RCE Vulnerability Archives

Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available

27Jul

By RBNo Comments

News

Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available

Attackers are focusing on a serious vulnerability in Fastjson, Alibaba's JSON library for Java, according to security companies ThreatBook and Imperva. A malicious JSON request with Java process rights can run code in impacted Spring Boot apps without authentication. The vulnerability, which is tracked as CVE-2026-16723, has a CVSS score of 9.0 according to Alibaba. Fastjson 1.2.68 through 1.2.83, a Spring Boot executable fat-JAR, a network-reachable path that transmits attacker-controlled JSON to an impacted parser, and SafeMode left at its disabled default are all necessary for the verified chain. There is no need for a classpath device, and AutoType can be left disabled. Alibaba had not yet published a fixed version of Fastjson 1.x as of July 25. Businesses that are unable to mov...

Veeam Issues Patch for Critical RCE Vulnerability in Service Provider Console

4Dec

By RBNo Comments

News

Veeam Issues Patch for Critical RCE Vulnerability in Service Provider Console

To fix a serious vulnerability affecting Service Provider Console (VSPC) that might allow remote code execution on vulnerable instances, Veeam has published security upgrades. Tracked as CVE-2024-42448, the vulnerability has a CVSS score of 9.9 out of 10.0. The problem was discovered during internal testing, according to the company. Veeam stated in an advisory that Remote Code Execution (RCE) on the VSPC server computer is feasible from the VSPC management agent machine, provided that the management agent has server authorization read more about Veeam Issues Patch for Critical RCE Vulnerability in Service Provider Console Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions....

Ivanti Releases Urgent Fix for Critical Sentry RCE Vulnerability

21Mar

By RBNo Comments

News

Ivanti Releases Urgent Fix for Critical Sentry RCE Vulnerability

Ivanti has notified customers of a serious remote code execution vulnerability that affects Standalone Sentry and is advising them to update their systems right away to remain safe from possible online attacks. The vulnerability, identified as CVE-2023-41724, has a 9.6 CVSS score. Within the same physical or logical network, an unauthenticated threat actor can execute arbitrary commands on the appliance's underlying operating system, according to the business. The bug affects previous versions as well as all supported versions 9.17.0, 9.18.0, and 9.19.0. The 9.17.1, 9.18.1, and 9.19.1 patch, according to the corporation, is now available for download through the usual download channel. The NATO Cyber Security Center's Vincent Hutsebaut read more Ivanti Releases Urgent Fix for Cri...

Fortra Patches Critical RCE Vulnerability in FileCatalyst Transfer Tool

18Mar

By RBNo Comments

News

Fortra Patches Critical RCE Vulnerability in FileCatalyst Transfer Tool

Details of a significant security vulnerability that has been fixed in Fortra's FileCatalyst file transfer software have been made public. This vulnerability might give unauthenticated attackers access to remote code execution on vulnerable servers. The vulnerability, identified as CVE-2024-25153, has a CVSS score of 9.8 out of a possible 10. Using a specifically constructed POST request, files can be uploaded outside of the intended 'uploadtemp' directory using a directory traversal within the 'ftpservlet' of the FileCatalyst Workflow Web Portal, the business stated in an alert last week. When a file is successfully uploaded to the DocumentRoot of a web portal, specifically designed JSP files may be used to run programs read more Fortra Patches Critical RCE Vulnerability in File...

Critical RCE Vulnerability Uncovered in Juniper SRX Firewalls and EX Switches

16Jan

By RBNo Comments

News

Critical RCE Vulnerability Uncovered in Juniper SRX Firewalls and EX Switches

Updates have been made available by Juniper Networks to address a serious remote code execution (RCE) vulnerability in its EX Series switches and SRX Series firewalls. The problem, identified by the tracking number CVE-2024-21591, has a CVSS rating of 9.8. "An out-of-bounds write vulnerability in J-Web of Juniper Networks Junos OS SRX Series and EX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS) or Remote Code Execution (RCE) and obtain root privileges on the device," the business stated in an advisory. The leading player in networking equipment, which Hewlett Packard Enterprise (HPE) plans to acquire for $14 billion, claimed that the problem stems read more Critical RCE Vulnerability Uncovered in Juniper SRX Firewalls and EX Switches. ...