CVE Vulnerability Advisory Database

[Affected Scope] FreeRDP client libraries and dependent applications prior to version 3.21.0

[Impact] Remote Code Execution (RCE) or Denial of Service (DoS) on the client side when connecting to a malicious RDP server

[Mitigation] Immediately upgrade FreeRDP to the patched version 3.21.0 or higher

[Affected Scope] X11-based RDP client environments running FreeRDP versions prior to 3.21.0

[Impact] Connecting to a malicious RDP server can trigger client-side memory corruption (UAF), leading to application crashes (DoS) or potential remote code execution (RCE)

[Mitigation] Immediately upgrade FreeRDP to the patched version 3.21.0 or higher

[Affected Scope] Apple operating systems prior to iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, and other legacy versions

[Impact] A malicious application can exploit a Use-After-Free vulnerability to elevate privileges to system/kernel level and execute arbitrary code

[Mitigation] Immediately upgrade all affected Apple devices to the latest patched versions (iOS 18.3, macOS 15.3, etc.) via official software update channels

[Affected Scope] Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0

[Impact] An attacker can achieve arbitrary remote code execution (RCE) within the browser's content process, with active exploitation reported in the wild

[Mitigation] Immediately update all affected installations to the latest patched versions (Firefox 131.0.2+, ESR 128.3.1+, ESR 115.16.1+, Thunderbird 131.0.1+, 128.3.1+, 115.16.0+)

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 124.0.6367.201

[Impact] A remote attacker who has compromised the renderer process can exploit this vulnerability via a crafted HTML page to escape the browser sandbox and execute arbitrary code

[Mitigation] Immediately update Google Chrome to the latest stable version (124.0.6367.201 or higher) and enforce auto-update policies across the enterprise

[Affected Scope] Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0

[Impact] Attackers can trigger a Use-After-Free (UAF) condition via crafted web content, leading to arbitrary code execution and a complete sandbox escape on the host OS

[Mitigation] Immediately update all affected Mozilla products to their respective patched versions (Firefox 97.0.2+, Firefox ESR 91.6.1+, Thunderbird 91.6.2+, etc.)

[Affected Scope] Google Chrome prior to version 94.0.4606.61 on desktop platforms

[Impact] A remote attacker who has compromised the renderer process can potentially bypass the Chrome sandbox and execute arbitrary code on the host system via a crafted HTML page

[Mitigation] Immediately update Google Chrome to the latest stable version (94.0.4606.61 or higher) and enforce automatic updates across enterprise endpoints

[Affected Scope] Google Chrome prior to version 93.0.4577.82

[Impact] A remote attacker who has compromised the renderer process can potentially execute arbitrary code and escape the browser sandbox via a crafted HTML page

[Mitigation] Immediately update Google Chrome to the latest stable version (93.0.4577.82 or higher)

[Affected Scope] HTTP.sys services running on Windows 10 versions 2004, 20H2 and Windows Server versions 2004, 20H2

[Impact] Unauthenticated remote attackers can execute arbitrary code in the kernel context or trigger an immediate Blue Screen of Death (BSOD) leading to Denial of Service (DoS) by sending specially crafted HTTP packets

[Mitigation] Apply the official Microsoft cumulative security updates immediately, and restrict external exposure of HTTP.sys-dependent services prior to patching

[Affected Scope] Google Chrome prior to version 86.0.4240.198

[Impact] A remote attacker who has compromised the renderer process can bypass sandbox boundaries and potentially execute arbitrary code on the host system via a crafted HTML page

[Mitigation] Immediately update Google Chrome to the latest stable version (86.0.4240.198 or higher)

[Affected Scope] VMware ESXi 7.0 (prior to ESXi_7.0.1-0.0.16850804), 6.7 (prior to ESXi670-202010401-SG), and 6.5 (prior to ESXi650-202010401-SG)

[Impact] A malicious actor with access to port 427 on the management network can trigger a Use-After-Free in the OpenSLP service, leading to unauthenticated Remote Code Execution (RCE)

[Mitigation] Apply the official VMware security patches immediately, or disable the OpenSLP service on ESXi hosts as a temporary workaround

[Affected Scope] Legacy Windows operating systems including Windows XP, Windows 7, Windows Server 2003, Windows Server 2008, and 2008 R2

[Impact] An unauthenticated remote attacker can execute arbitrary code with kernel-level privileges or trigger a system crash (DoS) by sending specially crafted RDP requests, enabling wormable self-propagation across networks

[Mitigation] Immediately apply the official Microsoft security patches, or disable RDP services and enable Network Level Authentication (NLA) if patching is not feasible

[Affected Scope] Adobe Flash Player 21.0.0.226 and earlier versions across Windows, macOS, Linux, and ChromeOS

[Impact] Remote attackers can execute arbitrary code with the privileges of the active user and gain full system control via crafted malicious Flash content (SWF)

[Mitigation] Since Adobe Flash Player has reached End-of-Life (EOL), the recommended action is to completely uninstall it or disable Flash execution in all browsers and applications

[Affected Scope] Adobe Flash Player 21.0.0.197 and earlier versions

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (application crash) via specially crafted Flash content

[Mitigation] Since Adobe Flash Player has reached End-of-Life (EOL), completely uninstall Flash Player from all systems and transition to modern web standards

[Affected Scope] Adobe Flash Player 13.x through 18.x and 11.x legacy versions on Windows, OS X, and Linux

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content

[Mitigation] Since Adobe Flash Player has reached End-of-Life (EOL), the recommended mitigation is to completely uninstall Flash Player from all systems

[Affected Scope] Adobe Flash Player 13.x through 13.0.0.302, 14.x through 18.0.0.203 on Windows/OS X, and 11.x/12.x on Linux

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content

[Mitigation] Since Adobe Flash Player has reached End-of-Life (EOL), completely uninstall Flash Player and transition to modern web standards like HTML5

[Affected Scope] Adobe Flash Player 13.x through 18.x on Windows/OS X, and 11.x through 11.2.202.468 on Linux

[Impact] Remote attackers can execute arbitrary code or trigger a denial of service (system crash) via crafted Flash content

[Mitigation] Completely uninstall Adobe Flash Player or disable the Flash plugin across all web browsers and operating systems

[Affected Scope] Adobe Flash Player before 13.0.0.269, 14.x through 16.x before 16.0.0.305 on Windows and OS X, and before 11.2.202.442 on Linux

[Impact] Remote attackers can execute arbitrary code (RCE) and gain full system control via specially crafted malicious Flash content (SWF) without user interaction

[Mitigation] Since Adobe Flash Player has reached End-of-Life (EOL), the only secure mitigation is to completely uninstall Flash Player from all systems

[Affected Scope] Adobe Flash Player through 13.0.0.262, 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X, and through 11.2.202.438 on Linux

[Impact] Remote attackers can execute arbitrary code with the privileges of the active user and compromise the host system by enticing users to visit a website containing malicious Flash content (SWF)

[Mitigation] Since Adobe Flash Player has reached End-of-Life (EOL), it is highly recommended to completely uninstall Flash Player from all endpoints and disable Flash plugins in web browsers

[Affected Scope] Microsoft Internet Explorer versions 6 through 11

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (memory corruption) via crafted web pages, potentially leading to full system compromise

[Mitigation] Apply the official Microsoft cumulative security update, or implement immediate workarounds such as unregistering VGX.DLL and enabling Enhanced Mitigation Experience Toolkit (EMET)