CVE Vulnerability Advisory Database

[Affected Scope] Apache ActiveMQ 5.x before 5.14.0 with the Fileserver web application enabled

[Impact] Unauthenticated remote attackers can upload and execute arbitrary JSP files via HTTP PUT and MOVE requests, leading to complete system compromise

[Mitigation] Upgrade Apache ActiveMQ to version 5.14.0 or later, or disable the Fileserver web application in the jetty.xml configuration

[Affected Scope] SAP NetWeaver Application Server Java platforms, typically prior to version 7.3

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands and Java code via crafted HTTP/HTTPS requests (CVSS 10.0)

[Mitigation] Apply SAP Note 1445998 and disable the Invoker Servlet globally in the web.xml configuration

[Affected Scope] Adobe Flash Player 21.0.0.226 and earlier versions across Windows, macOS, Linux, and ChromeOS

[Impact] Remote attackers can execute arbitrary code with the privileges of the active user and gain full system control via crafted malicious Flash content (SWF)

[Mitigation] Since Adobe Flash Player has reached End-of-Life (EOL), the recommended action is to completely uninstall it or disable Flash execution in all browsers and applications

[Affected Scope] Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9

[Impact] Remote attackers can execute arbitrary code without authentication by sending malicious serialized objects to the JMX service port, leading to complete system compromise

[Mitigation] Apply the latest Oracle Java SE security updates, restrict external access to JMX ports, and enforce robust authentication and SSL/TLS

[Affected Scope] Adobe Flash Player 21.0.0.197 and earlier versions

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (application crash) via specially crafted Flash content

[Mitigation] Since Adobe Flash Player has reached End-of-Life (EOL), completely uninstall Flash Player from all systems and transition to modern web standards

[Affected Scope] UDDI (Universal Description, Discovery, and Integration) server component running on SAP NetWeaver J2EE Engine version 7.40.

[Impact] Unauthenticated remote attackers can execute arbitrary SQL commands via crafted requests, potentially leading to complete database compromise, data exfiltration, or remote code execution.

[Mitigation] Immediately apply SAP Security Note 2101079, disable the UDDI service if not required, and restrict network access.

[Affected Scope] IBM WebSphere Application Server and associated business, analytics, and mobile solutions utilizing vulnerable Apache Commons Collections library versions

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with system privileges by sending crafted serialized Java objects to exposed interfaces

[Mitigation] Apply official IBM security patches (Interim Fixes) immediately, or implement JVM-level deserialization filters to block the InvokerTransformer class

[Affected Scope] Juniper ScreenOS versions 6.2.0r15 through 6.2.0r18 and 6.3.0r12 through 6.3.0r20

[Impact] Remote attackers can bypass authentication and gain full administrative (root) access to the firewall via SSH or TELNET using a hardcoded master password

[Mitigation] Immediately upgrade ScreenOS to patched versions (6.3.0r21 or the respective 'b' releases) and disable external SSH/TELNET access

[Affected Scope] Oracle WebLogic Server versions 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0

[Impact] Unauthenticated remote attackers can execute arbitrary system commands via a crafted serialized Java object sent over the T3 protocol to TCP port 7001

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict external access to the T3 protocol using WebLogic Connection Filters

[Affected Scope] Oracle Java SE 6u95, 7u80, 8u45, and Java SE Embedded 7u75, 8u33 and prior

[Impact] Remote attackers can completely bypass the Java security sandbox and execute arbitrary code with the privileges of the running process

[Mitigation] Apply the latest Oracle Java SE security updates, disable Java browser plugins, and restrict untrusted Java applet execution

[Affected Scope] Adobe Flash Player 13.x through 18.x and 11.x legacy versions on Windows, OS X, and Linux

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content

[Mitigation] Since Adobe Flash Player has reached End-of-Life (EOL), the recommended mitigation is to completely uninstall Flash Player from all systems

[Affected Scope] Adobe Flash Player 13.x through 13.0.0.302, 14.x through 18.0.0.203 on Windows/OS X, and 11.x/12.x on Linux

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content

[Mitigation] Since Adobe Flash Player has reached End-of-Life (EOL), completely uninstall Flash Player and transition to modern web standards like HTML5

[Affected Scope] Adobe Flash Player 13.x through 18.x on Windows/OS X, and 11.x through 11.2.202.468 on Linux

[Impact] Remote attackers can execute arbitrary code or trigger a denial of service (system crash) via crafted Flash content

[Mitigation] Completely uninstall Adobe Flash Player or disable the Flash plugin across all web browsers and operating systems

[Affected Scope] Adobe Flash Player before 13.0.0.296, and 14.x through 18.x before 18.0.0.194 on Windows and OS X, and before 11.2.202.468 on Linux

[Impact] Remote attackers can execute arbitrary code and gain full system control via specially crafted malicious Flash content (.swf) without user interaction

[Mitigation] Since Adobe Flash Player has reached End-of-Life (EOL), the recommended mitigation is to completely uninstall Flash Player and disable browser plugins across all systems

[Affected Scope] Arcserve UDP versions prior to 5.0 Update 4

[Impact] Unauthenticated remote attackers can retrieve sensitive system files or trigger a denial of service, severely impacting business continuity

[Mitigation] Immediately upgrade to Arcserve UDP 5.0 Update 4 or later, and restrict external access to the management console

[Affected Scope] ProFTPD version 1.3.5 with the mod_copy module enabled.

[Impact] Unauthenticated remote attackers can read or write arbitrary files, leading to sensitive data exposure or full system compromise via RCE.

[Mitigation] Upgrade to ProFTPD 1.3.5a or later, or disable the mod_copy module in the configuration file.

[Affected Scope] Routers and embedded devices utilizing the Realtek SDK with the miniigd UPnP SOAP service enabled

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending crafted SOAP requests, leading to complete device compromise

[Mitigation] Disable the UPnP service, block external access to port 52869/TCP, and apply the latest firmware updates from the device vendor

[Affected Scope] Adobe Flash Player versions before 13.0.0.281, 14.x through 17.x before 17.0.0.169 on Windows/OS X, and before 11.2.202.457 on Linux

[Impact] Successful exploitation allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, which has been actively exploited in the wild

[Mitigation] Immediately uninstall Adobe Flash Player from all endpoints or upgrade to the patched versions, and disable Flash execution in web browsers

[Affected Scope] Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 R2 running IIS (Internet Information Services).

[Impact] Remote unauthenticated attackers can execute arbitrary code with SYSTEM privileges or trigger a Blue Screen of Death (BSOD), leading to complete system compromise or infrastructure denial of service.

[Mitigation] Apply the official Microsoft MS15-034 security patch immediately, or disable IIS Kernel Caching as a temporary workaround.

[Affected Scope] Elasticsearch versions before 1.3.8 and 1.4.x versions before 1.4.3

[Impact] Unauthenticated remote attackers can bypass sandbox restrictions to execute arbitrary shell commands on the host system, leading to complete system compromise

[Mitigation] Immediately upgrade Elasticsearch to version 1.3.8, 1.4.3, or later, or disable dynamic scripting in the configuration