Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote code execution. This vulnerability can only be exploited when the Java Security Manager is not properly configured. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Kernel/ptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Sonatype Nexus Repository Manager before 3.15.0 has an incorrect access control vulnerability. Exploitation allows for remote code execution. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Primetek Primefaces is vulnerable to a weak encryption flaw resulting in remote code execution CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: kev:CVE-2015-7450
WebSphere Application Server and Server Hypervisor Edition
A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
