There is an active exploitation of a remote code execution vulnerability that affects multiple versions of the ZK Framework. Assigned with CVE-2022-36537, the vulnerability may allow an attacker to access critical information by sending a specially crafted POST request to the AuUploader component. Markus Wulftange of Code White GmbH discovered the vulnerability last year, and … Continue reading “ZK Java Framework Remote Code Execution Vulnerability (CVE-2022-36537)”
Tag: Remote Code Execution Vulnerability
IBM Aspera Faspex Remote Code Execution Vulnerability (CVE-2022-47986)
IBM has released a security advisory to address ten vulnerabilities affecting its transfer solution Aspera Faspex. CVE-2022-47986 is the only critically rated vulnerability among the ten flaws that IBM addressed. Multiple remote code execution, cross-site scripting (XSS), denial of service (DoS), and other security vulnerabilities have been patched by IBM in this security update. CVE-2022-47986 … Continue reading “IBM Aspera Faspex Remote Code Execution Vulnerability (CVE-2022-47986)”
Oracle WebLogic Server Information Disclosure Vulnerability (CVE-2023-21839)
Oracle WebLogic server is vulnerable to an information disclosure flaw that can lead to remote code execution. Assigned with CVE-2023-21839, an attacker can exploit this vulnerability to gain unauthorized access to critical data. The vulnerability started getting noticed shortly after proof of concept (PoC) was published. Oracle WebLogic Server is a product of Oracle Fusion … Continue reading “Oracle WebLogic Server Information Disclosure Vulnerability (CVE-2023-21839)”
TerraMaster NAS Remote Code Execution Vulnerability (CVE-2022-24990)
TerraMaster NAS devices are vulnerable to a remote command execution vulnerability that could allow an unauthenticated attacker to execute commands as root. Tracked as CVE-2022-24990, the vulnerability is exploited via PHP Object Instantiation. CISA has added this vulnerability to its Known Exploited Vulnerabilities Catalog, requesting users to patch it soon. NAS (network-attached … Continue reading “TerraMaster NAS Remote Code Execution Vulnerability (CVE-2022-24990)”
Oracle E-Business Suite Remote Code Execution Vulnerability (CVE-2022-21587)
A critical remote code execution vulnerability in the Oracle E-Business suite is being exploited in the wild shortly after proof-of-concept (PoC) was published. Tracked as CVE-2022-21587, the vulnerability may allow an unauthenticated attacker to execute arbitrary code on the target system. It has been rated critical and given a CVSSv3 base score of 9.8. … Continue reading “Oracle E-Business Suite Remote Code Execution Vulnerability (CVE-2022-21587)”
CentOS Web Panel 7 (CWP7) Unauthenticated Remote Code Execution Vulnerability (CVE-2022-44877)
Malicious attackers exploit a critical vulnerability in the CentOS Web Panel (CWP). Tracked as CVE-2022-44877, this vulnerability could allow an attacker to gain unauthenticated remote code execution on vulnerable servers. The exploitation of this vulnerability began after the security researcher Numan Türle of Gais Cyber Security made the proof-of-concept code publicly available. CentOS Web Panel … Continue reading “CentOS Web Panel 7 (CWP7) Unauthenticated Remote Code Execution Vulnerability (CVE-2022-44877)”
VMware Released Patch for Multiple Vulnerabilities in VMware vRealize Log Insight (CVE-2022-31704, CVE-2022-31706, CVE-2022-31710, & CVE-2022-31711)
VMware has released a security advisory to address multiple vulnerabilities in its vRealize Log Insight product. The vulnerabilities have CVSSv3 scores ranging from 5.3 to 9.8. The vulnerabilities are being tracked as CVE-2022-31706, CVE-2022-31704, CVE-2022-31710, and CVE-2022-31711. vRealize Log Insight is used by infrastructure and applications in any environment for intelligent log management. This … Continue reading “VMware Released Patch for Multiple Vulnerabilities in VMware vRealize Log Insight (CVE-2022-31704, CVE-2022-31706, CVE-2022-31710, & CVE-2022-31711)”
Cisco EoL Small Business VPN Routers Multiple Vulnerabilities (CVE-2023-20025 & CVE-2023-20026)
Cisco released a security advisory to address critical severity vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, and RV082 Routers (CVE-2023-20025 & CVE-2023-20026). On successful exploitation, these vulnerabilities could allow a remote attacker to bypass authentication or execute arbitrary commands on affected devices. Hou Liuyang of Qihoo 360 Netlab … Continue reading “Cisco EoL Small Business VPN Routers Multiple Vulnerabilities (CVE-2023-20025 & CVE-2023-20026)”
JsonWebToken Library Remote Code Execution vulnerability (CVE-2022-23529)
A high-severity remote code execution vulnerability has been discovered in the JsonWebToken (JWT) open-source encryption project. Tracked as CVE-2022-23529, an attacker can exploit this vulnerability to gain remote code execution on the target server verifying a maliciously crafted JSON web token (JWT) request. Artur Oleyarsh, Security Researcher at Unit42, has mentioned in his blog, … Continue reading “JsonWebToken Library Remote Code Execution vulnerability (CVE-2022-23529)”
Zoho Patches Remote Code Execution Vulnerability Affecting Multiple ManageEngine Products (CVE-2022-47966)
A critical remote code execution vulnerability has been discovered in multiple Zoho ManageEngine products. Tracked as CVE-2022-47966, this vulnerability affects 24 products of ManageEngine. Successful exploitation of this vulnerability may allow an attacker to perform remote code execution. Khoadha of Viettel Cyber Security has discovered this vulnerability via Zoho Bug Bounty program. Zoho ManageEngine … Continue reading “Zoho Patches Remote Code Execution Vulnerability Affecting Multiple ManageEngine Products (CVE-2022-47966)”