A critical remote code execution vulnerability has been discovered in Apache Struts, a popular open source framework for developing web applications in the Java programming language. [1] In the past, Apache Struts RCE vulnerabilities have been weaponized in less than 24 hours -- one of which resulted in the Equifax breach that totaled over $600 million in cost. [2]
A vulnerability has been discovered in Oracle Database that could allow for complete compromise of the database, as well as shell access to the underlying server. [1] . The vulnerability resides in the Java Virtual Machine component of the Oracle Database Server and does not require user interaction. The vulnerability allows low-privileged attackers that have Create Session privilege with network access via Oracle Net to compromise the Java VM component.
NOTE: Drupal core developers have stated that exploits for this vulnerability will likely be developed within days. Drupal site owners must take action immediately or risk complete compromise of their sites.
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. [1]
This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised. [1]
Multiple vulnerabilities have been discovered in PHP, the most severe of which could allow an attacker to execute arbitrary code. PHP is a programming language originally designed for use in web-based applications with HTML content. PHP supports a wide variety of platforms and is used by numerous web-based software applications. [1]
A team of security researchers disclosed several software analysis methods that, when used for malicious purposes, have the potential to improperly gather sensitive data from many types of computing devices with many different vendors’ processors and operating systems.
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. [1]
Researchers have discovered serious weaknesses in WPA2, a protocol that secures all modern protected Wi-Fi networks. This includes everything from computers, tablets, phones, home wireless routers and any device that supports WPA2 over Wi-Fi.
While details are still emerging, not all vendors have released patches as of yet. So, in some cases, there will be little users can do until patches are released. An attacker needs to be in range of an access-point to leverage this attack.
A critical vulnerability has been discovered in the Apache Struts web application framework for Java web applications. A remote code execution attack is possible when using the Apache Struts REST plugin with XStream handler to deserialise XML requests. [1]
Attackers can execute arbitrary code remotely by exploiting this vulnerability.
A remote code execution vulnerability exists when Windows Search handles objects in memory. This can be exploited by an attacker sending a specially crafted SMB message to the Windows Search service. [4]
Due to recent nation-state activity and the elevated risk of potential cyber attacks, Microsoft has released security updates for older unsupported versions of Windows for this issue as well as other high-severity fixes in the June patch release. [1]
The samba team has released a patch for a Remote Code Execution bug that affects all versions between 3.5.0 and 4.6.3/4.5.9/4.4.13. This vulnerability will allow a malicious attacker to upload a library to a writable share then cause the server to execute that library. [1] Patches are available from the samba.org. [2]
A critical vulnerability has been discovered and released in the Apache Struts 2 framework. Patches are available from Apache. [1]
This vulnerability allows for unauthenticated, remote code execution on the server. Further, there are at least two known public exploits for this vulnerability [2] and ISP has already started to see scanning and exploit attempts against campus systems.
WordPress has fixed several critical flaws in its content management system, addressing cross-site scripting and sql injection bugs, along with a severe privilege escalation / content injection vulnerability. [1]