CVE Vulnerability Advisory Database

[Affected Scope] Ivanti Connect Secure (ICS) versions prior to 25.1.3.0 (excluding 22.7R2.14 and earlier)

[Impact] Remote unauthenticated attackers can bypass authentication via identity spoofing and execute arbitrary commands with system privileges

[Mitigation] Immediately upgrade to version 25.1.3.0 or later and perform a comprehensive compromise assessment using official IoCs

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 9.0, 10.0, and 10.1 utilizing the Classic Web Client

[Impact] Viewing an email containing a malicious ICS calendar file triggers arbitrary JavaScript execution within the victim's session, enabling unauthorized email redirection and data exfiltration

[Mitigation] Apply official Zimbra security patches (9.0.0 Patch 44, 10.0.13, 10.1.5 or later) immediately, and restrict the use of the Classic Web Client until patched

[Affected Scope] Unitronics Vision and Samba PLCs and HMIs configured using VisiLogic versions prior to 9.9.00

[Impact] Unauthenticated remote attackers with network access can exploit default administrative credentials to gain full control of the target system

[Mitigation] Upgrade VisiLogic to version 9.9.00 or later, change default passwords immediately, and restrict external network exposure

[Affected Scope] OpenPLC ScadaBR through version 0.9.1 on Linux and through version 1.12.4 on Windows

[Impact] Remote authenticated attackers can upload and execute malicious JSP files, leading to complete system compromise and arbitrary code execution

[Mitigation] Apply the latest security patches, restrict external access to the ScadaBR interface, and block unauthorized JSP uploads via WAF rules