#remote-code-execution

[ follow ]
#cybersecurity

Thousands of PAN-OS devices compromised by critical exploits

Palo Alto Networks firewalls were compromised due to two security bugs, allowing attackers to deploy backdoors and malware.

NachoVPN Tool Exploits Flaws in Popular VPN Clients for System Compromise

Flaws in Palo Alto Networks and SonicWall VPNs could allow remote code execution on Windows and macOS, exposing users to significant security risks.

700K+ DrayTek routers are sitting ducks on the internet

A critical vulnerability in DrayTek routers could allow remote-code execution, risking sensitive data and system integrity.

Over 300K Prometheus Instances Exposed: Credentials and API Keys Leaking Online

Thousands of Prometheus servers lack proper authentication, risking data leakage, DoS, and remote code execution attacks due to their exposure on the internet.

Zero Day Initiative - CVE-2024-38213: Copy2Pwn Exploit Evades Windows Web Protections

CVE-2024-38213 allows bypassing Windows mark-of-the-web protections leading to remote code execution via WebDAV shares.

Microsoft offers updates on 117 vulnerabilities on Patch Tuesday

Microsoft released updates addressing 117 vulnerabilities, including two actively exploited threats that pose significant risks to users.

Thousands of PAN-OS devices compromised by critical exploits

Palo Alto Networks firewalls were compromised due to two security bugs, allowing attackers to deploy backdoors and malware.

NachoVPN Tool Exploits Flaws in Popular VPN Clients for System Compromise

Flaws in Palo Alto Networks and SonicWall VPNs could allow remote code execution on Windows and macOS, exposing users to significant security risks.

700K+ DrayTek routers are sitting ducks on the internet

A critical vulnerability in DrayTek routers could allow remote-code execution, risking sensitive data and system integrity.

Over 300K Prometheus Instances Exposed: Credentials and API Keys Leaking Online

Thousands of Prometheus servers lack proper authentication, risking data leakage, DoS, and remote code execution attacks due to their exposure on the internet.

Zero Day Initiative - CVE-2024-38213: Copy2Pwn Exploit Evades Windows Web Protections

CVE-2024-38213 allows bypassing Windows mark-of-the-web protections leading to remote code execution via WebDAV shares.

Microsoft offers updates on 117 vulnerabilities on Patch Tuesday

Microsoft released updates addressing 117 vulnerabilities, including two actively exploited threats that pose significant risks to users.
morecybersecurity
#apache-struts

Critical Apache Struts bug under active exploit

Critical security flaw in Apache Struts 2 allows file upload manipulation, posing severe risks of remote code execution; immediate updates are essential.

Apache issues patches for critical Struts 2 RCE bug

The Apache Struts 2 vulnerability (CVE-2024-53677) has a severity rating of 9.5 and poses a serious security risk, necessitating immediate action for users.

Critical Apache Struts bug under active exploit

Critical security flaw in Apache Struts 2 allows file upload manipulation, posing severe risks of remote code execution; immediate updates are essential.

Apache issues patches for critical Struts 2 RCE bug

The Apache Struts 2 vulnerability (CVE-2024-53677) has a severity rating of 9.5 and poses a serious security risk, necessitating immediate action for users.
moreapache-struts
#security-vulnerability

Doomsday 9.9 unauthenticated RCE bug affects all Linux

A critical 9.9-rated unauthenticated RCE flaw is affecting GNU/Linux systems, with no fix yet despite disclosure to developers three weeks ago.

D-Link says replace vulnerable routers or risk pwnage

Users of older D-Link VPN routers should replace their devices to avoid critical security vulnerabilities.
The vulnerability allows for remote code execution without authentication, raising significant security concerns.

Doomsday 9.9 unauthenticated RCE bug affects all Linux

A critical 9.9-rated unauthenticated RCE flaw is affecting GNU/Linux systems, with no fix yet despite disclosure to developers three weeks ago.

D-Link says replace vulnerable routers or risk pwnage

Users of older D-Link VPN routers should replace their devices to avoid critical security vulnerabilities.
The vulnerability allows for remote code execution without authentication, raising significant security concerns.
moresecurity-vulnerability
#security-vulnerabilities

Printing vulnerability affecting Linux distros raises alarm | Computer Weekly

The newly discovered vulnerabilities in Cups pose a significant security risk to numerous devices, potentially exposing them to remote code execution.

Critical Flaws in Traccar GPS System Expose Users to Remote Attacks

Traccar GPS system has critical vulnerabilities allowing remote code execution via path traversal if guest registration is enabled, posing serious security risks.

Printing vulnerability affecting Linux distros raises alarm | Computer Weekly

The newly discovered vulnerabilities in Cups pose a significant security risk to numerous devices, potentially exposing them to remote code execution.

Critical Flaws in Traccar GPS System Expose Users to Remote Attacks

Traccar GPS system has critical vulnerabilities allowing remote code execution via path traversal if guest registration is enabled, posing serious security risks.
moresecurity-vulnerabilities

Zero Day Initiative - Exploiting Exchange PowerShell After ProxyNotShell: Part 3 - DLL Loading Chain for RCE

The article explains a chain of vulnerabilities in Microsoft Exchange that lead to remote code execution.

September Patch Tuesday: Update before 1 October | Computer Weekly

Microsoft has issued critical fixes for multiple remote code vulnerabilities in its September 2024 update, indicating urgency for users to patch their systems.

PoCcode released for zero-click Windows critical vuln

Windows users must install the latest patches swiftly to protect against CVE-2024-38063, a critical vulnerability that allows remote code execution.
#google

Researchers Uncover 10 Flaws in Google's File Transfer Tool Quick Share

As many as 10 security flaws were discovered in Google's Quick Share utility, leading to a potential remote code execution threat on systems with the software.

Google patches Quick Share for Windows to shut malware hole

Google's Quick Share for Windows had 10 now-fixed bugs, allowing remote code execution through a full RCE chain.

Researchers Uncover 10 Flaws in Google's File Transfer Tool Quick Share

As many as 10 security flaws were discovered in Google's Quick Share utility, leading to a potential remote code execution threat on systems with the software.

Google patches Quick Share for Windows to shut malware hole

Google's Quick Share for Windows had 10 now-fixed bugs, allowing remote code execution through a full RCE chain.
moregoogle

New Flaws in Sonos Smart Speakers Allow Hackers to Eavesdrop on Users

Sonos smart speakers have vulnerabilities that could allow remote code execution and covert audio capture by hackers.

AWS 'Bucket Monopoly' attacks could allow account takeover

Critical flaws in AWS services allowed remote code execution and account takeover, fixed by AWS after Aqua Security's research.

Zero Day Initiative - CVE-2023-46263: Ivanti Avalanche Arbitrary File Upload Vulnerability

Ivanti Avalanche, an enterprise mobility management program, has recently been patched for a remote code execution vulnerability.
Successful exploitation of the vulnerability could allow an authenticated attacker to execute code in the context of SYSTEM.

Ivanti Secure VPN Zero-Day Vulnerabilities Allow Chinese Threat Actor to Compromise Systems

Two zero-day vulnerabilities have been discovered in Ivanti Secure VPN, enabling unauthorized remote code execution and system compromise.
The vulnerabilities are being actively exploited by a Chinese nation-state threat actor called UTA0178.
[ Load more ]