CVE Vulnerability Advisory Database

[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.

[Impact] Unauthenticated remote attackers can read arbitrary files from the server, potentially leading to full system compromise and credential theft.

[Mitigation] Immediate upgrade to patched versions: 18.11.12, 19.0.9, 19.1.8, 19.2.6, or 19.3.2.

[Affected Scope] SysAid On-Prem versions <= 23.3.40

[Impact] Unauthenticated remote attackers can exploit the Server URL processing logic to read arbitrary files, hijack administrator accounts, and potentially achieve Remote Code Execution (RCE)

[Mitigation] Immediately upgrade SysAid On-Prem to the patched version (24.40.60 or higher) and restrict external access to the application

[Affected Scope] NAKIVO Backup & Replication versions prior to 11.0.0.88174

[Impact] Unauthenticated remote attackers can exploit absolute path traversal to read arbitrary system files, potentially leading to enterprise-wide Remote Code Execution (RCE) due to cleartext credentials stored in PhysicalDiscovery.

[Mitigation] Immediately upgrade NAKIVO Backup & Replication to version 11.0.0.88174 or later and restrict external access.

[Affected Scope] Check Point Security Gateways connected to the internet with Remote Access VPN or Mobile Access Software Blades enabled

[Impact] Unauthenticated remote attackers can read sensitive system files (e.g., /etc/shadow, password hashes, configuration files), potentially leading to credential theft and full network compromise

[Mitigation] Immediately apply the official hotfix provided in Check Point Advisory sk182336, audit system logs for IoCs, and rotate all sensitive credentials

[Affected Scope] Adobe ColdFusion 2023 Update 6 and earlier, and ColdFusion 2021 Update 12 and earlier

[Impact] Unauthenticated attackers can bypass access controls to read or modify arbitrary files on the host system, potentially exposing sensitive configuration data

[Mitigation] Apply the official Adobe APSB24-14 security patch immediately and restrict external internet access to the ColdFusion administrator panel

[Affected Scope] Jenkins weekly version 2.441 and earlier, LTS version 2.426.2 and earlier

[Impact] Unauthenticated attackers can read arbitrary files on the Jenkins controller file system, potentially leading to Remote Code Execution (RCE) under specific conditions

[Mitigation] Immediately upgrade Jenkins weekly to 2.442 or later, and LTS to 2.426.3 or later, or disable CLI access

[Affected Scope] ZKTeco ZKBioTime v8.5.5 and all versions prior to 9.0.120240617.19506

[Impact] Unauthenticated remote attackers can read arbitrary sensitive system files by sending a crafted payload to the vulnerable API endpoint

[Mitigation] Immediately upgrade to the patched version (9.0.120240617.19506 or higher) and restrict external access to the application

[Affected Scope] On-premise Grafana installations running versions 8.0.0-beta1 through 8.3.0 (excluding Grafana Cloud)

[Impact] Unauthenticated remote attackers can exploit directory traversal to read sensitive local system and configuration files

[Mitigation] Immediately upgrade to patched versions (8.0.7, 8.1.8, 8.2.7, or 8.3.1+) or block the vulnerable URL path via reverse proxy

[Affected Scope] Apache Flink versions 1.11.0, 1.11.1, and 1.11.2

[Impact] Unauthenticated remote attackers can read arbitrary files on the JobManager local filesystem via the REST interface

[Mitigation] Immediately upgrade to Apache Flink 1.11.3, 1.12.0, or later versions

[Affected Scope] SAP NetWeaver Application Server Java version 7.5.

[Impact] Unauthenticated remote attackers can read arbitrary system and configuration files by exploiting a directory traversal vulnerability using '..' sequences in the query string.

[Mitigation] Apply SAP Security Note 2486657 immediately, and implement WAF rules to block directory traversal patterns in the interim.