Threat database

The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.

CVE-2019-0344 is a high-severity vulnerability in SAP Commerce Cloud (formerly Hybris) involving deserialization of untrusted data in the mediaconversion and virtualjdbc extensions. This flaw allows attackers to perform code injection. Exploits have been observed in the wild. No specific affected versions or patch information is provided in the available data.

Multiple DrayTek Vigor routers (Vigor3900, Vigor2960, and Vigor300B) have an OS command injection vulnerability in the cgi-bin/mainfunction.cgi/cvmcfgupload endpoint. This flaw allows remote attackers to execute arbitrary commands by injecting shell metacharacters in a filename when the content type text/x-python-script is used. The vulnerability is known to be exploited in the wild.

Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.

CVE-2020-14644 is a deserialization vulnerability in Oracle WebLogic Server that allows unauthenticated remote attackers with network access via T3 or IIOP protocols to execute arbitrary code. This vulnerability has been exploited in the wild. Oracle has released patches as part of its July 2020 Critical Patch Update and strongly recommends applying these patches promptly to mitigate the risk.

CVE-2022-21445 is a high-severity vulnerability in the Oracle ADF Faces library included with Oracle JDeveloper Distribution. It involves deserialization of untrusted data, which can lead to unauthenticated remote code execution. The vulnerability has been exploited in the wild. Oracle has released patches for this and other vulnerabilities in its April 2022 Critical Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk.

CVE-2020-0618 is a deserialization vulnerability in Microsoft SQL Server Reporting Services that allows an authenticated attacker to execute code with the privileges of the Report Server service account. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns. It affects SQL Server Reporting Services and requires authentication to exploit.

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.

The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.

The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.

CVE-2014-0502 is a double free vulnerability in Adobe Flash Player that enables remote attackers to execute arbitrary code. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided in the available data.

Adobe Flash Player has a vulnerability in its ExternalInterface ActionScript functionality that allows remote attackers to execute arbitrary code by delivering crafted SWF content. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2013-0643 is a vulnerability in Adobe Flash Player involving incorrect default permissions in the Firefox sandbox. This flaw allows remote attackers to execute arbitrary code by delivering specially crafted SWF content. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2014-0497 is an integer underflow vulnerability in Adobe Flash Player that enables remote attackers to execute arbitrary code. This vulnerability has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided in the available data.

An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.

Windows MSHTML Platform Spoofing Vulnerability

Microsoft Publisher Security Feature Bypass Vulnerability

Windows Mark of the Web Security Feature Bypass Vulnerability

Windows Installer Elevation of Privilege Vulnerability