CVE Vulnerability Advisory Database

[Affected Scope] All unpatched versions of SiteGuard Server Edition

[Impact] Local attackers with low privileges can execute arbitrary OS commands as root or SYSTEM, leading to full system compromise

[Mitigation] Immediately apply the official security patch from EG Secure and audit local server access permissions

[Affected Scope] SonicWall SMA1000 Appliance Management Console (AMC) management interface

[Impact] A remote authenticated attacker with administrator privileges can execute arbitrary OS commands under specific conditions, leading to complete system compromise

[Mitigation] Immediately apply the official security patches provided by SonicWall and restrict access to the AMC management interface

[Affected Scope] Zimbra Collaboration (ZCS) versions prior to 10.1.20, specifically when the optional zimbra-snmp package is installed and SNMP notifications are enabled.

[Impact] An unauthenticated remote attacker can execute arbitrary operating system commands as the Zimbra user by sending specially crafted SMTP requests.

[Mitigation] Immediately upgrade Zimbra Collaboration to version 10.1.20 or later, or temporarily disable the zimbra-snmp service.

[Affected Scope] On-premises deployments of VeloCloud Orchestrator (VCO)

[Impact] Unauthenticated remote attackers can access privileged internal functionalities and execute arbitrary OS commands (CWE-78), leading to complete compromise of the orchestrator's confidentiality, integrity, and availability

[Mitigation] Immediately apply the official security patches provided by the vendor and restrict external network access to the orchestrator management interface

[Affected Scope] Kestra open-source versions prior to 1.0.45 and 1.3.21

[Impact] Unauthenticated remote attackers can bypass authentication filters to create and execute arbitrary workflows, leading to Remote Code Execution (RCE) as root inside the worker container

[Mitigation] Immediately upgrade Kestra to version 1.0.45, 1.3.21, or higher

[Affected Scope] Fortinet FortiSandbox (5.0.0 to 5.0.5, 4.4.0 to 4.4.8, 4.2 all versions), FortiSandbox Cloud and PaaS (5.0.4 to 5.0.5)

[Impact] An unauthenticated remote attacker can execute unauthorized OS commands with root privileges via specially crafted HTTP requests

[Mitigation] Immediately upgrade to the patched versions (5.0.6, 4.4.9 or higher) and restrict external access to the management interface

[Affected Scope] Ivanti Sentry versions prior to R10.5.2, R10.6.2, and R10.7.1

[Impact] An unauthenticated remote attacker can execute arbitrary OS commands with root privileges, leading to complete system compromise

[Mitigation] Immediately upgrade to the patched versions (R10.5.2, R10.6.2, R10.7.1, or higher)

[Affected Scope] LiteLLM proxy server environments running versions 1.74.2 to before 1.83.7

[Impact] Authenticated users with low-privilege API keys can execute arbitrary OS commands on the proxy host, potentially leading to full system compromise

[Mitigation] Immediately upgrade LiteLLM to the patched version 1.83.7 or later, and restrict access to the vulnerable endpoints in the interim

[Affected Scope] Fortinet FortiSandbox versions 4.4.0 through 4.4.8

[Impact] Unauthenticated remote attackers can execute unauthorized OS commands or code with elevated privileges, potentially leading to full system compromise

[Mitigation] Immediately upgrade to FortiSandbox version 4.4.9 or higher, and restrict access to management interfaces

[Affected Scope] Apache ActiveMQ Classic versions prior to 5.19.4, and 6.0.0 through 6.2.3

[Impact] An authenticated attacker can execute arbitrary system commands within the broker's JVM by loading a malicious remote Spring XML configuration via the Jolokia JMX-HTTP bridge

[Mitigation] Immediately upgrade Apache ActiveMQ to a patched version (5.19.4 or 6.2.3) and restrict Jolokia access policies

[Affected Scope] Lantronix EDS5000 device servers running firmware version 2.1.0.0R3

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges by sending crafted HTTP RPC requests

[Mitigation] Apply the official firmware patch immediately, and restrict external access to the HTTP/HTTPS management interfaces

[Affected Scope] Nextcloud deployments utilizing the Collabora Online - Built-in CODE Server (richdocumentscode) app prior to version 25.04.702

[Impact] Unauthenticated attackers can exploit a configuration-dependent OS Command Injection vulnerability via proxy.php and an intermediate reverse proxy to achieve Remote Code Execution (RCE)

[Mitigation] Immediately upgrade the richdocumentscode application to version 25.04.702 or later, and restrict external access to the proxy endpoint in the interim