CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Trimble Cityworks Deserialization Vulnerability Leading to IIS Remote Code Execution (CVE-2025-0994)
[Affected Scope] Trimble Cityworks versions prior to 15.8.9 and Cityworks with Office Companion versions prior to 23.10
[Impact] Authenticated attackers can exploit a deserialization vulnerability (CWE-502) to execute arbitrary code with system privileges on the Microsoft IIS web server
[Mitigation] Immediately upgrade to patched versions (Cityworks 15.8.9+ or Office Companion 23.10+) and restrict IIS access controls
Zimbra Collaboration Suite (ZCS) 8.8.15 Stored XSS Vulnerability Leading to Remote Code Execution (CVE-2023-34192) Security Advisory
[Affected Scope] Zimbra Collaboration Suite (ZCS) version 8.8.15
[Impact] A remote authenticated attacker can execute arbitrary code and hijack sessions by injecting malicious scripts into the '/h/autoSaveDraft' function
[Mitigation] Immediately apply the official Zimbra security patches and restrict access to the affected endpoint using WAF rules
Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31196) Security Advisory
[Affected Scope] Microsoft Exchange Server 2013, 2016, and 2019
[Impact] High-privileged remote attackers can execute arbitrary code and gain full system control over the Exchange Server
[Mitigation] Immediately apply the official Microsoft Cumulative Updates (CU) and Security Updates (SU), and restrict external access