Apache APISIX has issued a security alert, revealing a remote code execution vulnerability (CVE-2022-24112) in versions prior to 2.12.1. Apache APISIX is a high-performance API gateway that is dynamic and real-time. APISIX offers load balancing, dynamic upstream, canary release, circuit breaking, authentication, observability, and other traffic management functions. The vulnerability states “In versions of Apache … Continue reading “Apache APISIX Batch-Requests Plugin Remote Code Execution Vulnerability (CVE-2022-24112)”
Tag: Remote Code Execution Vulnerability
Apache Cassandra Database Software High-Severity Remote Code Execution Vulnerability (CVE-2021-44521)
Apache Cassandra is a free and open-source distributed NoSQL database management system that can handle massive volumes of data across many commodity servers while maintaining high availability and avoiding single points of failure. Researchers have revealed details of a high-severity security flaw in the Apache Cassandra open-source NoSQL distributed database. The vulnerability is easy … Continue reading “Apache Cassandra Database Software High-Severity Remote Code Execution Vulnerability (CVE-2021-44521)”
Microsoft Windows security update for January 2022 addresses 126 Vulnerabilities with 9 rated as Critical
Microsoft patched 126 vulnerabilities in their January 2022 Patch Tuesday release. Out of these, nine are rated as critical severity. As of this writing, none of the 126 vulnerabilities are known to be actively exploited. Microsoft has fixed problems in their software including Remote Code Execution (RCE) vulnerabilities, privilege escalation security flaws, spoofing bugs, … Continue reading “Microsoft Windows security update for January 2022 addresses 126 Vulnerabilities with 9 rated as Critical”
Apache Log4j2 Zero-day Remote Code Execution Vulnerability Exploited in the Wild (CVE-2021-44228)
A remote code execution vulnerability in Apache Log4j2 was discovered on the Internet on December 9, 2021, and is actively being exploited in the wild. In Apache Log4j2, attackers can create customized requests to execute remote code. Users are recommended to examine related vulnerabilities as soon as possible due to the wide spectrum of impact … Continue reading “Apache Log4j2 Zero-day Remote Code Execution Vulnerability Exploited in the Wild (CVE-2021-44228)”
Zoho ManageEngine ServiceDesk Plus and SupportCenter Plus Unauthenticated Remote Code Execution Vulnerability (CVE-2021-44077)
The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) have warned users of a newly patched issue in Zoho’s ManageEngine ServiceDesk Plus and SupportCenter Plus that can be used to drop web– shells leading to remote code execution. CVE-2021-44077 is an unauthenticated remote code execution vulnerability that affects older versions of ServiceDesk Plus and SupportCenter Plus. Zoho ManageEngine ServiceDesk Plus remote code execution vulnerability ManageEngine ServiceDesk … Continue reading “Zoho ManageEngine ServiceDesk Plus and SupportCenter Plus Unauthenticated Remote Code Execution Vulnerability (CVE-2021-44077)”
Microsoft Exchange Server Remote Code Execution (RCE) Vulnerability (CVE-2021-42321)
Microsoft has released a patch for a highly severe Exchange Server vulnerability in its November 2021 Patch Tuesday. This vulnerability can allow authenticated attackers to execute codes remotely on vulnerable servers. The CVE-2021-42321 security issue is caused by inappropriate validation of command-let (cmdlet) parameters. To execute this vulnerability, the attacker needs to be authenticated. This vulnerability only affects on-premises Microsoft Exchange servers, including those used by users in Exchange Hybrid … Continue reading “Microsoft Exchange Server Remote Code Execution (RCE) Vulnerability (CVE-2021-42321)”
GitLab Unauthenticated Remote Code Execution Vulnerability (CVE-2021-22205)
GitLab is a web-based DevOps lifecycle solution built by GitLab Inc. providing unrivaled insight and productivity across the DevOps lifecycle in a single application. GitLab has released an update for a significant remote code execution (RCE) vulnerability (CVE-2021-22205) in GitLab’s web interface. This vulnerability has been regularly exploited in the wild and has caused a vast … Continue reading “GitLab Unauthenticated Remote Code Execution Vulnerability (CVE-2021-22205)”
Apache HTTP Server Path Normalization and Remote Code Execution (RCE) Vulnerability (CVE-2021-42013)
The Apache Software Foundation has published additional security updates for its HTTP Server to remediate an incomplete fix for a path traversal and Remote Code Execution (RCE) vulnerability patched in the first week of October 2021 (CVE-2021-41773). CVE-2021-42013 is based upon a path normalization bug, which allowed an unauthenticated remote user to view files on the Apache Web … Continue reading “Apache HTTP Server Path Normalization and Remote Code Execution (RCE) Vulnerability (CVE-2021-42013)”
Microsoft Windows Print Spooler Remote Code Execution Vulnerability (CVE-2021-34527)
A zero-day exploit which allows authenticated users with a regular Domain User account to gain full SYSTEM-level privileges was observed on June 29, 2021 on a fully patched Windows system. Named PrintNightmare and tracked as CVE-2021-34527, was disclosed by MS on July 1, 2021. PrintNightmare (CVE-2021-34527) is a vulnerability that allows an attacker with a … Continue reading “Microsoft Windows Print Spooler Remote Code Execution Vulnerability (CVE-2021-34527)”
Pulse Connect Secure Remote Code Execution Vulnerability (CVE-2021-22893)
An authenticated bypass vulnerability was discovered under Pulse Connect Secure (PCS), that allows an unauthenticated user to perform remote arbitrary file execution on the Pulse Connect Secure gateway. News in the wild states that the new zero-day vulnerability in Pulse Secure VPN devices with CVE-2021-22893 were exploited to take over multiple US and European government … Continue reading “Pulse Connect Secure Remote Code Execution Vulnerability (CVE-2021-22893)”
