CVE Vulnerability Advisory Database

[Affected Scope] Cisco Identity Services Engine (ISE) web-based management interface and API endpoints.

[Impact] Unauthenticated remote attackers can gain full administrative access to the device by bypassing authentication controls.

[Mitigation] Apply the latest security patches from Cisco immediately and restrict access to management interfaces via ACLs.

[Affected Scope] Websites utilizing the SP Page Builder extension for Joomla

[Impact] Unauthenticated attackers can upload and execute malicious PHP code, leading to complete takeover of the web server

[Mitigation] Immediately update to the latest patched version, apply WAF rules, and disable PHP execution in upload directories

[Affected Scope] Sitecore Experience Manager (XM) and Experience Platform (XP) versions up to and including 9.0

[Impact] Unauthenticated remote attackers can execute arbitrary code and fully compromise the host system via deserialization of untrusted data

[Mitigation] Immediately apply the official security patches from the vendor, or implement temporary workarounds such as enforcing ViewState encryption and restricting access

[Affected Scope] Apple devices running iOS/iPadOS versions prior to 15.8.5, 16.7.12, 18.6.2, iPadOS 17.7.10, or macOS versions prior to Sequoia 15.6.1, Sonoma 14.7.8, and Ventura 13.7.8

[Impact] Processing a maliciously crafted image file may lead to memory corruption, allowing remote attackers to execute arbitrary code or gain full system control without user interaction

[Mitigation] Immediately apply the official security patches provided by Apple (iOS 15.8.5, 16.7.12, 18.6.2, iPadOS 17.7.10, macOS 15.6.1, etc.)

[Affected Scope] Apple devices running iOS < 18.4.1, iPadOS < 18.4.1, macOS Sequoia < 15.4.1, tvOS < 18.4.1, and visionOS < 2.4.1

[Impact] Attackers with arbitrary read/write capabilities can bypass hardware-level Pointer Authentication (PAC) to execute arbitrary code with kernel privileges

[Mitigation] Immediately apply the official security updates released by Apple (iOS 18.4.1, macOS 15.4.1, etc.)

[Affected Scope] Apple iOS and iPadOS prior to 18.4.1, macOS Sequoia prior to 15.4.1, tvOS prior to 18.4.1, visionOS prior to 2.4.1, and watchOS prior to 11.5

[Impact] Processing a maliciously crafted media file containing an audio stream may lead to arbitrary remote code execution (RCE) on the target system

[Mitigation] Immediately apply the official software updates provided by Apple to patch the vulnerability

[Affected Scope] Devices running iOS 15/16/17/18, iPadOS, macOS Sequoia, visionOS, watchOS, and Safari browser

[Impact] Processing maliciously crafted web content may allow an attacker to break out of the Web Content sandbox and execute arbitrary code, with active exploitation reported in targeted attacks

[Mitigation] Immediately apply the official security updates released by Apple, including iOS 18.3.2 and macOS 15.3.2

[Affected Scope] ScienceLogic SL1 (formerly EM7) versions prior to 12.1.3, 12.2.3, and 12.3, including older lines 10.1.x, 10.2.x, 11.1.x, 11.2.x, and 11.3.x

[Impact] Unauthenticated remote attackers can exploit an unspecified third-party component packaged with SL1 to execute arbitrary commands and gain full system control

[Mitigation] Immediately upgrade to patched SL1 versions (12.1.3+, 12.2.3+, 12.3+) or apply the corresponding hotfixes for your specific version line

[Affected Scope] Google Chrome prior to 128.0.6613.84 and all affected Chromium-based browsers (e.g., Microsoft Edge)

[Impact] Remote attackers can trigger heap corruption and execute arbitrary code within the browser renderer process via a crafted HTML page

[Mitigation] Immediately update all Chromium-based browsers to the latest stable release (Chrome 128.0.6613.84 or higher)

[Affected Scope] Apple iOS before 14.4, iPadOS before 14.4, macOS Big Sur before 11.2, and macOS Catalina/Mojave prior to Security Update 2021-001.

[Impact] A remote attacker can execute arbitrary code on the target device via malicious web content, bypassing sandbox restrictions. This vulnerability has been actively exploited in the wild.

[Mitigation] Immediately apply the official software updates provided by Apple to upgrade to iOS/iPadOS 14.4, macOS Big Sur 11.2, or later.

[Affected Scope] Google Chrome versions prior to 86.0.4240.111 and FreeType library versions prior to 2.10.4

[Impact] Remote attackers can trigger heap corruption and potentially execute arbitrary code via a specially crafted HTML page or font file

[Mitigation] Immediately upgrade Google Chrome to version 86.0.4240.111 or later, and update the FreeType library to version 2.10.4 or higher

[Affected Scope] Adobe Flash Player 21.0.0.242 and earlier versions across Windows, macOS, Linux, and ChromeOS

[Impact] Remote attackers can execute arbitrary code and gain full system control via specially crafted malicious Flash content (SWF)

[Mitigation] Since Adobe Flash Player has reached End-of-Life (EOL), the only effective mitigation is to completely uninstall Flash Player from all systems

[Affected Scope] Adobe Flash Player 21.0.0.197 and earlier versions

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (application crash) via specially crafted Flash content

[Mitigation] Since Adobe Flash Player has reached End-of-Life (EOL), completely uninstall Flash Player from all systems and transition to modern web standards

[Affected Scope] Adobe Flash Player through 13.0.0.262, 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X, and through 11.2.202.438 on Linux

[Impact] Remote attackers can execute arbitrary code with the privileges of the active user and compromise the host system by enticing users to visit a website containing malicious Flash content (SWF)

[Mitigation] Since Adobe Flash Player has reached End-of-Life (EOL), it is highly recommended to completely uninstall Flash Player from all endpoints and disable Flash plugins in web browsers

[Affected Scope] Microsoft Internet Explorer versions 6 through 11

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (memory corruption) via crafted web pages, potentially leading to full system compromise

[Mitigation] Apply the official Microsoft cumulative security update, or implement immediate workarounds such as unregistering VGX.DLL and enabling Enhanced Mitigation Experience Toolkit (EMET)