CVE Vulnerability Advisory Database

[Affected Scope] F5 BIG-IP APM virtual servers configured with an OAuth Authorization Server profile.

[Impact] Unauthenticated attackers can execute arbitrary code with system privileges via specially crafted traffic, leading to full system compromise.

[Mitigation] Immediately apply the latest security patches or Hotfixes provided by F5, and consider disabling the OAuth Authorization Server profile until patched.

[Affected Scope] All client environments running FreeRDP versions prior to 3.21.0

[Impact] A malicious RDP server can trigger a client-side heap buffer overflow, leading to Denial of Service (DoS) or potential Remote Code Execution (RCE)

[Mitigation] Immediately upgrade FreeRDP to the patched version 3.21.0 or higher

[Affected Scope] Client environments running FreeRDP versions prior to 3.21.0

[Impact] A malicious RDP server can trigger a client-side heap buffer overflow, leading to Denial of Service (DoS) or potential Remote Code Execution (RCE)

[Mitigation] Immediately upgrade FreeRDP to the patched version 3.21.0 or higher

[Affected Scope] FortiOS versions 6.4 through 7.6 and FortiSwitchManager versions 7.0 through 7.2.

[Impact] Unauthenticated remote attackers can execute arbitrary code or commands with system privileges by sending crafted packets, leading to full system compromise.

[Mitigation] Immediately apply the latest firmware updates provided by Fortinet and restrict exposure of management interfaces and VPN services to the public internet.

[Affected Scope] VMware vCenter Server versions 7.0 and 8.0, VMware Cloud Foundation versions 4.x and 5.x

[Impact] An unauthenticated remote attacker can trigger a heap overflow via specially crafted DCERPC packets, potentially executing arbitrary code with root privileges

[Mitigation] Immediately apply the official Broadcom security patches (vCenter 8.0 U3b / 7.0 U3s or later) and restrict network access to vCenter management ports

[Affected Scope] FortiOS versions 7.2.4 and below, 7.0.11 and below, 6.4.12 and below, 6.0.16 and below; FortiProxy versions 7.2.3 and below, 7.0.9 and below, 2.0.12 and below, and all 1.2/1.1 versions with SSL-VPN enabled

[Impact] An unauthenticated remote attacker can execute arbitrary code or commands with root privileges on the target appliance via specifically crafted HTTP requests

[Mitigation] Immediately upgrade FortiOS and FortiProxy to the patched versions, or disable the SSL-VPN service as a temporary workaround

[Affected Scope] FortiOS versions 7.2.0 to 7.2.2, 7.0.0 to 7.0.8, 6.4.0 to 6.4.10, 6.2.0 to 6.2.11, 6.0.15 and earlier; FortiProxy versions 7.2.0 to 7.2.1, 7.0.7 and earlier

[Impact] An unauthenticated remote attacker can execute arbitrary code or commands with root privileges on the target system by sending specifically crafted HTTP/HTTPS requests

[Mitigation] Immediately upgrade to the patched firmware versions or disable the SSL-VPN service and restrict access using local-in policies if patching is delayed

[Affected Scope] Google Chrome for Android prior to version 86.0.4240.185

[Impact] A remote attacker who has compromised the renderer process can trigger a heap buffer overflow in the UI component via a crafted HTML page, potentially leading to a complete sandbox escape and arbitrary code execution on the target device

[Mitigation] Immediately update Google Chrome for Android to version 86.0.4240.185 or later via the Google Play Store

[Affected Scope] WhatsApp and WhatsApp Business prior to specific patched versions across Android, iOS, Windows Phone, and Tizen platforms

[Impact] Remote attackers can execute arbitrary code (RCE) and compromise target devices without user interaction by sending specially crafted RTCP packets

[Mitigation] Immediately update WhatsApp applications to the latest official patched versions via respective app stores

[Affected Scope] Adobe Flash Player before 13.0.0.296, and 14.x through 18.x before 18.0.0.194 on Windows and OS X, and before 11.2.202.468 on Linux

[Impact] Remote attackers can execute arbitrary code and gain full system control via specially crafted malicious Flash content (.swf) without user interaction

[Mitigation] Since Adobe Flash Player has reached End-of-Life (EOL), the recommended mitigation is to completely uninstall Flash Player and disable browser plugins across all systems