CVE Vulnerability Advisory Database

[Affected Scope] Apache ActiveMQ brokers and client libraries utilizing the OpenWire protocol

[Impact] Unauthenticated remote attackers can execute arbitrary shell commands on the target system by manipulating serialized class types

[Mitigation] Immediately upgrade both brokers and clients to patched versions (5.15.16, 5.16.7, 5.17.6, or 5.18.3 and above)

[Affected Scope] F5 BIG-IP systems with network access to the Configuration Utility (TMUI) via the management port and/or Self IP addresses.

[Impact] Unauthenticated remote attackers can bypass authentication mechanisms and execute arbitrary system commands with root privileges on the target system.

[Mitigation] Immediately apply the official F5 security patches or restrict access to the TMUI (port 443) from untrusted networks as a temporary workaround.

[Affected Scope] NextGen Healthcare Mirth Connect versions prior to 4.4.1

[Impact] Unauthenticated remote attackers can bypass authentication to execute arbitrary OS commands with system privileges, leading to full host compromise

[Mitigation] Immediately upgrade Mirth Connect to version 4.4.1 or later, and restrict access to administrative ports

[Affected Scope] VMware vCenter Server 7.0 and 8.0 series, VMware Cloud Foundation 4.x and 5.x series

[Impact] An unauthenticated attacker with network access can trigger an out-of-bounds write, potentially leading to remote code execution (RCE) with administrative privileges

[Mitigation] Apply the official security patches immediately, and restrict network access to the vCenter DCERPC port (default 2012/tcp) using firewalls

[Affected Scope] On-premise deployments of Atlassian Confluence Data Center and Confluence Server (Atlassian Cloud instances are not affected)

[Impact] Unauthenticated remote attackers can bypass access controls to access setup endpoints, create unauthorized administrator accounts, and achieve full system compromise

[Mitigation] Immediately upgrade to the patched official versions, or restrict external access to the vulnerable /setup/* endpoints if patching cannot be applied immediately

[Affected Scope] All on-premises versions of JetBrains TeamCity prior to 2023.05.4

[Impact] Unauthenticated attackers can bypass authentication, gain administrative privileges, hijack build pipelines, and execute arbitrary code on the server

[Mitigation] Immediately upgrade TeamCity server to version 2023.05.4 or later, or apply the official security patch plugin

[Affected Scope] Craft CMS installations running versions prior to 4.4.15

[Impact] Unauthenticated remote attackers can execute arbitrary PHP code and fully compromise the underlying server by sending crafted HTTP requests

[Mitigation] Immediately upgrade Craft CMS to version 4.4.15 or later to resolve the vulnerability

[Affected Scope] Ivanti MobileIron Sentry versions 9.18.0 and below with MICS (Mobile IT Connector System) Admin Portal enabled

[Impact] Unauthenticated attackers can bypass authentication controls on the administrative interface, leading to remote code execution (RCE) and full system compromise

[Mitigation] Immediately apply the official vendor patches and restrict external access to the MICS administrative port (default TCP 8443)

[Affected Scope] Juniper Networks Junos OS on EX Series switches and SRX Series firewalls with the J-Web interface enabled

[Impact] An unauthenticated, network-based attacker can modify the PHP execution environment (PHPRC) via crafted HTTP requests, leading to arbitrary code execution and full device compromise

[Mitigation] Immediately upgrade Junos OS to the patched versions, or disable the J-Web interface and restrict access to trusted IP addresses as a temporary workaround

[Affected Scope] Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier), and 2023u1 (and earlier)

[Impact] Unauthenticated remote attackers can exploit a Deserialization of Untrusted Data vulnerability (CWE-502) to execute arbitrary code with system privileges

[Mitigation] Immediately apply the official Adobe security patches (APSB23-41), restrict external access, and enable WAF rules

[Affected Scope] Citrix NetScaler ADC and NetScaler Gateway appliances configured as a SAML SP or SAML IdP

[Impact] Unauthenticated remote attackers can execute arbitrary code with elevated privileges on the appliance, leading to full system compromise

[Mitigation] Immediately apply the official security patches provided by Citrix and run compromise assessment scripts to detect potential Indicators of Compromise (IoCs)

[Affected Scope] Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier), and 2023.0.0.330468 (and earlier)

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending malicious serialized data

[Mitigation] Immediately apply the official Adobe security patch (APSB23-40) and restrict external access to serialization endpoints

[Affected Scope] Zimbra Collaboration Suite (ZCS) version 8.8.15

[Impact] A remote authenticated attacker can execute arbitrary code and hijack sessions by injecting malicious scripts into the '/h/autoSaveDraft' function

[Mitigation] Immediately apply the official Zimbra security patches and restrict access to the affected endpoint using WAF rules

[Affected Scope] Zyxel NAS326 (prior to V5.21(AAZF.14)C0), NAS540 (prior to V5.21(AATB.11)C0), and NAS542 (prior to V5.21(ABAG.11)C0)

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges by sending crafted HTTP requests, leading to complete system compromise

[Mitigation] Apply the official firmware updates immediately and restrict external internet access to the NAS management interface

[Affected Scope] FortiOS versions 7.2.4 and below, 7.0.11 and below, 6.4.12 and below, 6.0.16 and below; FortiProxy versions 7.2.3 and below, 7.0.9 and below, 2.0.12 and below, and all 1.2/1.1 versions with SSL-VPN enabled

[Impact] An unauthenticated remote attacker can execute arbitrary code or commands with root privileges on the target appliance via specifically crafted HTTP requests

[Mitigation] Immediately upgrade FortiOS and FortiProxy to the patched versions, or disable the SSL-VPN service as a temporary workaround

[Affected Scope] VMware Aria Operations for Networks (formerly vRealize Network Insight) 6.x versions

[Impact] Unauthenticated remote attackers with network access can execute arbitrary commands with root privileges, leading to complete system compromise

[Mitigation] Apply the official VMware security patches (VMSA-2023-0012) immediately and restrict access to management interfaces

[Affected Scope] All MOVEit Transfer versions prior to 2021.0.6, 2021.1.4, 2022.0.4, 2022.1.5, and 2023.0.1, including older unsupported versions

[Impact] Unauthenticated remote attackers can manipulate the database via HTTP/HTTPS requests, potentially leading to remote code execution (RCE) and unauthorized data exfiltration

[Mitigation] Immediately upgrade to the patched versions, restrict external HTTP/HTTPS access to the server, and conduct a thorough compromise assessment

[Affected Scope] Barracuda Email Security Gateway (appliance form factor only) versions 5.1.3.001 through 9.2.0.006

[Impact] A remote attacker can execute arbitrary system commands with the privileges of the ESG product by sending a specially crafted .tar archive, leading to complete system compromise

[Mitigation] Verify the automatic application of patch BNSF-36456, perform a thorough compromise assessment (IoC search), and immediately replace compromised appliances

[Affected Scope] Apache RocketMQ versions 5.1.0 and below, and versions 4.9.5 and below

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with the privileges of the RocketMQ process, leading to full system compromise

[Mitigation] Immediately upgrade to RocketMQ version 5.1.1 or above (for 5.x) or 4.9.6 or above (for 4.x)

[Affected Scope] Zyxel ZyWALL/USG (4.60 to 4.73), VPN (4.60 to 5.35), USG FLEX (4.60 to 5.35), and ATP (4.60 to 5.35) series firmware

[Impact] An unauthenticated remote attacker can execute arbitrary OS commands with root privileges by sending crafted IKE UDP packets to the affected device

[Mitigation] Immediately upgrade to the latest official patched firmware version and restrict access to IKE ports (UDP 500/4500) from untrusted WAN interfaces