Tag: Remote Code Execution
Two WordPress plugin bugs let attackers plant web shells
Wordfence and Defiant detail critical flaws in WooCommerce Wholesale Lead Capture and The Events Calendar, both reachable without credentials.
Cisco patches a zero-day that turns one email into root
A crafted message can give an unauthenticated attacker root on Cisco's secure email gateway, and the flaw is already being…
Chinese crew turns a Gitea bug into a 13-victim espionage spree
A newly named threat actor automated a July Gitea flaw into a framework that stole source code and pushed on…
Check Point patches two CVSS 9.8 flaws in VPN certificate handling
Check Point has patched two certificate-handling bugs that score 9.8 and could let an unauthenticated attacker run code.
SAP patches CVSS 10 OVERPASS kernel bug reachable without credentials
SAP patches OVERPASS, a CVSS 10 kernel bug that lets unauthenticated attackers run commands on SAP hosts.
N-central zero-day claims split N-able’s advisories as hotfix four ships
N-able's fourth N-central hotfix closes a CVSS 10 pre-auth RCE while its own advisories disagree on whether it is already…
Telerik UI exploit goes public for a chain Progress fixed in July
TantoSec's public tool turns a Telerik UI padding oracle into unauthenticated code execution for shops that skipped the July patch.
HPE fixes 34 ArubaOS-CX flaws led by a 9.8 RCE cluster
HPE's AOS-CX updates close 34 CVEs including a 9.8-rated unauthenticated RCE cluster.