Source: Ministry of education information & communication security contingency platform
| Publication Number | TACERT-ANA-2026101511101212 | Publication Time | 2026-10-15 11:04:13 |
| Incident Type | ANA-Vulnerability Alert | Discovery Time | 2026-10-15 11:04:13 |
| Impact Level | Low | ||
| [Subject] 【Vulnerability Alert】CISA Adds 5 Known Exploited Vulnerabilities to the KEV Catalog (2026/10/05-2026/10/11) |
|||
| [Content] Forwarded from TWCERTCC-200-202610-00000021 【CVE-2015-5477】ISC BIND Data Processing Errors Vulnerability (CVSS v3.1: 7.5) 【Whether Exploited by Ransomware: Unknown】ISC BIND has a data processing errors vulnerability. A remote attacker may cause a Denial-of-Service (DoS) attack by sending a TKEY query. 【CVE-2016-3081】Apache Struts Command Injection Vulnerability (CVSS v3.1: 8.1) 【Whether Exploited by Ransomware: Unknown】Apache Struts has a command injection vulnerability. When the Dynamic Method Invocation feature is enabled, a remote attacker may execute arbitrary code through the method:prefix. 【CVE-2023-22894】Strapi Cleartext Storage of Sensitive Information Vulnerability (CVSS v3.1: 7.2) 【Whether Exploited by Ransomware: Unknown】Strapi has a cleartext storage of sensitive information vulnerability. An attacker with access permissions to the administration panel may view sensitive information through query filters. The affected product may have reached End-of-Life (EoL) or End-of-Service (EoS). Users are advised to discontinue its use or migrate to a supported version. 【CVE-2021-3199】ONLYOFFICE Docs Server Path Traversal Vulnerability (CVSS v3.1: 9.8) 【Whether Exploited by Ransomware: Unknown】ONLYOFFICE Docs has a path traversal vulnerability. When JWT is used, an attacker may trigger this vulnerability through the /.. sequence in the image upload parameter, potentially leading to Remote Code Execution (RCE). 【CVE-2015-3306】ProFTPD Improper Access Control Vulnerability (CVSS v3.1: 10.0) 【Whether Exploited by Ransomware: Unknown】ProFTPD has an improper access control vulnerability. A remote attacker may read and write arbitrary files through the SITE CPFR and SITE CPTO commands. Information Sharing Level: WHITE (Information content can be publicly disclosed) |
|||
| [Affected Platform] 【CVE-2015-5477】Please refer to the affected versions listed by the official vendor: https://kb.isc.org/docs/aa-01272 【CVE-2016-3081】Please refer to the affected versions listed by the official vendor: https://cwiki.apache.org/confluence/spaces/WW/pages/62693266/S2-032 【CVE-2023-22894】Please refer to the affected versions listed by the official vendor: https://github.com/advisories/GHSA-jjqf-j4w7-92w8 【CVE-2021-3199】ONLYOFFICE Document Server versions earlier than 5.6.3 【CVE-2015-3306】Please refer to the listed affected versions: https://lists.debian.org/debian-security-announce/2015/msg00154.html |
|||
| [Recommended Actions] 【CVE-2015-5477】The official vendor has released a security update to fix this vulnerability. Please update to the relevant version: https://kb.isc.org/docs/aa-01272 【CVE-2016-3081】The official vendor has released a security update to fix this vulnerability. Please update to the relevant version: https://cwiki.apache.org/confluence/spaces/WW/pages/62693266/S2-032 【CVE-2023-22894】The official vendor has released a security update to fix this vulnerability. Please update to the relevant version: https://github.com/advisories/GHSA-jjqf-j4w7-92w8 【CVE-2021-3199】Please upgrade the corresponding product to the following version (or later): ONLYOFFICE Document Server 5.6.3 【CVE-2015-3306】The official vendor has released a security update to fix this vulnerability. Please update to the relevant version: https://lists.debian.org/debian-security-announce/2015/msg00154.html |
|||
| [Reference] | |||