CVE Vulnerability Advisory Database

[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)

[Impact] Unauthenticated attackers can execute arbitrary code on the GitLab server via crafted CI/CD configurations, leading to full system compromise

[Mitigation] Immediate upgrade to patched versions 19.2.8, 19.3.5, or 19.4.2 is mandatory

[Affected Scope] Citrix NetScaler ADC and Gateway versions prior to 14.1-73.37 and 13.1-64.23, including FIPS/NDcPP variants.

[Impact] Unauthenticated remote attackers can execute arbitrary commands with system privileges, leading to full appliance compromise and potential lateral movement.

[Mitigation] Immediately apply the vendor-supplied security patches and restrict access to management interfaces (NSIP).

[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.

[Impact] Unauthenticated remote attackers can read arbitrary files from the server, potentially leading to full system compromise and credential theft.

[Mitigation] Immediate upgrade to patched versions: 18.11.12, 19.0.9, 19.1.8, 19.2.6, or 19.3.2.

[Affected Scope] Web management interface of PaperCut MF and PaperCut NG.

[Impact] Unauthenticated remote attackers can trigger backend actions and modify system configurations before access validation checks complete, potentially leading to Remote Code Execution (RCE).

[Mitigation] Apply the official vendor security patches immediately and restrict external access to the web management ports (default 9191, 9192).

[Affected Scope] MLflow versions from 3.3.0 prior to 3.15.0

[Impact] Unauthenticated attackers can bypass URL validation to access internal network resources or cloud metadata services, potentially retrieving sensitive credentials and response data.

[Mitigation] Immediately upgrade MLflow to version 3.15.0 or later, and restrict access to the webhook test endpoint in the interim.

[Affected Scope] SonicWall SMA1000 Series Appliance Work Place interface

[Impact] Remote unauthenticated attackers can force the appliance to make requests to unintended internal or external locations, potentially leading to internal network compromise or RCE

[Mitigation] Apply the official firmware updates immediately and restrict external access to the management interface

[Affected Scope] Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62

[Impact] Unauthenticated remote attackers can compromise and completely take over the PeopleSoft Enterprise PeopleTools system via HTTP network access

[Mitigation] Immediately apply the official Oracle Critical Patch Update (CPU) and restrict external HTTP access to the affected component

[Affected Scope] Splunk Enterprise versions 10.2.x below 10.2.4 and 10.0.x below 10.0.7 (versions 9.4 and earlier are unaffected)

[Impact] An unauthenticated remote attacker can access the PostgreSQL sidecar service endpoint to create or truncate arbitrary files, potentially leading to Remote Code Execution (RCE)

[Mitigation] Immediately upgrade to patched versions (10.2.4+, 10.0.7+) or disable the PostgreSQL sidecar service if an immediate upgrade is not feasible

[Affected Scope] Fortinet FortiSandbox (5.0.0 to 5.0.5, 4.4.0 to 4.4.8, 4.2 all versions), FortiSandbox Cloud and PaaS (5.0.4 to 5.0.5)

[Impact] An unauthenticated remote attacker can execute unauthorized OS commands with root privileges via specially crafted HTTP requests

[Mitigation] Immediately upgrade to the patched versions (5.0.6, 4.4.9 or higher) and restrict external access to the management interface

[Affected Scope] Langflow versions prior to 1.9.0

[Impact] Unauthenticated remote attackers can execute arbitrary Python code and gain full control over the host system

[Mitigation] Immediately upgrade Langflow to version 1.9.0 or higher, and restrict external access to the vulnerable endpoint

[Affected Scope] SmarterTools SmarterMail software versions prior to Build 9511

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands on the target system via a malicious HTTP server, leading to complete system compromise

[Mitigation] Immediately upgrade SmarterMail to the latest stable version (Build 9511 or higher) and restrict access to administrative endpoints

[Affected Scope] Laravel Livewire versions v3.0.0 up to and including v3.6.3

[Impact] Unauthenticated remote attackers can exploit the component hydration process to execute arbitrary system commands on the host server

[Mitigation] Immediately upgrade the Livewire package to the patched version v3.6.4 or later

[Affected Scope] Specific API endpoints of Cisco Identity Services Engine (ISE) and Cisco ISE-PIC

[Impact] An unauthenticated, remote attacker can execute arbitrary code with root privileges on the underlying operating system

[Mitigation] Immediately apply the official security patches provided by Cisco and restrict access to the API ports from untrusted networks

[Affected Scope] Specific API endpoints of Cisco Identity Services Engine (ISE) and Cisco ISE-PIC

[Impact] An unauthenticated, remote attacker can execute arbitrary code with root privileges on the underlying operating system by sending a crafted API request

[Mitigation] Immediately apply the official security patches provided by Cisco and restrict access to the management API ports

[Affected Scope] Erlang/OTP versions prior to OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20

[Impact] Unauthenticated remote attackers can exploit a flaw in SSH protocol message handling to execute arbitrary commands and gain full system control without valid credentials

[Mitigation] Immediately upgrade Erlang/OTP to patched versions (OTP-27.3.3, OTP-26.2.5.11, or OTP-25.3.2.20) or temporarily disable the SSH server and restrict access via firewall rules

[Affected Scope] Langflow versions prior to 1.3.0

[Impact] A remote, unauthenticated attacker can execute arbitrary Python code and fully compromise the host system by sending crafted HTTP requests.

[Mitigation] Immediately upgrade Langflow to version 1.3.0 or later, and restrict external access to the vulnerable endpoint.

[Affected Scope] Cleo Harmony, VLTrader, and LexiCom versions prior to 5.8.0.24

[Impact] Unauthenticated remote attackers can leverage default settings of the Autorun directory to import and execute arbitrary Bash or PowerShell commands on the host system, leading to full system compromise.

[Mitigation] Immediately upgrade to the patched version (5.8.0.24 or higher) and restrict access to exposed management interfaces.

[Affected Scope] NuPoint Unified Messaging (NPM) component within Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201)

[Impact] Unauthenticated remote attackers can exploit insufficient input validation to perform path traversal, allowing unauthorized access to view, corrupt, or delete user data and system configurations

[Mitigation] Immediately upgrade to the latest patched version provided by the vendor, and restrict external access to management interfaces

[Affected Scope] Progress WhatsUp Gold versions released before 2024.0.0

[Impact] An unauthenticated remote attacker can execute arbitrary SQL queries to retrieve sensitive database information, including encrypted user password hashes

[Mitigation] Immediately upgrade WhatsUp Gold to version 2024.0.0 or later and restrict database and web console access

[Affected Scope] Progress WhatsUp Gold versions prior to 2023.1.3

[Impact] Unauthenticated remote attackers can execute arbitrary commands with 'iisapppool\ mconsole' privileges, leading to full system compromise

[Mitigation] Immediately upgrade WhatsUp Gold to version 2023.1.3 or later and restrict external access