Forwarding TWCERTCC Security Information Advisory TWCERTCC-200-202610-00000021
【CVE-2015-5477】ISC BIND Data Processing Errors Vulnerability (CVSS v3.1: 7.5)
【Exploited by ransomware: Unknown】 ISC BIND has a data processing errors vulnerability; a remote attacker may cause a denial of service by sending TKEY queries.
【CVE-2016-3081】Apache Struts Command Injection Vulnerability (CVSS v3.1: 8.1)
【Exploited by ransomware: Unknown】 Apache Struts has a command injection vulnerability; when Dynamic Method Invocation is enabled, a remote attacker may execute arbitrary code via method:prefix.
【CVE-2023-22894】Strapi Cleartext Storage of Sensitive Information Vulnerability (CVSS v3.1: 7.2)
【Exploited by ransomware: Unknown】 Strapi has a cleartext storage of sensitive information vulnerability; an attacker with access to the admin panel may view sensitive information via query filters. The affected products may have reached end of life (EoL) or end of service (EoS); users are advised to stop using them or migrate to supported versions.
【CVE-2021-3199】ONLYOFFICE Docs Server Path Traversal Vulnerability (CVSS v3.1: 9.8)
【Exploited by ransomware: Unknown】 ONLYOFFICE Docs has a path traversal vulnerability; when JWT is used, an attacker may trigger this vulnerability via /.. sequences in the image upload parameter, leading to remote code execution.
【CVE-2015-3306】ProFTPD Improper Access Control Vulnerability (CVSS v3.1: 10.0)
【Exploited by ransomware: Unknown】 ProFTPD has an improper access control vulnerability; a remote attacker may read and write arbitrary files via the SITE CPFR and SITE CPTO commands.