CVE Vulnerability Advisory Database

[Affected Scope] Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending a malicious serialized .NET object in the __CSRFTOKEN HTTP POST parameter

[Mitigation] Apply official security patches, disable the vulnerable AntiCSRF module, or upgrade to a supported secure version

[Affected Scope] Oracle WebLogic Server versions 10.3.6.0.0 and 12.1.3.0.0

[Impact] Unauthenticated remote attackers can gain full control of the WebLogic Server and execute arbitrary system commands via malicious HTTP requests

[Mitigation] Apply the official Oracle security patches immediately, or disable/remove the unused wls9-async and wls-wsat components

[Affected Scope] Kentico CMS versions 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and all 9.x versions

[Impact] Unauthenticated remote attackers can bypass authentication and execute arbitrary .NET object deserialization, leading to full remote code execution on the host server

[Mitigation] Immediately apply the official vendor hotfixes or restrict external network access to the Kentico Staging Service endpoints

[Affected Scope] Microsoft SharePoint Server 2010, 2013, 2016, 2019, and SharePoint Foundation 2013

[Impact] Unauthenticated remote attackers can execute arbitrary code with the privileges of the SharePoint IIS application pool (w3wp.exe) by sending a specially crafted application package, leading to complete system compromise

[Mitigation] Immediately apply the official Microsoft security updates and perform compromise assessments on internet-facing SharePoint servers

[Affected Scope] Jenkins weekly version 2.153 and earlier, LTS version 2.138.3 and earlier utilizing the Stapler web framework.

[Impact] Unauthenticated remote attackers can invoke arbitrary methods on Java objects by sending crafted URLs, leading to full Remote Code Execution (RCE) under system privileges.

[Mitigation] Immediately upgrade Jenkins weekly to version 2.154 or later, and LTS to version 2.138.4 or later.

[Affected Scope] All Java-based web applications utilizing RichFaces Framework versions 3.0.0 through 3.3.4.

[Impact] A remote, unauthenticated attacker can execute arbitrary system commands and fully compromise the host by sending a crafted chain of serialized Java objects.

[Mitigation] Migrate legacy RichFaces 3.X applications to supported frameworks, or restrict external access to the vulnerable '/org.ajax4jsf.resource.UserResource' path using WAF rules or servlet filters.

[Affected Scope] Adobe ColdFusion 2016 Update 5 and earlier, ColdFusion 11 Update 13 and earlier

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by exploiting a deserialization of untrusted data (CWE-502)

[Mitigation] Immediately apply the official Adobe security patch (APSB18-14) and restrict external access to RMI and management ports

[Affected Scope] Oracle WebLogic Server versions 10.3.6.0, 12.1.3.0, 12.2.1.2, and 12.2.1.3

[Impact] Unauthenticated remote attackers can exploit this vulnerability via the T3 protocol to execute arbitrary code and completely take over the WebLogic Server

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict external T3 protocol access (Port 7001) using connection filters or firewalls

[Affected Scope] Cisco Secure Access Control System (ACS) prior to release 5.8 Patch 9

[Impact] An unauthenticated, remote attacker can execute arbitrary commands on the affected device with root privileges by sending a crafted serialized Java object

[Mitigation] Immediately upgrade to Cisco ACS 5.8 Patch 9 or later, or restrict network access to vulnerable ports

[Affected Scope] Jenkins weekly versions 2.56 and earlier, and LTS versions 2.46.1 and earlier

[Impact] Unauthenticated remote attackers can execute arbitrary system commands and fully compromise the Jenkins master node by sending a serialized Java SignedObject

[Mitigation] Immediately upgrade Jenkins to version 2.57+ or LTS 2.46.2+, and disable the legacy remoting-based CLI protocol

[Affected Scope] JBoss Application Server shipped with Red Hat Enterprise Application Platform (EAP) 5.2, specifically when the HTTP Invoker (ReadOnlyAccessFilter) is enabled.

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with the privileges of the JBoss process by sending crafted serialized Java objects.

[Mitigation] Apply official Red Hat security updates, disable or restrict access to the HTTP Invoker servlet, or block serialization payloads using a Web Application Firewall (WAF).

[Affected Scope] Progress Telerik UI for ASP.NET AJAX versions before R1 2017 and R2 before R2 2017 SP2

[Impact] Remote attackers can exploit weak encryption to perform unrestricted file uploads or execute arbitrary code on the target server

[Mitigation] Upgrade to the latest patched version of Telerik UI, or configure strong custom encryption keys in web.config

[Affected Scope] Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 Update 11 and earlier, and ColdFusion 10 Update 22 and earlier.

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending crafted Action Message Format (AMF) payloads.

[Mitigation] Apply the official Adobe security updates (APSB17-14) immediately and restrict external access to AMF gateway endpoints.

[Affected Scope] Apache Tomcat versions before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12, when JmxRemoteLifecycleListener is enabled

[Impact] Remote attackers with network access to JMX ports can trigger untrusted deserialization without authentication, leading to arbitrary Remote Code Execution (RCE) with system privileges

[Mitigation] Upgrade Apache Tomcat to the latest secure release, or disable JmxRemoteLifecycleListener in server.xml and restrict network access to JMX ports using firewalls

[Affected Scope] All Java applications utilizing Apache Shiro versions prior to 1.2.5

[Impact] Remote attackers can leverage the hardcoded default AES encryption key to send malicious serialized objects, leading to arbitrary code execution (RCE) or access control bypass

[Mitigation] Immediately upgrade Apache Shiro to version 1.2.5 or higher, and explicitly configure a unique, secure random cipher key for the RememberMe service

[Affected Scope] Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9

[Impact] Remote attackers can execute arbitrary code without authentication by sending malicious serialized objects to the JMX service port, leading to complete system compromise

[Mitigation] Apply the latest Oracle Java SE security updates, restrict external access to JMX ports, and enforce robust authentication and SSL/TLS

[Affected Scope] IBM WebSphere Application Server and associated business, analytics, and mobile solutions utilizing vulnerable Apache Commons Collections library versions

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with system privileges by sending crafted serialized Java objects to exposed interfaces

[Mitigation] Apply official IBM security patches (Interim Fixes) immediately, or implement JVM-level deserialization filters to block the InvokerTransformer class

[Affected Scope] Oracle WebLogic Server versions 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0

[Impact] Unauthenticated remote attackers can execute arbitrary system commands via a crafted serialized Java object sent over the T3 protocol to TCP port 7001

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict external access to the T3 protocol using WebLogic Connection Filters

[Affected Scope] HP ProCurve Manager (PCM) 3.20/4.0, PCM+ 3.20/4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management.

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending a specially crafted marshalled object.

[Mitigation] Restrict external access to the vulnerable EJBInvokerServlet and JMXInvokerServlet endpoints and apply official security patches.