisory Database

[Affected Scope] Sitecore Experience Platform (XP) 7.5 Initial Release to Sitecore XP 8.2 Update-7.

[Impact] Unauthenticated remote attackers can execute arbitrary commands with system privileges on the hosting server by sending specially crafted serialized payloads.

[Mitigation] Apply official security patches immediately or restrict external access to the vulnerable '/sitecore/shell/ClientBin/Reporting/ReportService.asmx' endpoint.

[Affected Scope] BQE BillQuick Web Suite 2018 through 2021 before version 22.0.9.1

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with MSSQLSERVER$ privileges via SQL injection and xp_cmdshell activation, potentially deploying ransomware

[Mitigation] Immediately upgrade BillQuick Web Suite to version 22.0.9.1 or higher, disable xp_cmdshell on the database, and apply WAF rules

[Affected Scope] Yealink Device Management (DM) server version 3.6.0.20 and prior.

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending crafted requests to a vulnerable API endpoint.

[Mitigation] Immediately apply the latest official security patches and restrict external internet access to the management console.

[Affected Scope] Google Chrome prior to version 94.0.4606.61 on desktop platforms

[Impact] A remote attacker who has compromised the renderer process can potentially bypass the Chrome sandbox and execute arbitrary code on the host system via a crafted HTML page

[Mitigation] Immediately update Google Chrome to the latest stable version (94.0.4606.61 or higher) and enforce automatic updates across enterprise endpoints

[Affected Scope] Google Chrome prior to version 93.0.4577.82

[Impact] A remote attacker who has compromised the renderer process can potentially execute arbitrary code and escape the browser sandbox via a crafted HTML page

[Mitigation] Immediately update Google Chrome to the latest stable version (93.0.4577.82 or higher)

[Affected Scope] Apache HTTP Server versions 2.4.49 and 2.4.50

[Impact] Unauthenticated remote attackers can exploit this vulnerability to access sensitive files outside the document root or execute arbitrary commands if CGI scripts are enabled

[Mitigation] Immediately upgrade Apache HTTP Server to version 2.4.51 or later, and enforce strict directory access controls

[Affected Scope] Apache HTTP Server version 2.4.49.

[Impact] Attackers can exploit this vulnerability using specially crafted URLs to access sensitive files outside the document root or execute arbitrary commands (RCE) if CGI scripts are enabled.

[Mitigation] Immediately upgrade to the latest stable version (2.4.51 or higher) and enforce strict directory access controls ('Require all denied').

[Affected Scope] Citrix ShareFile Storage Zones Controller versions prior to 5.11.20

[Impact] Unauthenticated remote attackers can bypass access controls to compromise the storage zones controller, potentially leading to arbitrary code execution and data exfiltration

[Mitigation] Immediately upgrade to Citrix ShareFile Storage Zones Controller 5.11.20 or later, and restrict external access to administrative endpoints

[Affected Scope] VMware vCenter Server versions 6.7 and 7.0 running the Analytics (CEIP) service

[Impact] Unauthenticated attackers with network access to port 443/TCP can upload arbitrary files and execute remote code with system privileges

[Mitigation] Apply official vendor patches immediately, or implement the temporary workaround to disable the vulnerable Analytics endpoint

[Affected Scope] Web server software embedded in various Hikvision IP cameras and Network Video Recorders (NVRs)

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending specially crafted HTTP requests, leading to full device compromise

[Mitigation] Immediately upgrade to the latest patched firmware version provided by the vendor and restrict direct internet access to the devices

[Affected Scope] Apache HTTP Server versions 2.4.48 and earlier with mod_proxy enabled

[Impact] Unauthenticated remote attackers can craft malicious URI paths to force mod_proxy to forward requests to an arbitrary origin server, leading to SSRF

[Mitigation] Immediately upgrade Apache HTTP Server to version 2.4.49 or later, or apply strict RewriteRules to block malicious proxy requests

[Affected Scope] Certain Dahua IP cameras, NVRs, XVRs, and thermal cameras

[Impact] Attackers can bypass identity authentication during the login process by sending crafted malicious packets, gaining full administrative control

[Mitigation] Immediately apply the latest firmware updates from the vendor and restrict direct internet access to the devices

[Affected Scope] Certain Dahua IP cameras, NVRs, DVRs, and associated firmware versions

[Impact] Attackers can completely bypass the identity authentication process during login and gain full administrative control of the device

[Mitigation] Immediately apply the latest firmware updates provided by the vendor and restrict external network access to the devices

[Affected Scope] Open Management Infrastructure (OMI) versions prior to 1.6.8-1, commonly deployed automatically on Microsoft Azure Linux Virtual Machines

[Impact] Unauthenticated remote attackers can execute arbitrary commands with root privileges on the target system by sending a specially crafted HTTP/S request

[Mitigation] Immediately upgrade the OMI package to version 1.6.8-1 or higher, and restrict network access to OMI ports (5985, 5986) using firewalls

[Affected Scope] Aviatrix Controller 6.x versions prior to 6.5-1804.1922

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by exploiting directory traversal and unrestricted file upload vulnerabilities

[Mitigation] Immediately upgrade Aviatrix Controller to version 6.5-1804.1922 or later, and restrict external access to the management interface

[Affected Scope] Zoho ManageEngine ADSelfService Plus version 6113 and prior

[Impact] Unauthenticated remote attackers can bypass REST API authentication and execute arbitrary code with SYSTEM privileges

[Mitigation] Immediately upgrade to build 6114 or later and inspect systems for Indicators of Compromise (IoCs)

[Affected Scope] Zoho ManageEngine ServiceDesk Plus versions prior to 11302

[Impact] Unauthenticated remote attackers can bypass authentication mechanisms to access sensitive REST-API endpoints, potentially leading to full system compromise

[Mitigation] Immediately upgrade ServiceDesk Plus to build 11302 or higher and restrict external access to API endpoints

[Affected Scope] Atlassian Confluence Server and Data Center versions prior to 6.13.23, 6.14.0 to < 7.4.11, 7.5.0 to < 7.11.6, and 7.12.0 to < 7.12.5

[Impact] An unauthenticated, remote attacker can execute arbitrary OS commands with system privileges on the target instance by sending a specially crafted HTTP request.

[Mitigation] Immediately upgrade Confluence instances to the patched versions (6.13.23, 7.4.11, 7.11.6, 7.12.5, or later) or apply the vendor-provided workaround scripts.

[Affected Scope] October CMS versions prior to Build 472 and v1.1.5 (affecting the october/system package)

[Impact] An attacker can bypass authentication and gain full access to any user account, including administrators, by sending a specially crafted password reset request.

[Mitigation] Immediately upgrade October CMS to Build 472, v1.1.5, or a newer version.

[Affected Scope] IoT and network devices utilizing Realtek Jungle SDK versions v2.x through v3.4.14B

[Impact] Unauthenticated remote attackers can exploit stack buffer overflows and command injection flaws to execute arbitrary code with root privileges, leading to full device compromise

[Mitigation] Apply the latest firmware updates from the respective device manufacturers and restrict external access to the web management interface