CVE Vulnerability Advisory Database

[Affected Scope] SonicWall SMA1000 Series Appliance Work Place interface

[Impact] Unauthenticated remote attackers can bypass authentication, access sensitive internal resources, and perform unauthorized administrative operations, potentially leading to full system compromise

[Mitigation] Immediately apply the official firmware patches provided by SonicWall and restrict external access to the Work Place interface

[Affected Scope] MLflow versions from 3.3.0 prior to 3.15.0

[Impact] Unauthenticated attackers can bypass URL validation to access internal network resources or cloud metadata services, potentially retrieving sensitive credentials and response data.

[Mitigation] Immediately upgrade MLflow to version 3.15.0 or later, and restrict access to the webhook test endpoint in the interim.

[Affected Scope] SonicWall SMA1000 Series Appliance Work Place interface

[Impact] Remote unauthenticated attackers can force the appliance to make requests to unintended internal or external locations, potentially leading to internal network compromise or RCE

[Mitigation] Apply the official firmware updates immediately and restrict external access to the management interface

[Affected Scope] xiweicheng TMS up to version 2.28.0

[Impact] Unauthenticated remote attackers can access internal network resources, invoke internal APIs, or potentially escalate to Remote Code Execution (RCE)

[Mitigation] Apply the latest security patches, sanitize the 'url' parameter in HtmlUtil.java, or deploy WAF rules to block outbound requests to private IP ranges

[Affected Scope] Apache HTTP Server versions 2.4.48 and earlier with mod_proxy enabled

[Impact] Unauthenticated remote attackers can craft malicious URI paths to force mod_proxy to forward requests to an arbitrary origin server, leading to SSRF

[Mitigation] Immediately upgrade Apache HTTP Server to version 2.4.49 or later, or apply strict RewriteRules to block malicious proxy requests

[Affected Scope] Microsoft Exchange Server 2013, 2016, and 2019 on-premises deployments

[Impact] Unauthenticated attackers can bypass security controls to execute arbitrary PowerShell commands with SYSTEM privileges

[Mitigation] Immediately apply the official Microsoft Cumulative Updates (CU) and Security Updates (SU), and restrict external access to Exchange management ports

[Affected Scope] F5 BIG-IP (16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x) and BIG-IQ (7.1.0.x, 7.0.0.x) management interfaces running iControl REST.

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with elevated privileges, leading to complete compromise of the target device.

[Mitigation] Immediately upgrade to the patched versions provided by F5 and restrict access to the iControl REST interface (TCP 443) from untrusted networks.

[Affected Scope] On-premises Microsoft Exchange Server 2013, 2016, and 2019

[Impact] Unauthenticated remote attackers can bypass authentication, access sensitive mailbox data, and chain with other vulnerabilities to execute arbitrary code (RCE)

[Mitigation] Immediately apply the official Microsoft Cumulative Update (CU) and Security Update (SU), or implement IIS URL Rewrite rules to block malicious requests

[Affected Scope] Accellion FTA 9_12_411 and earlier

[Impact] Unauthenticated remote attackers can exploit this vulnerability via crafted POST requests to access internal network resources or chain it with other flaws for remote code execution

[Mitigation] Immediately upgrade Accellion FTA to version 9_12_416 or later and restrict external access

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions prior to 8.8.15 Patch 7 with WebEx zimlet installed and zimlet JSP enabled

[Impact] Unauthenticated remote attackers can exploit Server-Side Request Forgery (SSRF) to access internal network resources, extract sensitive data, or pivot to further remote code execution (RCE)

[Mitigation] Immediately upgrade Zimbra Collaboration Suite to 8.8.15 Patch 7 or later, or disable and undeploy the unused WebEx zimlet

[Affected Scope] Synacor Zimbra Collaboration Suite (ZCS) 8.7.x before 8.7.11p10

[Impact] Unauthenticated remote attackers can exploit this XML External Entity (XXE) vulnerability to read arbitrary local files, perform SSRF, and achieve Remote Code Execution (RCE)

[Mitigation] Immediately upgrade Zimbra Collaboration Suite to version 8.7.11p10 or later, and restrict external access to the Autodiscover servlet endpoint