CVE Vulnerability Advisory Database

[Affected Scope] All DedeCMS installations prior to version 5.7

[Impact] Remote unauthenticated attackers can disclose sensitive local files or system configurations via path traversal sequences

[Mitigation] Upgrade to DedeCMS 5.7 or later, or manually patch the uninitialized variable in the affected PHP script

[Affected Scope] All WordPress installations running vulnerable core versions and specific themes.

[Impact] Unauthenticated attackers can include and execute arbitrary local PHP files, leading to full server compromise.

[Mitigation] Immediate update to the latest WordPress security release and deployment of WAF filtering rules.

[Affected Scope] Zimbra Collaboration (ZCS) versions 10.0 and 10.1 utilizing the Webmail Classic UI

[Impact] Unauthenticated remote attackers can exploit the /h/rest endpoint to include and execute arbitrary files from the WebRoot directory, potentially leading to sensitive information disclosure and Remote Code Execution (RCE)

[Mitigation] Immediately apply the official security patches from Zimbra, or restrict external access to the vulnerable /h/rest endpoint as a temporary workaround

[Affected Scope] Gladinet CentreStack and Triofox solutions prior to version 16.12.10420.56791

[Impact] Unauthenticated remote attackers can exploit hardcoded AES keys to read arbitrary local files and potentially achieve full system compromise

[Mitigation] Immediately upgrade to version 16.12.10420.56791 or later and restrict access to publicly exposed endpoints

[Affected Scope] All versions of Gladinet CentreStack and Triofox prior to and including 16.7.10368.56560

[Impact] Unauthenticated remote attackers can exploit this flaw to read sensitive system and configuration files, leading to critical information disclosure

[Mitigation] Immediately upgrade to the patched version (16.7.10368.56561 or higher) and restrict external access to the management console

[Affected Scope] Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier

[Impact] A remote unauthenticated attacker can read arbitrary system files and sensitive account credentials by sending specially crafted XML requests

[Mitigation] Immediately upgrade to the latest patched versions provided by the vendor and disable external entity resolution in XML parsers

[Affected Scope] Metabase versions prior to 0.40.5 and 1.40.5 (including all 0.40.x and 1.40.x releases below these versions)

[Impact] Unauthenticated remote attackers can exploit directory traversal to read arbitrary system files and environment variables from the server

[Mitigation] Immediately upgrade to patched Metabase versions (0.40.5, 1.40.5 or later) or block the vulnerable API path using a reverse proxy or WAF

[Affected Scope] DrayTek VigorConnect version 1.6.0-B3 and prior

[Impact] Unauthenticated remote attackers can download arbitrary system files with root privileges via directory traversal

[Mitigation] Immediately upgrade VigorConnect to the latest patched version (1.6.0-RC1 or higher) and restrict access to the management interface

[Affected Scope] DrayTek VigorConnect version 1.6.0-B3 and prior

[Impact] Unauthenticated remote attackers can download arbitrary system files with root privileges, leading to full exposure of sensitive host operating system data

[Mitigation] Immediately upgrade VigorConnect to the latest secure version and restrict access to the management interface from the public internet

[Affected Scope] Paessler PRTG Network Monitor versions prior to 18.2.40.1683

[Impact] Unauthenticated remote attackers can exploit a Local File Inclusion (LFI) vulnerability to create unauthorized accounts with administrative privileges, leading to full system compromise

[Mitigation] Immediately upgrade PRTG Network Monitor to version 18.2.40.1683 or later and restrict external access to the web console