CVE Vulnerability Advisory Database

[Affected Scope] Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8

[Impact] Unauthenticated remote attackers can exploit SQL injection to manipulate the database, bypass authentication, and ultimately execute arbitrary commands with root privileges.

[Mitigation] Immediately upgrade to the official patched versions (10.2.3 / 10.0.8 or higher) and restrict external access to the management interface.

[Affected Scope] Linear eMerge E3-Series physical access control devices (versions 1.00-06 and prior)

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending specially crafted HTTP requests

[Mitigation] Immediately isolate vulnerable devices from the public internet and restrict access using strict firewall rules or apply the latest firmware updates

[Affected Scope] Ubiquiti AirOS prior to v4.0.1 (802.11 ISP), v5.3.5 (AirMax), v5.4.5 (AirSync), and Nanostation5 devices

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges via a specially crafted HTTP GET request

[Mitigation] Immediately upgrade to the patched firmware versions and restrict external access to the web management interface

[Affected Scope] Exim mail server versions 4.87 to 4.91 inclusive

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending specially crafted recipient addresses

[Mitigation] Immediately upgrade Exim packages to a patched version (4.92 or higher) and apply temporary configuration workarounds

[Affected Scope] Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7, 5.4.6 to 5.4.12, and specific FortiProxy versions with SSL VPN web portal enabled

[Impact] Unauthenticated remote attackers can download arbitrary system files (including active session credentials) via specially crafted HTTP requests, leading to full network compromise

[Mitigation] Immediately upgrade FortiOS/FortiProxy firmware to the patched versions, terminate active SSL VPN sessions, and enforce a global password reset

[Affected Scope] Atlassian Crowd and Crowd Data Center from version 2.1.0 up to 3.4.4 (specific minor version ranges)

[Impact] Unauthenticated remote attackers can upload and install arbitrary plugins, leading to complete remote code execution (RCE) on the host system

[Mitigation] Immediately upgrade to the fixed versions (3.0.5, 3.1.6, 3.2.8, 3.3.5, 3.4.4 or later) or disable/remove the pdkinstall plugin

[Affected Scope] Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending a malicious serialized .NET object in the __CSRFTOKEN HTTP POST parameter

[Mitigation] Apply official security patches, disable the vulnerable AntiCSRF module, or upgrade to a supported secure version

[Affected Scope] Synacor Zimbra Collaboration Suite (ZCS) 8.7.x before 8.7.11p10

[Impact] Unauthenticated remote attackers can exploit this XML External Entity (XXE) vulnerability to read arbitrary local files, perform SSRF, and achieve Remote Code Execution (RCE)

[Mitigation] Immediately upgrade Zimbra Collaboration Suite to version 8.7.11p10 or later, and restrict external access to the Autodiscover servlet endpoint

[Affected Scope] Schneider Electric U.motion Builder software version 1.3.4

[Impact] Unauthenticated remote attackers can execute arbitrary code with elevated privileges by injecting malicious SQL commands into vulnerable input fields

[Mitigation] Immediately upgrade to the patched version provided by the vendor, or restrict network access to the device from the public internet

[Affected Scope] Citrix Workspace App for Windows before version 1904

[Impact] Unauthenticated remote attackers can exploit incorrect access control mechanisms to execute arbitrary code and gain full system privileges on the target host

[Mitigation] Immediately upgrade affected client installations to version 1904 or later, and restrict network access for unpatched endpoints

[Affected Scope] Legacy Windows operating systems including Windows XP, Windows 7, Windows Server 2003, Windows Server 2008, and 2008 R2

[Impact] An unauthenticated remote attacker can execute arbitrary code with kernel-level privileges or trigger a system crash (DoS) by sending specially crafted RDP requests, enabling wormable self-propagation across networks

[Mitigation] Immediately apply the official Microsoft security patches, or disable RDP services and enable Network Level Authentication (NLA) if patching is not feasible

[Affected Scope] Systems running unpatched versions impacted by CVE-2018-14839

[Impact] LG N1A1 NAS 3718.510 is affected by: Remote Command Execution. The impact is: execute arbitrary code (remote). The attack vector is: HTTP PO...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] WhatsApp and WhatsApp Business prior to specific patched versions across Android, iOS, Windows Phone, and Tizen platforms

[Impact] Remote attackers can execute arbitrary code (RCE) and compromise target devices without user interaction by sending specially crafted RTCP packets

[Mitigation] Immediately update WhatsApp applications to the latest official patched versions via respective app stores

[Affected Scope] Pulse Connect Secure (PCS) versions prior to 8.2R12.1, 8.3R7.1, and 9.0R3.4

[Impact] An unauthenticated remote attacker can send a specially crafted URI to read arbitrary system files and session databases, potentially leading to complete credential theft and network compromise.

[Mitigation] Immediately upgrade to the official patched firmware versions (8.2R12.1, 8.3R7.1, 9.0R3.4, or later).

[Affected Scope] ZyXEL P660HN-T1A v1 routers distributed by TrueOnline running TCLinux Firmware v7.3.15.0 v001 / 3.40(ULM.0)b31 or prior

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by manipulating the remote_host parameter in the ViewLog.asp page

[Mitigation] Immediately disable external WAN access to the web management interface, apply the latest firmware updates, or replace legacy end-of-life devices

[Affected Scope] Wireless presentation gateways based on the AWIND OEM platform, including Crestron AM-100/101, Barco wePresent WiPG-1000P/1600W, and Extron ShareLink 200/250.

[Impact] An unauthenticated remote attacker can execute arbitrary operating system commands with root privileges via crafted HTTP requests.

[Mitigation] Apply the latest firmware updates from the respective vendors and restrict network access to the device management interfaces.

[Affected Scope] Oracle WebLogic Server versions 10.3.6.0.0 and 12.1.3.0.0

[Impact] Unauthenticated remote attackers can gain full control of the WebLogic Server and execute arbitrary system commands via malicious HTTP requests

[Mitigation] Apply the official Oracle security patches immediately, or disable/remove the unused wls9-async and wls-wsat components

[Affected Scope] Kentico CMS versions 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and all 9.x versions

[Impact] Unauthenticated remote attackers can bypass authentication and execute arbitrary .NET object deserialization, leading to full remote code execution on the host server

[Mitigation] Immediately apply the official vendor hotfixes or restrict external network access to the Kentico Staging Service endpoints

[Affected Scope] Kibana versions before 5.6.15 and 6.6.1

[Impact] Unauthenticated attackers can exploit a prototype pollution flaw in the Timelion visualizer to execute arbitrary shell commands with the privileges of the Kibana process on the host system.

[Mitigation] Immediately upgrade Kibana to version 5.6.15, 6.6.1, or later, or disable the Timelion application in the configuration file.

[Affected Scope] Atlassian Confluence Server and Data Center before 6.6.12, 6.7.0 to before 6.12.3, 6.13.0 to before 6.13.3, and 6.14.0 to before 6.14.2

[Impact] Unauthenticated remote attackers can achieve path traversal and execute arbitrary code (RCE) on the host server via Server-Side Template Injection (SSTI)

[Mitigation] Immediately upgrade Confluence to the patched versions (6.6.12, 6.12.3, 6.13.3, 6.14.2 or later) or disable the Widget Connector macro