CVE Vulnerability Advisory Database

[Affected Scope] ConnectWise ScreenConnect client software (Servers are not impacted)

[Impact] Attackers can exploit active remote sessions to transfer and execute malicious files without host confirmation, leading to full system compromise.

[Mitigation] Immediately update all ScreenConnect clients to the latest patched version and enforce session consent policies.

[Affected Scope] Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, specifically the Oracle Payments (File Transmission) component

[Impact] Unauthenticated remote attackers can bypass authentication via HTTP, leading to complete takeover of the Oracle Payments module

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately, and restrict external HTTP access to the Payments module until patched

[Affected Scope] Microsoft Partner Center Portal (Partner.Microsoft.com) services and associated API endpoints

[Impact] An unauthenticated remote attacker can elevate privileges over the network, potentially gaining administrative control over partner accounts and sensitive tenant data

[Mitigation] As this is a cloud-hosted service, Microsoft has applied server-side mitigations; however, organizations must immediately audit Partner Center API integrations, permissions, and admin logs

[Affected Scope] Microsoft Exchange Server 2013, 2016, and 2019 on-premises deployments

[Impact] Attackers can elevate privileges to SYSTEM, enabling remote code execution (RCE) when chained with other ProxyShell vulnerabilities

[Mitigation] Immediately apply the official Microsoft Cumulative Updates (CU) and Security Updates (SU), and restrict external access to Exchange IIS ports

[Affected Scope] On-premises and virtual appliance deployments of SonicWall Email Security running version 10.0.9.x.

[Impact] Unauthenticated remote attackers can create administrative accounts by sending crafted HTTP requests, leading to full system compromise.

[Mitigation] Immediately upgrade to the patched firmware version (10.0.9.6173, 10.0.10, or higher).

[Affected Scope] Atlassian Crowd and Crowd Data Center from version 2.1.0 up to 3.4.4 (specific minor version ranges)

[Impact] Unauthenticated remote attackers can upload and install arbitrary plugins, leading to complete remote code execution (RCE) on the host system

[Mitigation] Immediately upgrade to the fixed versions (3.0.5, 3.1.6, 3.2.8, 3.3.5, 3.4.4 or later) or disable/remove the pdkinstall plugin

[Affected Scope] Intel Active Management Technology (AMT), Standard Manageability (ISM), and Small Business Technology (SBT) firmware versions 6.x, 7.x, 8.x, 9.x, 10.x, and 11.x

[Impact] An unprivileged network or local attacker can bypass authentication to gain administrative system privileges and execute arbitrary code

[Mitigation] Apply the latest firmware updates provided by your system OEM, or disable AMT/ISM features and block associated ports immediately

[Affected Scope] Adobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows operating systems.

[Impact] Attackers can bypass the sandbox protection mechanism and execute arbitrary native code in a privileged context.

[Mitigation] Immediately upgrade affected installations to patched versions 10.1.11, 11.0.08, or later.