Session Fixation Vulnerability in Zammad Enables Remote Code Execution
A session fixation vulnerability in Zammad GmbH Zammad can lead to remote code execution as the zammad user and may be chained with another vulnerability.
Newsroom
Cybersecurity news, advisories and updates
Threat advisories, regulatory changes in the Kingdom, short briefs on what matters this week, and news from our firm — each written for decision makers, with what to do next.
Showing 21
#Vulnerability management Remove
Path Traversal Vulnerability in ONLYOFFICE Docs Enables Remote Code Execution
A path traversal vulnerability in ONLYOFFICE Docs when JWT authentication is enabled allows attackers to upload malicious images and potentially execute remote code on affected servers.
Threat advisoriesCritical
Citrix NetScaler Input Validation Flaw Enables Unauthenticated Remote Command Execution
Citrix NetScaler ADC and Gateway products contain an improper input validation vulnerability allowing unauthenticated attackers to execute arbitrary commands remotely.
Threat advisoriesCritical
Critical Remote File Inclusion Vulnerability Disclosed in WordPress Core
A critical remote file inclusion vulnerability in WordPress Core permits unauthenticated attackers to execute arbitrary code by forcing page-template resolution to include local PHP files outside theme directories.
Threat advisoriesCritical
Critical Vulnerability in Cisco Catalyst SD-WAN Manager Enables Unauthenticated Admin Access
A hex encoding vulnerability in Cisco Catalyst SD-WAN Manager allows unauthenticated remote attackers to gain admin privileges through improper URI encoding handling in HTTP requests.
Threat advisoriesCritical
BeyondTrust Remote Support Authentication Bypass Vulnerability Requires Immediate Action
BeyondTrust Remote Support contains an authentication bypass vulnerability allowing remote attackers to perform file operations on the appliance, requiring immediate vendor mitigations.
Microsoft SharePoint Code Injection Vulnerability Requires Immediate Patching
Microsoft SharePoint contains a code injection vulnerability allowing authorized attackers to execute code remotely over a network, requiring immediate application of vendor security updates.
Threat advisoriesCritical
Apache Struts Command Injection Vulnerability Requires Immediate Patching
Apache Struts contains a command injection vulnerability enabling remote attackers to execute arbitrary code when Dynamic Method Invocation is enabled, requiring immediate vendor patches.
CISA Adds New Vulnerability to Known Exploited Vulnerabilities Catalog
CISA has added a new vulnerability to its Known Exploited Vulnerabilities Catalog, highlighting the need for organizations to prioritize remediation efforts for high-risk vulnerabilities.
Trust
Built around the regulators you answer to
SAMA
Saudi Central BankCSF · BCM · CRFR
NCA
National Cybersecurity AuthorityECC-2:2024 · CSCC · CCC
SDAIA
Saudi Data & AI AuthorityPDPL
CMA
Capital Market AuthorityCSG
CST
Communications, Space & Technology CommissionCRF
14regulatory frameworks
Ready to talk about your compliance?
Tell us where you stand. We will show you the shortest path to what your regulator expects.