CVE Vulnerability Advisory Database

[Affected Scope] Sitecore Experience Platform (XP) 7.5 Initial Release to Sitecore XP 8.2 Update-7.

[Impact] Unauthenticated remote attackers can execute arbitrary commands with system privileges on the hosting server by sending specially crafted serialized payloads.

[Mitigation] Apply official security patches immediately or restrict external access to the vulnerable '/sitecore/shell/ClientBin/Reporting/ReportService.asmx' endpoint.

[Affected Scope] Zoho ManageEngine ADSelfService Plus version 6113 and prior

[Impact] Unauthenticated remote attackers can bypass REST API authentication and execute arbitrary code with SYSTEM privileges

[Mitigation] Immediately upgrade to build 6114 or later and inspect systems for Indicators of Compromise (IoCs)

[Affected Scope] End-of-life (EOL) SonicWall Secure Remote Access (SRA) appliances running all 8.x firmware and 9.0.0.9-26sv or earlier

[Impact] Unauthenticated remote attackers can execute arbitrary SQL commands via crafted payloads, potentially leading to credential theft, database compromise, and remote code execution (RCE)

[Mitigation] Since the affected products are EOL, immediately decommission the SRA appliances and migrate to supported SMA (Secure Mobile Access) series, or restrict external access via firewall rules

[Affected Scope] Tenda AC11 wireless routers running firmware versions up to and including 02.03.01.104_CN

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending a specially crafted HTTP POST request

[Mitigation] Immediately upgrade to the latest patched firmware version and disable external WAN-side HTTP management interfaces

[Affected Scope] On-premises and virtual appliance deployments of SonicWall Email Security running version 10.0.9.x.

[Impact] Unauthenticated remote attackers can create administrative accounts by sending crafted HTTP requests, leading to full system compromise.

[Mitigation] Immediately upgrade to the patched firmware version (10.0.9.6173, 10.0.10, or higher).

[Affected Scope] Accellion FTA versions 9_12_370 and earlier

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands and gain full system control by sending crafted POST requests to various admin endpoints

[Mitigation] Immediately upgrade to Accellion FTA version 9_12_380 or later, or migrate to a supported secure file transfer platform

[Affected Scope] Accellion FTA 9_12_411 and earlier

[Impact] Unauthenticated remote attackers can exploit this vulnerability via crafted POST requests to access internal network resources or chain it with other flaws for remote code execution

[Mitigation] Immediately upgrade Accellion FTA to version 9_12_416 or later and restrict external access

[Affected Scope] Micro Focus Operations Bridge Reporter (OBR) version 10.40.

[Impact] Unauthenticated remote attackers can execute arbitrary system commands on the OBR server, leading to complete system compromise.

[Mitigation] Apply the official vendor security patch (KM03775947) immediately and restrict external access to the OBR management ports.

[Affected Scope] Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0

[Impact] Unauthenticated remote attackers can bypass authentication via HTTP and gain complete control (RCE) over the Oracle WebLogic Server

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately, or restrict external network access to the administration console (/console)

[Affected Scope] MobileIron Core & Connector versions 10.6.0.0 and earlier, Sentry versions 9.8.0 and earlier, Monitor & RDB versions 2.0.0.1 and earlier

[Impact] Unauthenticated remote attackers can execute arbitrary code with system administrator privileges by sending specially crafted Hessian serialized data

[Mitigation] Immediately apply the official security patches provided by the vendor and restrict external access to sensitive service endpoints

[Affected Scope] IBM Data Risk Manager versions 2.0.1, 2.0.2, 2.0.3, and 2.0.4.

[Impact] A remote authenticated attacker with high privileges could execute arbitrary OS commands, leading to complete system compromise.

[Mitigation] Apply the official IBM security patches immediately and restrict network access to the management interface.

[Affected Scope] Systems running Microsoft .NET Framework versions 2.0, 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8, and Microsoft SharePoint Server.

[Impact] An unauthenticated remote attacker can execute arbitrary code with system privileges by sending a specially crafted XOML (XML Process Markup Language) file to the target server.

[Mitigation] Immediately apply the official Microsoft security patches and restrict untrusted XOML workflow compilation within your SharePoint environment.

[Affected Scope] Ubiquiti AirOS prior to v4.0.1 (802.11 ISP), v5.3.5 (AirMax), v5.4.5 (AirSync), and Nanostation5 devices

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges via a specially crafted HTTP GET request

[Mitigation] Immediately upgrade to the patched firmware versions and restrict external access to the web management interface

[Affected Scope] Exim mail server versions 4.87 to 4.91 inclusive

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending specially crafted recipient addresses

[Mitigation] Immediately upgrade Exim packages to a patched version (4.92 or higher) and apply temporary configuration workarounds

[Affected Scope] Schneider Electric U.motion Builder software version 1.3.4

[Impact] Unauthenticated remote attackers can execute arbitrary code with elevated privileges by injecting malicious SQL commands into vulnerable input fields

[Mitigation] Immediately upgrade to the patched version provided by the vendor, or restrict network access to the device from the public internet

[Affected Scope] Pulse Connect Secure (PCS) versions prior to 8.2R12.1, 8.3R7.1, and 9.0R3.4

[Impact] An unauthenticated remote attacker can send a specially crafted URI to read arbitrary system files and session databases, potentially leading to complete credential theft and network compromise.

[Mitigation] Immediately upgrade to the official patched firmware versions (8.2R12.1, 8.3R7.1, 9.0R3.4, or later).

[Affected Scope] Kentico CMS versions 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and all 9.x versions

[Impact] Unauthenticated remote attackers can bypass authentication and execute arbitrary .NET object deserialization, leading to full remote code execution on the host server

[Mitigation] Immediately apply the official vendor hotfixes or restrict external network access to the Kentico Staging Service endpoints

[Affected Scope] Microsoft SharePoint Server 2010, 2013, 2016, 2019, and SharePoint Foundation 2013

[Impact] Unauthenticated remote attackers can execute arbitrary code with the privileges of the SharePoint IIS application pool (w3wp.exe) by sending a specially crafted application package, leading to complete system compromise

[Mitigation] Immediately apply the official Microsoft security updates and perform compromise assessments on internet-facing SharePoint servers

[Affected Scope] Quest KACE System Management Appliance (SMA) 8.0.318 and prior versions

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with high privileges by sending specially crafted HTTP requests

[Mitigation] Apply official vendor patches immediately and restrict external internet access to the management interface

[Affected Scope] Adobe ColdFusion 2016 Update 5 and earlier, ColdFusion 11 Update 13 and earlier

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by exploiting a deserialization of untrusted data (CWE-502)

[Mitigation] Immediately apply the official Adobe security patch (APSB18-14) and restrict external access to RMI and management ports