Threats tagged 'cisa-kev'

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.

The TP-Link TL-WA855RE device has a vulnerability where critical functions lack authentication. An unauthenticated attacker on the same network can send a TDDP_RESET POST request to trigger a factory reset and reboot the device. This allows the attacker to bypass access controls by setting a new administrative password. The affected product may be end-of-life or end-of-service, and users are advised to discontinue its use.

The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9. This issue affects Archer C7(EU) V2: before 241108 and TL-WR841N/ND(MS) V9: before 241108. Both products have reached the status of EOL (end-of-life). It's recommending to purchase the new product to ensure better performance and security. If replacement is not an option in the short term, please use the second reference link to download and install the patch(es).

Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.

FreePBX endpoint versions prior to 15.0.66, 16.0.89, and 17.0.3 contain a critical SQL injection vulnerability. This flaw allows unauthenticated attackers to manipulate the FreePBX Administrator database arbitrarily and potentially execute remote code. The vulnerability arises from insufficient sanitization of user-supplied data. The issue has been patched in the specified versions.

Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with IPv6 services or servicegroups bound with IPv6 servers (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with DBS IPv6 services or servicegroups bound with IPv6 DBS servers (OR) CR virtual server with type HDX

CVE-2024-8069 is a vulnerability in Citrix Session Recording involving deserialization of untrusted data. It allows limited remote code execution with the privileges of the NetworkService account. Exploitation requires the attacker to be an authenticated user on the same intranet as the session recording server. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12, iOS 18.6.2 and iPadOS 18.6.2, iPadOS 17.7.10, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, macOS Ventura 13.7.8. Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.

Red Hat OpenShift Container Platform 4.19.9 addresses two important security vulnerabilities in Git that allow arbitrary code execution and arbitrary file writes. These issues are fixed in the 4.19.9 release, and users running versions from 4.19.0 up to but not including 4.19.9 are advised to upgrade. The update is rated as having an Important security impact by Red Hat Product Security.

Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.

Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.

Microsoft Office Excel contains a remote code execution vulnerability identified as CVE-2007-0671. This vulnerability can be exploited by opening a specially crafted Excel file, which may be delivered via email attachment or hosted on a malicious website. Successful exploitation allows an attacker to execute arbitrary code on the affected system. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the input data.

Microsoft Internet Explorer has a memory corruption vulnerability (CVE-2013-3893) that enables remote code execution. The affected versions may be end-of-life or end-of-service, and users are advised to discontinue use. This vulnerability has been exploited in the wild.

CVE-2025-8088 is a path traversal vulnerability in the Windows version of WinRAR that allows attackers to execute arbitrary code via crafted malicious archive files. It has been exploited in the wild and is associated with known ransomware campaigns. The vulnerability was discovered by researchers from ESET and carries a high severity rating with a CVSS 4.0 score of 8.4.

Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.

CVE-2025-54948 is a critical OS command injection vulnerability in the on-premise management console of Trend Micro Apex One version 2019 (14.0). It allows a remote attacker to upload malicious code and execute commands without authentication. The vulnerability has a high CVSS score of 9.4, indicating severe potential impact on confidentiality, integrity, and availability. No official patch or remediation information is currently provided by the vendor. There are no known exploits in the wild at this time.

D-Link DCS-2530L and DCS-2670L devices have an unspecified vulnerability that can lead to remote disclosure of the administrator password. These devices may be end-of-life or end-of-service, and users are advised to discontinue their use. The vulnerability has been exploited in the wild.

D-Link DCS-2530L and DCS-2670L devices have a command injection vulnerability in the cgi-bin/ddns_enc.cgi component. This vulnerability allows attackers to execute arbitrary commands on affected devices. The impacted products may be end-of-life or end-of-service, and users are advised to discontinue use. Exploitation of this vulnerability has been observed in the wild.

CVE-2022-40799 is a high-severity vulnerability in the D-Link DNR-322L device that allows an authenticated attacker to execute operating system level commands by exploiting a code download process lacking integrity checks. The affected product may be end-of-life or end-of-service, and users are advised to discontinue its use. Exploits have been observed in the wild.