Primary Categories: [[CL0P]] Links: [[CL0P Articles]] / [[CL0P Ransom Note]] / [[CL0P Tools]] / [[CL0P TTP's]] # [[CL0P CVE's]] # 2025 ## CVE‑2025‑61882 - Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. - CVSS - 9.8 - https://nvd.nist.gov/vuln/detail/CVE-2025-61882 # 2024 ## CVE-2024-0204 - Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal. - CVSS - 9.8 - https://nvd.nist.gov/vuln/detail/cve-2024-0204 ## CVE-2024-21412 - An attacker could exploit this vulnerability by convincing a target to open a malicious file. Successful exploitation would bypass SmartScreen security features. - CVSS - 8.1 - https://nvd.nist.gov/vuln/detail/cve-2024-21412 ## CVE-2024-21762 - A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to execute unauthorized code or commands via specifically crafted requests - CVSS - 9.8 - https://nvd.nist.gov/vuln/detail/cve-2024-21762 ## CVE-2024-55956 - In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory. - CVSS - 9.8 - https://nvd.nist.gov/vuln/detail/CVE-2024-55956 # 2023 ## CVE-2023-0669 - Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2. - CVSS - 7.2 - https://nvd.nist.gov/vuln/detail/CVE-2023-0669 ## CVE-2023-3284 - Download key for a file in a vault was passed in an insecure way that could easily be logged in M-Files New Web in M-Files before 22.11.12011.0. This issue affects M-Files New Web: before 22.11.12011.0. - CVSS - 7.5 - https://nvd.nist.gov/vuln/detail/CVE-2022-3284 ## CVE-2023-4966 - Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA  virtual server. - CVSS - 7.5 - https://nvd.nist.gov/vuln/detail/cve-2023-4966 ## CVE-2023-20269 - A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user. - CVSS - 9.1 - https://nvd.nist.gov/vuln/detail/cve-2023-20269 ## CVE-2023-22527 - A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. - CVSS - 9.8 - https://nvd.nist.gov/vuln/detail/cve-2023-22527 ## CVE-2023-27350 - This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. - CVSS - 9.8 - https://nvd.nist.gov/vuln/detail/CVE-2023-27350 ## CVE-2023-27351 - This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. - CVSS - 7.5 - https://nvd.nist.gov/vuln/detail/CVE-2023-27351 ## CVE-2023-34362 - In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. - CVSS - 9.8 - https://nvd.nist.gov/vuln/detail/CVE-2023-34362 ## CVE-2023-36025 - Microsoft Windows Defender SmartScreen and stems from the lack of checks and associated prompts on Internet Shortcut (.url) files. Threat actors can leverage this vulnerability by crafting .url files that download and execute malicious scripts that bypass the Windows Defender SmartScreen warning and checks. - CVSS - 8.8 - https://nvd.nist.gov/vuln/detail/cve-2023-36025 ## CVE-2023-49103 - An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). - CVSS - 7.5 - https://nvd.nist.gov/vuln/detail/cve-2023-49103 # 2022 ## CVE-2022-47966 - Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. - CVSS - 9.8 - https://nvd.nist.gov/vuln/detail/cve-2022-47966 # 2021 ## CVE-2021-27101 - Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later. - CVSS - 9.8 - https://nvd.nist.gov/vuln/detail/CVE-2021-27101 ## CVE-2021-27102 - Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later. - CVSS - 7.8 - https://nvd.nist.gov/vuln/detail/CVE-2021-27102 ## CVE-2021-27103 - Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later. - CVSS - 9.8 - https://nvd.nist.gov/vuln/detail/CVE-2021-27103 ## CVE-2021-27104 - Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later. - CVSS - 9.8 - https://nvd.nist.gov/vuln/detail/CVE-2021-27104 ## CVE-2021-34527 - A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. - CVSS - 8.8 - https://nvd.nist.gov/vuln/detail/CVE-2021-34527 ## CVE-2021-35211 - Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability. - CVSS - 10 - https://nvd.nist.gov/vuln/detail/CVE-2021-35211 # 2019 ## CVE-2019-19781 - An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal. - CVSS - 9.8 - https://nvd.nist.gov/vuln/detail/CVE-2019-19781 # 2018 ## CVE-2018-8453 - An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. - CVSS - 7.8 - https://nvd.nist.gov/vuln/detail/cve-2018-8453