Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver …
Every CISA KEV addition, plus critical-severity flaws in the kit that sits at the edge of a network: firewalls, VPN gateways, load balancers, routers, switches and management consoles.
Colour on the left of each entry is the CVSS severity. A pink CISA KEV badge means the flaw is being exploited right now — treat those first, whatever the score says. How each post is sourced and checked is set out in the methodology.
Ahsay AhsayCBS Improper Authentication Vulnerability
Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd …
Cisco Secure Email Gateway Relative Path Traversal Vulnerability
A path traversal bug in Cisco Secure Email Gateway’s attachment-scanning feature lets an attacker email a crafted file to the gateway and gain root on the underlying OS without logging in.
Palo Alto Networks PAN-OS Code Injection Vulnerability
An authenticated attacker who can reach the PAN-OS management interface can inject code that runs as root on PA-Series, VM-Series, or Panorama firewalls, and the flaw is already being exploited.
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
An unauthenticated attacker can spoof the login check on Ivanti Connect Secure and run arbitrary commands on the gateway, with no credentials or user interaction required, and it’s already being exploited.
Microsoft Windows Command Injection Vulnerability
A command injection flaw in Windows Shell lets an attacker who tricks a user into opening a crafted file or link bypass a security feature, with full confidentiality, integrity and availability impact — and it’s already being exploited.
Apache Struts Command Injection Vulnerability
A long-standing flaw in Apache Struts lets unauthenticated attackers run commands on the server by abusing the method: prefix when Dynamic Method Invocation is switched on.
ISC BIND Data Processing Errors Vulnerability
A single crafted TKEY query can crash the BIND named daemon on unpatched 9.9.x and 9.10.x servers, knocking out DNS resolution or authority with no login required.
ONLYOFFICE Docs Server Path Traversal Vulnerability
A directory traversal bug in ONLYOFFICE Document Server’s upload endpoint lets a remote, unauthenticated attacker write files outside the upload folder and potentially run code on the host.
ProFTPD Improper Access Control Vulnerability
ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. Listed in CISA KEV …