CVE Vulnerability Catalog

The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.

In dotCMS 3.0 through 22.02, the ContentResource API has a vulnerability that allows an attacker to bypass filename sanitization in a multipart request. This enables directory traversal, saving files outside the intended location. If anonymous content creation is enabled, an unauthenticated attacker can upload an executable file such as .jsp, leading to remote code execution.

An elevation of privilege vulnerability in Windows Client Server Run-time Subsystem (CSRSS). Details are not provided in the description.

Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress. This affects Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music.

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that allows an unauthenticated attacker to execute arbitrary code on the instance. Affected versions range from 1.3.0 before 7.4.17, 7.13.0 before 7.13.7, 7.14.0 before 7.14.3, 7.15.0 before 7.15.2, 7.16.0 before 7.16.4, 7.17.0 before 7.17.4, and 7.18.0 before 7.18.1.

A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights.

An out-of-bounds write issue in Apple systems was addressed with improved bounds checking. This affects tvOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.3.1, iOS 15.4.1, and iPadOS 15.4.1. An application may execute arbitrary code with kernel privileges.

An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macOS Monterey 12.3.1, Security Update 2022-004 Catalina, macOS Big Sur 11.6.6. A local user may be able to read kernel memory.

A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379 by default upon activation. An attacker could exploit this vulnerability by connecting to the Redis instance on the open port. A successful exploit could allow the attacker to write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database. Given the configuration of the sandboxed container that the Redis instance runs in, a remote attacker would be unable to execute remote code or abuse the integrity of the Cisco IOS XR Software host system.

SolarView Compact version 6.00 was found to contain a command injection vulnerability via conf_mail.php. An attacker can exploit this to execute arbitrary system commands on the device.

A OS command injection vulnerability exists in the CGI program of Zyxel USG FLEX, ATP, and VPN series firmware. It allows an attacker to modify specific files and execute OS commands on the vulnerable device. Affected versions include USG FLEX 100(W) 5.00-5.21 Patch 1, USG FLEX 200, 500, 700, USG FLEX 50(W), USG20(W)-VPN, ATP, and VPN series.

A spoofing vulnerability in the Windows LSA service. An attacker can force a domain controller to authenticate to a malicious server.

A privilege elevation vulnerability in Active Directory Domain Services (AD DS). An attacker can gain domain administrator privileges.

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.

In F5 BIG-IP versions 16.1.x prior to 16.1.2.2, 15.1.x prior to 15.1.5.1, 14.1.x prior to 14.1.4.6, 13.1.x prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. This allows an attacker to access the management interface without authentication.

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The documentation has always recommended proper security measures, including a firewall.

The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution due to incorrect data validation. Affected appliances are SA 100, SA 400, and Virtual SA.

A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.