Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could allow for code execution. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Adobe Acrobat and Reader contains a use-after-free vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Acrobat Acrobat and Reader contain a heap-based buffer overflow vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Accellion FTA contains a server-side request forgery (SSRF) vulnerability exploited via a crafted POST request to wmProgressstat.html. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Accellion FTA contains a SQL injection vulnerability exploited via a crafted host header in a request to document_root.html. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Accellion FTA contains an OS command injection vulnerability exploited via a local web service call. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Accellion FTA contains an OS command injection vulnerability exploited via a crafted POST request to various admin endpoints. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
A security feature bypass vulnerability in Microsoft Excel would allow a local user to perform arbitrary code execution. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
An authenticated attacker could leverage improper validation in cmdlet arguments within Microsoft Exchange and perform remote code execution. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: kev:CVE-2021-44077
ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution. CISA required action: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
