CVE Vulnerability Advisory Database

[Affected Scope] Adobe Flash Player before 13.0.0.269, 14.x through 16.x before 16.0.0.305 on Windows and OS X, and before 11.2.202.442 on Linux

[Impact] Remote attackers can execute arbitrary code (RCE) and gain full system control via specially crafted malicious Flash content (SWF) without user interaction

[Mitigation] Since Adobe Flash Player has reached End-of-Life (EOL), the only secure mitigation is to completely uninstall Flash Player from all systems

[Affected Scope] Adobe Flash Player through 13.0.0.262, 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X, and through 11.2.202.438 on Linux

[Impact] Remote attackers can execute arbitrary code with the privileges of the active user and compromise the host system by enticing users to visit a website containing malicious Flash content (SWF)

[Mitigation] Since Adobe Flash Player has reached End-of-Life (EOL), it is highly recommended to completely uninstall Flash Player from all endpoints and disable Flash plugins in web browsers

[Affected Scope] Rejetto HTTP File Server (HFS) 2.3x versions prior to 2.3c

[Impact] Unauthenticated remote attackers can execute arbitrary system commands and gain full control of the host by sending crafted HTTP requests

[Mitigation] Immediately upgrade to a patched version (2.3c or later) or decommission the legacy HFS service in favor of secure alternatives

[Affected Scope] GNU Bash through version 4.3 (patch level bash43-025 and earlier) and other legacy versions

[Impact] Remote attackers can write arbitrary files or execute unauthorized system commands via vectors such as OpenSSH ForceCommand, Apache mod_cgi/mod_cgid, or DHCP client scripts

[Mitigation] Immediately update GNU Bash to the latest patched version using your operating system's package manager and audit environment variable configurations

[Affected Scope] All Linux and Unix-like systems running GNU Bash versions up to and including 4.3

[Impact] Remote unauthenticated attackers can execute arbitrary system commands and gain full control of the target server by manipulating environment variables

[Mitigation] Immediately update GNU Bash to the latest patched version using your operating system package manager

[Affected Scope] Adobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows operating systems.

[Impact] Attackers can bypass the sandbox protection mechanism and execute arbitrary native code in a privileged context.

[Mitigation] Immediately upgrade affected installations to patched versions 10.1.11, 11.0.08, or later.

[Affected Scope] Microsoft Internet Explorer versions 6 through 11

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (memory corruption) via crafted web pages, potentially leading to full system compromise

[Mitigation] Apply the official Microsoft cumulative security update, or implement immediate workarounds such as unregistering VGX.DLL and enabling Enhanced Mitigation Experience Toolkit (EMET)

[Affected Scope] NTWebServer component in InduSoft Web Studio versions prior to 7.1 SP2 Patch 4

[Impact] Unauthenticated remote attackers can exploit directory traversal to read administrative passwords in APP files, leading to arbitrary remote code execution (RCE)

[Mitigation] Upgrade InduSoft Web Studio to version 7.1 SP2 Patch 4 or later, and restrict external access to the NTWebServer port

[Affected Scope] Adobe Flash Player before 11.7.700.261, 11.8.x through 12.0.x before 12.0.0.44 on Windows/macOS, and before 11.2.202.336 on Linux

[Impact] Remote attackers can execute arbitrary code and gain full control of the target system by enticing users to visit a website containing a specially crafted Flash (.swf) file

[Mitigation] Immediately uninstall legacy Adobe Flash Player or upgrade to patched versions, and disable Flash execution in all web browsers

[Affected Scope] HP ProCurve Manager (PCM) 3.20/4.0, PCM+ 3.20/4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management.

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending a specially crafted marshalled object.

[Mitigation] Restrict external access to the vulnerable EJBInvokerServlet and JMXInvokerServlet endpoints and apply official security patches.

[Affected Scope] Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03

[Impact] Attackers can execute arbitrary code or cause a denial of service (memory corruption) via crafted PDF files

[Mitigation] Immediately upgrade to patched versions (9.5.5, 10.1.7, 11.0.03 or later) and enforce sandbox security policies

[Affected Scope] Apache Struts framework versions 2.0.0 through 2.3.15

[Impact] Remote attackers can execute arbitrary OGNL expressions via crafted 'action:', 'redirect:', or 'redirectAction:' parameter prefixes, leading to full system compromise

[Mitigation] Immediately upgrade Apache Struts to version 2.3.15.1 or higher, or implement strict WAF rules to block vulnerable parameter prefixes

[Affected Scope] Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, 5.0 Update 45 and earlier, and OpenJDK 7.

[Impact] Remote attackers can completely bypass the Java security sandbox and execute arbitrary code on the host system via malicious 2D image rendering.

[Mitigation] Immediately upgrade to Java SE 7u25 or later, apply OpenJDK security patches, and disable Java browser plugins.

[Affected Scope] Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03

[Impact] Attackers can execute arbitrary code with the privileges of the logged-in user and compromise the host system via a specially crafted PDF document

[Mitigation] Immediately update affected installations to patched versions (9.5.5, 10.1.7, 11.0.03 or later) or migrate to the latest Adobe Acrobat Reader DC

[Affected Scope] Adobe ColdFusion versions 9.0, 9.0.1, 9.0.2, and 10

[Impact] Remote attackers can bypass authentication using a default empty password on the RDS component, hijack the session to access the administrator interface, and execute arbitrary code

[Mitigation] Apply the official APSB13-03 security patch, disable the RDS component, or enforce strong passwords

[Affected Scope] Oracle Java 7 Update 10 and earlier versions (all versions prior to Java 7 Update 11).

[Impact] Remote attackers can completely bypass the JVM security sandbox and execute arbitrary system commands with the privileges of the running user by enticing them to visit a malicious web page containing a crafted Java applet.

[Mitigation] Immediately upgrade to Oracle Java 7 Update 11 or later (or migrate to modern LTS versions like Java 8/11/17), and disable the Java browser plug-in across all enterprise endpoints.

[Affected Scope] Adobe ColdFusion versions 9.0, 9.0.1, and 9.0.2 when an administrator password is not configured

[Impact] Remote attackers can bypass authentication, gain administrative access, and potentially execute arbitrary code to compromise the server

[Mitigation] Apply the official Adobe security patch (APSB13-03), enforce strong administrator passwords, and restrict external access to the admin console

[Affected Scope] Oracle Fusion Middleware versions 11.1.1.4, 11.1.1.6, and 11.1.2.0 within the Oracle Reports Developer component.

[Impact] Unauthenticated remote attackers can read or upload arbitrary files via the URLPARAMETER functionality, which can be chained with CVE-2012-3153 to achieve Remote Code Execution (RCE) via JSP web shell upload.

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict external access to the rwservlet endpoint and implement strict URL filtering.

[Affected Scope] Oracle Java SE 7 Update 7 and earlier versions of the JRE (Java Runtime Environment)

[Impact] Unauthenticated remote attackers can completely compromise system confidentiality, integrity, and availability, leading to Remote Code Execution (RCE)

[Mitigation] Immediately upgrade to Java SE 7 Update 9 or later, and restrict JAX-WS class loading in legacy environments

[Affected Scope] Oracle Java SE 7 Update 6 and earlier JRE (Java Runtime Environment) versions

[Impact] Remote attackers can completely bypass SecurityManager restrictions and execute arbitrary code with elevated privileges via a crafted malicious applet

[Mitigation] Immediately upgrade to Java SE 7 Update 7 or later, or disable the Java browser plugin across all endpoints