CVE Vulnerability Advisory Database

[Affected Scope] Drupal versions prior to 7.58, 8.3.9, 8.4.6, and 8.5.1

[Impact] Unauthenticated remote attackers can execute arbitrary PHP code and gain full system-level control of the web server by sending specially crafted HTTP requests

[Mitigation] Immediately upgrade Drupal Core to the patched versions (7.58, 8.3.9, 8.4.6, 8.5.1 or higher)

[Affected Scope] PAN-OS versions before 6.1.19, 7.0.19, 7.1.14, and 8.0.6 management interface

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges via the management interface, leading to complete device compromise

[Mitigation] Immediately upgrade to the patched versions and restrict access to the management interface from the public internet

[Affected Scope] NETGEAR DGN2200 wireless ADSL2+ modem router devices running firmware versions up to and including 10.0.0.50.

[Impact] Remote authenticated attackers can execute arbitrary OS commands with root privileges via shell metacharacters in the ping_IPAddr parameter of HTTP POST requests, leading to complete device compromise.

[Mitigation] Apply the latest official firmware updates from NETGEAR, disable remote management, and restrict access to the web administration interface.

[Affected Scope] Apache ActiveMQ 5.x before 5.14.0 with the Fileserver web application enabled

[Impact] Unauthenticated remote attackers can upload and execute arbitrary JSP files via HTTP PUT and MOVE requests, leading to complete system compromise

[Mitigation] Upgrade Apache ActiveMQ to version 5.14.0 or later, or disable the Fileserver web application in the jetty.xml configuration

[Affected Scope] SAP NetWeaver Application Server Java platforms, typically prior to version 7.3

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands and Java code via crafted HTTP/HTTPS requests (CVSS 10.0)

[Mitigation] Apply SAP Note 1445998 and disable the Invoker Servlet globally in the web.xml configuration

[Affected Scope] IBM WebSphere Application Server and associated business, analytics, and mobile solutions utilizing vulnerable Apache Commons Collections library versions

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with system privileges by sending crafted serialized Java objects to exposed interfaces

[Mitigation] Apply official IBM security patches (Interim Fixes) immediately, or implement JVM-level deserialization filters to block the InvokerTransformer class

[Affected Scope] Routers and embedded devices utilizing the Realtek SDK with the miniigd UPnP SOAP service enabled

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending crafted SOAP requests, leading to complete device compromise

[Mitigation] Disable the UPnP service, block external access to port 52869/TCP, and apply the latest firmware updates from the device vendor

[Affected Scope] Adobe Flash Player through 13.0.0.262, 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X, and through 11.2.202.438 on Linux

[Impact] Remote attackers can execute arbitrary code with the privileges of the active user and compromise the host system by enticing users to visit a website containing malicious Flash content (SWF)

[Mitigation] Since Adobe Flash Player has reached End-of-Life (EOL), it is highly recommended to completely uninstall Flash Player from all endpoints and disable Flash plugins in web browsers

[Affected Scope] Microsoft Internet Explorer versions 6 through 11

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (memory corruption) via crafted web pages, potentially leading to full system compromise

[Mitigation] Apply the official Microsoft cumulative security update, or implement immediate workarounds such as unregistering VGX.DLL and enabling Enhanced Mitigation Experience Toolkit (EMET)

[Affected Scope] Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03

[Impact] Attackers can execute arbitrary code or cause a denial of service (memory corruption) via crafted PDF files

[Mitigation] Immediately upgrade to patched versions (9.5.5, 10.1.7, 11.0.03 or later) and enforce sandbox security policies

[Affected Scope] Oracle Java 7 Update 10 and earlier versions (all versions prior to Java 7 Update 11).

[Impact] Remote attackers can completely bypass the JVM security sandbox and execute arbitrary system commands with the privileges of the running user by enticing them to visit a malicious web page containing a crafted Java applet.

[Mitigation] Immediately upgrade to Oracle Java 7 Update 11 or later (or migrate to modern LTS versions like Java 8/11/17), and disable the Java browser plug-in across all enterprise endpoints.

[Affected Scope] Adobe ColdFusion versions 9.0, 9.0.1, and 9.0.2 when an administrator password is not configured

[Impact] Remote attackers can bypass authentication, gain administrative access, and potentially execute arbitrary code to compromise the server

[Mitigation] Apply the official Adobe security patch (APSB13-03), enforce strong administrator passwords, and restrict external access to the admin console

[Affected Scope] Oracle Java SE 7 Update 7 and earlier versions of the JRE (Java Runtime Environment)

[Impact] Unauthenticated remote attackers can completely compromise system confidentiality, integrity, and availability, leading to Remote Code Execution (RCE)

[Mitigation] Immediately upgrade to Java SE 7 Update 9 or later, and restrict JAX-WS class loading in legacy environments

[Affected Scope] PHP versions before 5.3.12 and 5.4.x before 5.4.2, configured to run as a CGI script (php-cgi)

[Impact] Unauthenticated remote attackers can execute arbitrary code by injecting command-line options via HTTP query strings

[Mitigation] Upgrade to patched PHP versions or configure web server rewrite rules to block malicious query strings