/ feedMultiple D-Link routers contain a command injection vulnerability which can allow attackers to achieve full system compromise. CISA required action: The impacted product is end-of-life and should be disconnected if st…
Oracle BI Publisher, formerly XML Publisher, contains an unspecified vulnerability that allows for various unauthorized actions. Open-source reporting attributes this vulnerability to allowing for authentication bypas…
In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases. CISA required action: Apply updates per vendor instructions.
A path traversal vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unaut…
Apache Kylin contains an OS command injection vulnerability which could permit an attacker to perform remote code execution. CISA required action: Apply updates per vendor instructions.
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM. CISA required action: Apply updates per vendor instructions.
Palo Alto Networks PAN-OS contains a vulnerability in SAML which allows an attacker to bypass authentication. CISA required action: Apply updates per vendor instructions.
QNAP Helpdesk contains an improper access control vulnerability which could allow an attacker to gain privileges or to read sensitive information. CISA required action: Apply updates per vendor instructions.
Spring, by VMware Tanzu, Cloud Config contains a path traversal vulnerability that allows applications to serve arbitrary configuration files. CISA required action: Apply updates per vendor instructions.
Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code. CISA required action: A…
smtp_mailaddr in smtp_session.c in OpenSMTPD, as used in OpenBSD and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session. CISA required action: Apply updates per ve…
Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution. CISA required action: Apply updates per vendor instructions.
D-Link DIR-610 devices allow remote code execution via the cmd parameter to command.php. CISA required action: The impacted product is end-of-life and should be disconnected if still in use.
Improper Access Control in Citrix ShareFile storage zones controller may allow an unauthenticated attacker to remotely compromise the storage zones controller. CISA required action: Apply updates per vendor instructions.
Microsoft Windows Print Spooler contains an unspecified vulnerability which can allow for privilege escalation. CISA required action: Apply updates per vendor instructions.
A vulnerability has been identified in MiCollab and MiVoice Business Express that may allow a malicious actor to gain unauthorized access to sensitive information and services, cause performance degradations or a deni…
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code. CISA required action: Apply updates per vendor instructions.
Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows allows local users to gain privileges, and bypass the User Account Control (UAC) feature. CISA required action: App…
Adobe Flash Player contains a memory corruption vulnerability that allows for remote code execution or denial-of-service (DoS). CISA required action: The impacted product is end-of-life and should be disconnected if s…
afd.sys in the Ancillary Function Driver in Microsoft Windows does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application. CISA required acti…