Critical Remote Code Execution and SQL Injection Patches
Major software vendors including Ivanti, Fortinet, SAP, VMware, and n8n have released security updates addressing a range of critical vulnerabilities. The flaws could allow attackers to execute arbitrary code, bypass authentication, inject malicious SQL commands, or escalate privileges on affected systems. Organizations are urged to apply patches immediately to prevent potential exploitation.
Among the most severe issues is a critical vulnerability in Ivanti Xtraction, rated with a high severity score. The flaw involves external control of a file name, which could allow a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory. This could lead to information disclosure and enable client-side attacks. Fortinet also addressed two critical shortcomings in FortiAuthenticator and FortiSandbox products that could allow unauthenticated attackers to execute unauthorized code through crafted requests.
SAP and Other Vendor Vulnerabilities Addressed
SAP released patches for two critical vulnerabilities, including an SQL injection flaw in SAP S/4HANA and a missing authentication check in SAP Commerce cloud configuration. The authentication flaw stems from an overly permissive security configuration with improper rule ordering, potentially allowing an unauthenticated user to upload malicious configurations and perform code injection. VMware and n8n also shipped fixes for privilege escalation and other security issues. System administrators should prioritize these updates as part of their regular patch management cycles.
Source: The Hacker News
