Gateway
Monthly
Remote code execution or denial of service in NetScaler ADC and NetScaler Gateway (CVSS 9.5) via a memory overflow when configured as a SAML Service Provider or Identity Provider. Affected versions include 14.1-73.37 through 14.1-73.41 and 13.1-64.23 through 13.1-64.28 (and FIPS/NDcPP equivalents) when acting as SAML IdP, as well as all earlier versions when acting as either SP or IdP. No authentication is required (PR:N) and no public exploit has been identified at time of analysis, though the high attack complexity (AC:H) may limit reliable exploitation.
A remote, unauthenticated attacker can cause a denial-of-service condition on NetScaler ADC and NetScaler Gateway appliances running versions prior to the fixed builds (14.1-73.41, 13.1-64.28, 13.1-37.282, and 14.1-73.41 FIPS for ADC; 14.1-73.41 and 13.1-64.28 for Gateway). The vulnerability is network-reachable with low attack complexity and requires no user interaction, making internet-facing Gateway deployments the primary risk surface. No public exploit code or CISA KEV entry was identified at time of analysis, though the CVSS 4.0 base score of 8.7 reflects high severity for the availability-only impact.
Predictable value generation in Citrix NetScaler ADC and Gateway (CWE-342) lets unauthenticated remote attackers predict subsequent values from previously observed ones, primarily compromising integrity and availability rather than confidentiality. The vendor rates this 8.8 (CVSS 4.0 AV:N/AC:L/PR:N/UI:N, VC:L/VI:H/VA:H), while our independent assessment sees a 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H) indicating a high attack complexity because exploitation typically requires harvesting at least one prior value. Affected versions are ADC before 14.1-73.37 and 13.1-64.23 (also 14.1-73.37 FIPS and 13.1.37.279 FIPS/NDcPP) and Gateway before 14.1-73.37 and 13.1-64.23; vendor patches are available and no public exploit identified at time of analysis.
Remote unauthenticated attackers can trigger a memory overflow in Citrix NetScaler ADC and Gateway, leading to unpredictable behavior or denial of service. Affected versions include ADC before 14.1-73.37 and 13.1-64.23 (plus FIPS/NDcPP builds before 14.1-73.37 and 13.1.37.279), and Gateway before 14.1-73.37 and 13.1-64.23. The vendor CVSS 4.0 base score is 8.8 with availability as the dominant impact (VA:H), and no public exploit has been identified at time of analysis.
A memory overflow in Citrix NetScaler ADC and NetScaler Gateway can be triggered by unauthenticated remote attackers (CVSS vector PR:N/UI:N/AV:N), causing unpredictable appliance behavior and denial of service. Affected deployments are ADC before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS/NDcPP, plus Gateway before 14.1-73.37 and before 13.1-64.23. The vendor rates the flaw 8.8, and the dominant impact is availability (VA:H) rather than confidentiality or integrity compromise; no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status.
Memory overflow in Citrix NetScaler ADC and NetScaler Gateway running versions prior to 14.1-73.37 or 13.1-64.23 (and the corresponding FIPS/NDcPP builds) can be triggered over the network by an unauthenticated attacker with no user interaction, producing unpredictable or erroneous appliance behavior or a denial of service. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) is dominated by availability impact, with only incidental confidentiality and integrity exposure, so the demonstrated risk is service disruption rather than confirmed remote code execution. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so the practical exposure driver is network reachability to an unpatched ADC or Gateway instance; fixed builds are available via Citrix bulletin CTX697096.
HTTP request smuggling (CWE-444) in Citrix NetScaler ADC and NetScaler Gateway allows unauthenticated, remote attackers to send crafted requests that NetScaler and the protected back-end server parse differently, desynchronizing the HTTP connection so that follow-on requests are misrouted, poisoned, or injected into other users' traffic; the CVSS 9.3 score reflects high integrity and scope-changed impact on back-end traffic rather than compromise of the appliance itself (VC:N/VA:N, SC:H/SI:H). Affected are ADC builds before 14.1-73.37, before 13.1-64.23 and before 13.1-37.279 (NDcPP) plus their FIPS variants, and Gateway before 14.1-73.37 FIPS and before 13.1-64.23, per vendor advisory CTX697096. No public exploit code was identified at time of analysis, and practical exploitation is bounded by the appliance being internet-reachable and fronting a back end whose HTTP parsing differs from NetScaler's, which is the desynchronization precondition inherent to CWE-444.
Feature policy bypass in Citrix NetScaler ADC and Gateway allows unauthenticated remote attackers to evade certain configured policies when those policies use HTTP URL-based expressions, potentially bypassing policy enforcement controls. Affected are ADC before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS/NDcPP; Gateway before 14.1-73.37 and before 13.1-64.23. No public exploit identified at time of analysis, and the vendor advisory CTX697096 covers this issue alongside related NetScaler CVEs; exploitation requires the specific precondition of a URL-based feature policy, which limits real-world risk.
Citrix NetScaler ADC and NetScaler Gateway deployments running builds prior to 14.1-73.37 or 13.1-64.23 (including the corresponding FIPS and NDcPP builds 14.1-73.37 FIPS and 13.1.37.279 FIPS/NDcPP) can be driven by an unauthenticated remote attacker to achieve remote code execution or cause a denial-of-service condition. Per the available CVSS 4.0 vector the attack is network-reachable with no privileges or user interaction required, but Attack Complexity is High, meaning the attacker must first satisfy a specific, non-default precondition or timing/state condition rather than issuing a single trivial request. The vendor assigns a 9.5 base score with high impact to both the vulnerable appliance and subsequent systems; no confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, and the underlying weakness class was not disclosed (CWE: N/A).
Unauthenticated command execution in Citrix NetScaler ADC (before 14.1-73.37, before 13.1-64.23, and the corresponding FIPS and NDcPP builds) and NetScaler Gateway (before 14.1-73.37 and before 13.1-64.23) lets a network-reachable attacker with no credentials and no user interaction run arbitrary commands on the appliance. Both our assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) and the vendor's CVSS 4.0 score of 9.5 agree on high confidentiality, integrity, and availability impact, with the CVSS 4.0 AT:P flag indicating that a specific attack precondition must hold before the flawed input-validation path is reachable. No public exploit code has been identified at time of analysis, but this is a genuine top-priority vulnerability rather than a high-CVSS/low-real-risk case, because the only other barrier is having a vulnerable, network-exposed ADC or Gateway instance, and exposure is highest where the management or VPN virtual server is internet-facing.
Server-side request forgery in Portkey AI Gateway through version 1.15.2 enables unauthenticated remote attackers to weaponize the gateway as an internal network proxy by injecting arbitrary host values into the x-portkey-custom-host header on the /v1/proxy/* route, which lacks requestValidator middleware. The gateway faithfully forwards outbound requests - including Authorization headers carrying LLM provider API keys - to attacker-specified internal addresses, enabling credential exfiltration and internal service enumeration. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the unauthenticated, low-complexity nature of the attack vector makes this an urgent remediation priority for any internet-exposed gateway deployment.
Remote unauthenticated exploitation of NetScaler ADC and NetScaler Gateway allows attackers to cause high availability impact against the appliance alongside limited confidentiality and integrity compromise, without any privileges or user interaction. Affected builds span versions 13.1 through build 63.21 and 14.1 through build 73.32 for both products. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the combination of network-accessible attack vector with zero authentication barrier on widely deployed perimeter appliances warrants prompt remediation.
An insufficient input validation vulnerability exists in Citrix NetScaler ADC and NetScaler Gateway when configured as a SAML Identity Provider, allowing attackers to trigger a memory overread condition. The vulnerability affects both the NetScaler ADC and NetScaler Gateway products across multiple versions, and successful exploitation could lead to information disclosure by reading adjacent memory contents. While no CVSS score or EPSS data is currently published, the CWE-125 classification (Out-of-bounds Read) combined with the SAML IDP configuration context suggests moderate to high real-world risk for organizations relying on these devices for identity management.
Citrix NetScaler ADC and Gateway instances configured for SSL VPN, ICA Proxy, CVPN, RDP Proxy, or AAA virtual servers are vulnerable to a race condition that enables authenticated attackers to hijack other users' sessions. An attacker with valid credentials can exploit timing-dependent conditions to cause session mixup between concurrent users, potentially gaining unauthorized access to sensitive resources or impersonating other authenticated users. No patch is currently available for this high-severity vulnerability.
Prototype pollution in Apollo Federation before multiple versions.
Credential theft via Lua script execution in Envoy Gateway versions before 1.5.7 and 1.6.2 allows authenticated attackers to extract proxy credentials and subsequently access the control plane and all associated secrets including TLS private keys. Public exploit code exists for this vulnerability. Affected organizations running vulnerable Envoy Gateway instances should immediately upgrade as no patch is currently available for intermediate versions.
Server-side request forgery in Portkey AI Gateway 1.14.0 through 1.15.2 lets unauthenticated remote attackers make the gateway issue requests to loopback and Docker host services and return the responses to the caller. The flaw exists because the isValidCustomHost check trusts localhost-style hostnames whenever the TRUSTED_CUSTOM_HOSTS environment variable is unset, which is the default configuration; an attacker only needs to send a /v1 request carrying a crafted x-portkey-custom-host header (for example via the ollama provider). Publicly available exploit code exists for this issue and it is not listed in CISA KEV, so exploitation activity is not confirmed; the assessed impact is limited to confidentiality and integrity of services reachable from the gateway host, with no availability or code-execution impact.
Portkey.ai Gateway is a blazing fast AI Gateway with integrated guardrails. Prior to 1.14.0, the gateway determined the destination baseURL by prioritizing the value in the x-portkey-custom-host request header. The proxy route then appends the client-specified path to perform an external fetch. This can be maliciously used by users for SSRF attacks. This vulnerability is fixed in 1.14.0.
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity.
Cross site scripting vulnerability in Citrix ADC and Citrix Gateway in allows and attacker to perform cross site scripting. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Arbitrary file read in Citrix ADC and Citrix Gateway. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
User login brute force protection functionality bypass. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Remote desktop takeover via phishing. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthorized access to Gateway user capabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Aviatrix Gateway before 6.6.5712 and 6.7.x before 6.7.1376. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated redirection to a malicious website. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In CmpChannelServer of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new communication channel connections. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In CmpBlkDrvTcp of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new TCP connections. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The CODESYS Gateway Server V2 does not verifiy that the size of a request is within expected limits. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In CODESYS Gateway Server V2 an insufficient check for the activity of TCP client connections allows an unauthenticated attacker to consume all available TCP connections and prevent legitimate users. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared to the real CODESYS Gateway password. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and injecting packets. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An authenticated, remote attacker can gain access to a dereferenced pointer contained in a request. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An authenticated remote attacker can cause a null pointer dereference in the CmpSettings component of the affected CODESYS products which leads to a crash. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An uncontrolled resource consumption vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 that could allow an attacker with access to NSIP or SNIP with management interface. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A unauthenticated denial of service vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 when configured as a VPN (Gateway) or AAA virtual server could allow an attacker to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow an attacker to hijack a session. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN WANOP Edition models 4000-WO, 4100-WO,. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN WANOP Edition models 4000-WO, 4100-WO,. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In CODESYS Gateway V3 before 3.5.17.10, there is a NULL Pointer Dereference. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Input Validation on Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in CipherMail Community Gateway Virtual Appliances and Professional/Enterprise Gateway Virtual Appliances versions 1.0.1 through 4.7.1-0 and CipherMail Webmail Messenger. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
An issue was discovered in CipherMail Community Gateway and Professional/Enterprise Gateway 1.0.1 through 4.7.1-0 and CipherMail Webmail Messenger 1.1.1 through 3.1.1-0. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An Elevation of Privilege issue was discovered in Aviatrix VPN Client before 2.10.7, because of an incomplete fix for CVE-2020-7224. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Aviatrix Controller before 5.4.1204. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpsRamp Gateway before 7.0.0 has a backdoor account vadmin with the password 9vt@f3Vt that allows root SSH access to the server. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
CODESYS Control V3, Gateway V3, and HMI V3 before 3.5.15.30 allow uncontrolled memory allocation which can result in a remote denial of service condition. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in 3S-Smart CODESYS V3 products. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in 3S-Smart CODESYS V3 products. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
During an OData V2/V4 request in SAP Gateway, versions 750, 751, 752, 753, the HTTP Header attributes cache-control and pragma were not properly set, allowing an attacker to access restricted. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The SAP Gateway, versions 7.5, 7.51, 7.52 and 7.53, allows an attacker to inject content which is displayed in the form of an error message. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, F-Secure Anti-Virus 9.0.16160.0, Fortinet Antivirus 4.2.254.0, Ikarus. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Epss exploitation probability 83.9% and no vendor patch available.
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast!. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Epss exploitation probability 79.5% and no vendor patch available.
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast!. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Epss exploitation probability 50.8% and no vendor patch available.
The TAR file parser in AVG Anti-Virus 10.0.0.1190, Quick Heal (aka Cat QuickHeal) 11.00, Comodo Antivirus 7424, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, Fortinet. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Epss exploitation probability 18.2% and no vendor patch available.
The ELF file parser in Dr.Web 5.0.2.03300, eSafe 7.0.17.0, McAfee Gateway (formerly Webwasher) 2010.1C, Rising Antivirus 22.83.00.03, Fortinet Antivirus 4.2.254.0, and Panda Antivirus 10.0.2.7 allows. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
The CAB file parser in Dr.Web 5.0.2.03300, Trend Micro HouseCall 9.120.0.1004, Kaspersky Anti-Virus 7.0.0.125, Sophos Anti-Virus 4.61.0, Trend Micro AntiVirus 9.120.0.1004, McAfee Gateway (formerly. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Epss exploitation probability 78.5% and no vendor patch available.
The ELF file parser in Quick Heal (aka Cat QuickHeal) 11.00, McAfee Anti-Virus Scanning Engine 5.400.0.1158, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Norman Antivirus 6.06.12, eSafe. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal (aka Cat QuickHeal) 11.00, G Data AntiVirus 21, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Command. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Epss exploitation probability 50.2% and no vendor patch available.
The ELF file parser in Quick Heal (aka Cat QuickHeal) 11.00, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, eSafe 7.0.17.0, Kaspersky Anti-Virus. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
The ELF file parser in Bitdefender 7.2, Command Antivirus 5.2.11.5, Comodo Antivirus 7424, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, F-Secure Anti-Virus 9.0.16160.0, McAfee Gateway (formerly. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
The ELF file parser in Bitdefender 7.2, Comodo Antivirus 7424, eSafe 7.0.17.0, F-Secure Anti-Virus 9.0.16160.0, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
The ELF file parser in Bitdefender 7.2, Comodo Antivirus 7424, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, F-Secure Anti-Virus 9.0.16160.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0,. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Emsisoft Anti-Malware 5.1.0.1, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Epss exploitation probability 54.2% and no vendor patch available.
Remote code execution or denial of service in NetScaler ADC and NetScaler Gateway (CVSS 9.5) via a memory overflow when configured as a SAML Service Provider or Identity Provider. Affected versions include 14.1-73.37 through 14.1-73.41 and 13.1-64.23 through 13.1-64.28 (and FIPS/NDcPP equivalents) when acting as SAML IdP, as well as all earlier versions when acting as either SP or IdP. No authentication is required (PR:N) and no public exploit has been identified at time of analysis, though the high attack complexity (AC:H) may limit reliable exploitation.
A remote, unauthenticated attacker can cause a denial-of-service condition on NetScaler ADC and NetScaler Gateway appliances running versions prior to the fixed builds (14.1-73.41, 13.1-64.28, 13.1-37.282, and 14.1-73.41 FIPS for ADC; 14.1-73.41 and 13.1-64.28 for Gateway). The vulnerability is network-reachable with low attack complexity and requires no user interaction, making internet-facing Gateway deployments the primary risk surface. No public exploit code or CISA KEV entry was identified at time of analysis, though the CVSS 4.0 base score of 8.7 reflects high severity for the availability-only impact.
Predictable value generation in Citrix NetScaler ADC and Gateway (CWE-342) lets unauthenticated remote attackers predict subsequent values from previously observed ones, primarily compromising integrity and availability rather than confidentiality. The vendor rates this 8.8 (CVSS 4.0 AV:N/AC:L/PR:N/UI:N, VC:L/VI:H/VA:H), while our independent assessment sees a 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H) indicating a high attack complexity because exploitation typically requires harvesting at least one prior value. Affected versions are ADC before 14.1-73.37 and 13.1-64.23 (also 14.1-73.37 FIPS and 13.1.37.279 FIPS/NDcPP) and Gateway before 14.1-73.37 and 13.1-64.23; vendor patches are available and no public exploit identified at time of analysis.
Remote unauthenticated attackers can trigger a memory overflow in Citrix NetScaler ADC and Gateway, leading to unpredictable behavior or denial of service. Affected versions include ADC before 14.1-73.37 and 13.1-64.23 (plus FIPS/NDcPP builds before 14.1-73.37 and 13.1.37.279), and Gateway before 14.1-73.37 and 13.1-64.23. The vendor CVSS 4.0 base score is 8.8 with availability as the dominant impact (VA:H), and no public exploit has been identified at time of analysis.
A memory overflow in Citrix NetScaler ADC and NetScaler Gateway can be triggered by unauthenticated remote attackers (CVSS vector PR:N/UI:N/AV:N), causing unpredictable appliance behavior and denial of service. Affected deployments are ADC before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS/NDcPP, plus Gateway before 14.1-73.37 and before 13.1-64.23. The vendor rates the flaw 8.8, and the dominant impact is availability (VA:H) rather than confidentiality or integrity compromise; no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status.
Memory overflow in Citrix NetScaler ADC and NetScaler Gateway running versions prior to 14.1-73.37 or 13.1-64.23 (and the corresponding FIPS/NDcPP builds) can be triggered over the network by an unauthenticated attacker with no user interaction, producing unpredictable or erroneous appliance behavior or a denial of service. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) is dominated by availability impact, with only incidental confidentiality and integrity exposure, so the demonstrated risk is service disruption rather than confirmed remote code execution. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so the practical exposure driver is network reachability to an unpatched ADC or Gateway instance; fixed builds are available via Citrix bulletin CTX697096.
HTTP request smuggling (CWE-444) in Citrix NetScaler ADC and NetScaler Gateway allows unauthenticated, remote attackers to send crafted requests that NetScaler and the protected back-end server parse differently, desynchronizing the HTTP connection so that follow-on requests are misrouted, poisoned, or injected into other users' traffic; the CVSS 9.3 score reflects high integrity and scope-changed impact on back-end traffic rather than compromise of the appliance itself (VC:N/VA:N, SC:H/SI:H). Affected are ADC builds before 14.1-73.37, before 13.1-64.23 and before 13.1-37.279 (NDcPP) plus their FIPS variants, and Gateway before 14.1-73.37 FIPS and before 13.1-64.23, per vendor advisory CTX697096. No public exploit code was identified at time of analysis, and practical exploitation is bounded by the appliance being internet-reachable and fronting a back end whose HTTP parsing differs from NetScaler's, which is the desynchronization precondition inherent to CWE-444.
Feature policy bypass in Citrix NetScaler ADC and Gateway allows unauthenticated remote attackers to evade certain configured policies when those policies use HTTP URL-based expressions, potentially bypassing policy enforcement controls. Affected are ADC before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS/NDcPP; Gateway before 14.1-73.37 and before 13.1-64.23. No public exploit identified at time of analysis, and the vendor advisory CTX697096 covers this issue alongside related NetScaler CVEs; exploitation requires the specific precondition of a URL-based feature policy, which limits real-world risk.
Citrix NetScaler ADC and NetScaler Gateway deployments running builds prior to 14.1-73.37 or 13.1-64.23 (including the corresponding FIPS and NDcPP builds 14.1-73.37 FIPS and 13.1.37.279 FIPS/NDcPP) can be driven by an unauthenticated remote attacker to achieve remote code execution or cause a denial-of-service condition. Per the available CVSS 4.0 vector the attack is network-reachable with no privileges or user interaction required, but Attack Complexity is High, meaning the attacker must first satisfy a specific, non-default precondition or timing/state condition rather than issuing a single trivial request. The vendor assigns a 9.5 base score with high impact to both the vulnerable appliance and subsequent systems; no confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, and the underlying weakness class was not disclosed (CWE: N/A).
Unauthenticated command execution in Citrix NetScaler ADC (before 14.1-73.37, before 13.1-64.23, and the corresponding FIPS and NDcPP builds) and NetScaler Gateway (before 14.1-73.37 and before 13.1-64.23) lets a network-reachable attacker with no credentials and no user interaction run arbitrary commands on the appliance. Both our assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) and the vendor's CVSS 4.0 score of 9.5 agree on high confidentiality, integrity, and availability impact, with the CVSS 4.0 AT:P flag indicating that a specific attack precondition must hold before the flawed input-validation path is reachable. No public exploit code has been identified at time of analysis, but this is a genuine top-priority vulnerability rather than a high-CVSS/low-real-risk case, because the only other barrier is having a vulnerable, network-exposed ADC or Gateway instance, and exposure is highest where the management or VPN virtual server is internet-facing.
Server-side request forgery in Portkey AI Gateway through version 1.15.2 enables unauthenticated remote attackers to weaponize the gateway as an internal network proxy by injecting arbitrary host values into the x-portkey-custom-host header on the /v1/proxy/* route, which lacks requestValidator middleware. The gateway faithfully forwards outbound requests - including Authorization headers carrying LLM provider API keys - to attacker-specified internal addresses, enabling credential exfiltration and internal service enumeration. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the unauthenticated, low-complexity nature of the attack vector makes this an urgent remediation priority for any internet-exposed gateway deployment.
Remote unauthenticated exploitation of NetScaler ADC and NetScaler Gateway allows attackers to cause high availability impact against the appliance alongside limited confidentiality and integrity compromise, without any privileges or user interaction. Affected builds span versions 13.1 through build 63.21 and 14.1 through build 73.32 for both products. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the combination of network-accessible attack vector with zero authentication barrier on widely deployed perimeter appliances warrants prompt remediation.
An insufficient input validation vulnerability exists in Citrix NetScaler ADC and NetScaler Gateway when configured as a SAML Identity Provider, allowing attackers to trigger a memory overread condition. The vulnerability affects both the NetScaler ADC and NetScaler Gateway products across multiple versions, and successful exploitation could lead to information disclosure by reading adjacent memory contents. While no CVSS score or EPSS data is currently published, the CWE-125 classification (Out-of-bounds Read) combined with the SAML IDP configuration context suggests moderate to high real-world risk for organizations relying on these devices for identity management.
Citrix NetScaler ADC and Gateway instances configured for SSL VPN, ICA Proxy, CVPN, RDP Proxy, or AAA virtual servers are vulnerable to a race condition that enables authenticated attackers to hijack other users' sessions. An attacker with valid credentials can exploit timing-dependent conditions to cause session mixup between concurrent users, potentially gaining unauthorized access to sensitive resources or impersonating other authenticated users. No patch is currently available for this high-severity vulnerability.
Prototype pollution in Apollo Federation before multiple versions.
Credential theft via Lua script execution in Envoy Gateway versions before 1.5.7 and 1.6.2 allows authenticated attackers to extract proxy credentials and subsequently access the control plane and all associated secrets including TLS private keys. Public exploit code exists for this vulnerability. Affected organizations running vulnerable Envoy Gateway instances should immediately upgrade as no patch is currently available for intermediate versions.
Server-side request forgery in Portkey AI Gateway 1.14.0 through 1.15.2 lets unauthenticated remote attackers make the gateway issue requests to loopback and Docker host services and return the responses to the caller. The flaw exists because the isValidCustomHost check trusts localhost-style hostnames whenever the TRUSTED_CUSTOM_HOSTS environment variable is unset, which is the default configuration; an attacker only needs to send a /v1 request carrying a crafted x-portkey-custom-host header (for example via the ollama provider). Publicly available exploit code exists for this issue and it is not listed in CISA KEV, so exploitation activity is not confirmed; the assessed impact is limited to confidentiality and integrity of services reachable from the gateway host, with no availability or code-execution impact.
Portkey.ai Gateway is a blazing fast AI Gateway with integrated guardrails. Prior to 1.14.0, the gateway determined the destination baseURL by prioritizing the value in the x-portkey-custom-host request header. The proxy route then appends the client-specified path to perform an external fetch. This can be maliciously used by users for SSRF attacks. This vulnerability is fixed in 1.14.0.
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity.
Cross site scripting vulnerability in Citrix ADC and Citrix Gateway in allows and attacker to perform cross site scripting. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Arbitrary file read in Citrix ADC and Citrix Gateway. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
User login brute force protection functionality bypass. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Remote desktop takeover via phishing. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthorized access to Gateway user capabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Aviatrix Gateway before 6.6.5712 and 6.7.x before 6.7.1376. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated redirection to a malicious website. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In CmpChannelServer of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new communication channel connections. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In CmpBlkDrvTcp of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new TCP connections. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The CODESYS Gateway Server V2 does not verifiy that the size of a request is within expected limits. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In CODESYS Gateway Server V2 an insufficient check for the activity of TCP client connections allows an unauthenticated attacker to consume all available TCP connections and prevent legitimate users. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared to the real CODESYS Gateway password. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and injecting packets. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An authenticated, remote attacker can gain access to a dereferenced pointer contained in a request. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An authenticated remote attacker can cause a null pointer dereference in the CmpSettings component of the affected CODESYS products which leads to a crash. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An uncontrolled resource consumption vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 that could allow an attacker with access to NSIP or SNIP with management interface. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A unauthenticated denial of service vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 when configured as a VPN (Gateway) or AAA virtual server could allow an attacker to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow an attacker to hijack a session. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN WANOP Edition models 4000-WO, 4100-WO,. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN WANOP Edition models 4000-WO, 4100-WO,. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In CODESYS Gateway V3 before 3.5.17.10, there is a NULL Pointer Dereference. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Input Validation on Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in CipherMail Community Gateway Virtual Appliances and Professional/Enterprise Gateway Virtual Appliances versions 1.0.1 through 4.7.1-0 and CipherMail Webmail Messenger. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
An issue was discovered in CipherMail Community Gateway and Professional/Enterprise Gateway 1.0.1 through 4.7.1-0 and CipherMail Webmail Messenger 1.1.1 through 3.1.1-0. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An Elevation of Privilege issue was discovered in Aviatrix VPN Client before 2.10.7, because of an incomplete fix for CVE-2020-7224. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Aviatrix Controller before 5.4.1204. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpsRamp Gateway before 7.0.0 has a backdoor account vadmin with the password 9vt@f3Vt that allows root SSH access to the server. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
CODESYS Control V3, Gateway V3, and HMI V3 before 3.5.15.30 allow uncontrolled memory allocation which can result in a remote denial of service condition. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in 3S-Smart CODESYS V3 products. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in 3S-Smart CODESYS V3 products. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
During an OData V2/V4 request in SAP Gateway, versions 750, 751, 752, 753, the HTTP Header attributes cache-control and pragma were not properly set, allowing an attacker to access restricted. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The SAP Gateway, versions 7.5, 7.51, 7.52 and 7.53, allows an attacker to inject content which is displayed in the form of an error message. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, F-Secure Anti-Virus 9.0.16160.0, Fortinet Antivirus 4.2.254.0, Ikarus. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Epss exploitation probability 83.9% and no vendor patch available.
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast!. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Epss exploitation probability 79.5% and no vendor patch available.
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast!. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Epss exploitation probability 50.8% and no vendor patch available.
The TAR file parser in AVG Anti-Virus 10.0.0.1190, Quick Heal (aka Cat QuickHeal) 11.00, Comodo Antivirus 7424, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, Fortinet. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Epss exploitation probability 18.2% and no vendor patch available.
The ELF file parser in Dr.Web 5.0.2.03300, eSafe 7.0.17.0, McAfee Gateway (formerly Webwasher) 2010.1C, Rising Antivirus 22.83.00.03, Fortinet Antivirus 4.2.254.0, and Panda Antivirus 10.0.2.7 allows. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
The CAB file parser in Dr.Web 5.0.2.03300, Trend Micro HouseCall 9.120.0.1004, Kaspersky Anti-Virus 7.0.0.125, Sophos Anti-Virus 4.61.0, Trend Micro AntiVirus 9.120.0.1004, McAfee Gateway (formerly. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Epss exploitation probability 78.5% and no vendor patch available.
The ELF file parser in Quick Heal (aka Cat QuickHeal) 11.00, McAfee Anti-Virus Scanning Engine 5.400.0.1158, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Norman Antivirus 6.06.12, eSafe. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal (aka Cat QuickHeal) 11.00, G Data AntiVirus 21, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Command. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Epss exploitation probability 50.2% and no vendor patch available.
The ELF file parser in Quick Heal (aka Cat QuickHeal) 11.00, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, eSafe 7.0.17.0, Kaspersky Anti-Virus. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
The ELF file parser in Bitdefender 7.2, Command Antivirus 5.2.11.5, Comodo Antivirus 7424, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, F-Secure Anti-Virus 9.0.16160.0, McAfee Gateway (formerly. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
The ELF file parser in Bitdefender 7.2, Comodo Antivirus 7424, eSafe 7.0.17.0, F-Secure Anti-Virus 9.0.16160.0, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
The ELF file parser in Bitdefender 7.2, Comodo Antivirus 7424, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, F-Secure Anti-Virus 9.0.16160.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0,. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Emsisoft Anti-Malware 5.1.0.1, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Epss exploitation probability 54.2% and no vendor patch available.