CISA Known Exploited Vulnerabilities

The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.

CVE-2019-0344 is a high-severity vulnerability in SAP Commerce Cloud (formerly Hybris) involving deserialization of untrusted data in the mediaconversion and virtualjdbc extensions. This flaw allows attackers to perform code injection. Exploits have been observed in the wild. No specific affected versions or patch information is provided in the available data.

Multiple DrayTek Vigor routers (Vigor3900, Vigor2960, and Vigor300B) have an OS command injection vulnerability in the cgi-bin/mainfunction.cgi/cvmcfgupload endpoint. This flaw allows remote attackers to execute arbitrary commands by injecting shell metacharacters in a filename when the content type text/x-python-script is used. The vulnerability is known to be exploited in the wild.

OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.

Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.

Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.

CVE-2020-0618 is a deserialization vulnerability in Microsoft SQL Server Reporting Services that allows an authenticated attacker to execute code with the privileges of the Report Server service account. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns. It affects SQL Server Reporting Services and requires authentication to exploit.

CVE-2022-21445 is a high-severity vulnerability in the Oracle ADF Faces library included with Oracle JDeveloper Distribution. It involves deserialization of untrusted data, which can lead to unauthenticated remote code execution. The vulnerability has been exploited in the wild. Oracle has released patches for this and other vulnerabilities in its April 2022 Critical Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk.

CVE-2020-14644 is a deserialization vulnerability in Oracle WebLogic Server that allows unauthenticated remote attackers with network access via T3 or IIOP protocols to execute arbitrary code. This vulnerability has been exploited in the wild. Oracle has released patches as part of its July 2020 Critical Patch Update and strongly recommends applying these patches promptly to mitigate the risk.

RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.

CVE-2014-0502 is a double free vulnerability in Adobe Flash Player that enables remote attackers to execute arbitrary code. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided in the available data.

Adobe Flash Player has a vulnerability in its ExternalInterface ActionScript functionality that allows remote attackers to execute arbitrary code by delivering crafted SWF content. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2013-0643 is a vulnerability in Adobe Flash Player involving incorrect default permissions in the Firefox sandbox. This flaw allows remote attackers to execute arbitrary code by delivering specially crafted SWF content. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2014-0497 is an integer underflow vulnerability in Adobe Flash Player that enables remote attackers to execute arbitrary code. This vulnerability has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided in the available data.

Windows MSHTML Platform Spoofing Vulnerability

In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.

An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.

Microsoft Publisher Security Feature Bypass Vulnerability

Windows Mark of the Web Security Feature Bypass Vulnerability