CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Apache HTTP Server mod_rewrite Improper Output Escaping Remote Code Execution and Source Code Disclosure (CVE-2024-38475)
[Affected Scope] Apache HTTP Server versions 2.4.59 and earlier, specifically environments utilizing mod_rewrite rules where substitutions in server context use backreferences or variables as the first segment.
[Impact] Attackers can map URLs to restricted filesystem locations, leading to unauthorized source code disclosure or arbitrary code execution (RCE).
[Mitigation] Immediately upgrade Apache HTTP Server to version 2.4.60 or later, and review/restrict unsafe RewriteRules.
Cobalt Strike Remote Code Execution Vulnerability via Swing Component HTML Injection (CVE-2022-42948)
[Affected Scope] Cobalt Strike version 4.7.1
[Impact] Remote attackers can execute arbitrary code within the Cobalt Strike UI context by injecting crafted HTML payloads
[Mitigation] Immediately upgrade to Cobalt Strike version 4.7.2 or later, and restrict access to the Teamserver