CVEs & Disclosures

Command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software allowing unauthenticated attackers to execute arbitrary code with root privileges.

Command injection vulnerability in web components of Ivanti Connect Secure allowing authenticated administrators or chained unauthenticated actors to send crafted requests and execute arbitrary commands.

Best-Fit character encoding conversion flaw in Windows PHP-CGI implementation enabling unauthenticated remote code execution via crafted query string arguments.

Signal handler race condition vulnerability in OpenSSH's server (sshd) allowing unauthenticated remote code execution as root on glibc-based Linux systems.

Insecure deserialization vulnerability in Apache ActiveMQ OpenWire protocol implementation allowing unauthenticated remote code execution via ClassPathXmlApplicationContext invocation.

Broken access control flaw in Atlassian Confluence setup endpoints allowing unauthenticated attackers to re-trigger setup procedures and create rogue administrative accounts.

Memory corruption stack buffer overflow in Citrix NetScaler Gateway SAML authentication endpoint allowing unauthenticated remote code execution.

Buffer over-read vulnerability in Citrix NetScaler OpenID Connect implementation leaking memory chunks containing valid session tokens.

Class loader manipulation vulnerability in Spring Framework data binding on Java 9+ allowing attackers to overwrite Tomcat logging configurations and drop web shells.

Unauthenticated OGNL expression injection in Confluence web URI parsing allowing remote code execution via crafted HTTP GET requests.

JNDI lookup injection flaw in Apache Log4j2 allowing unauthenticated remote code execution when user-supplied strings are logged.

Pre-authentication server-side request forgery (SSRF) vulnerability in Microsoft Exchange Server allowing attackers to authenticate as the Exchange server.