APACHE FIXED CRITICAL RCE FLAW CVE-2023-50164 at STRUTS 2

The Apache Software Foundation fixed a critical file upload vulnerability in the Struts 2 open-source framework. This flaw, tracked as CVE-2023-50164, could allow remote code execution.

An attacker can manipulate file upload parameters to upload a malicious file and execute code on the server.

• Hot Topic
• Vulnerabilities

Memory-Dump-UEFI
Researcher dumping memory to bypass BitLocker on Windows 11

By infosecbulletin / Thursday , January 2 2025

Researchers have demonstrated a method to bypass Windows 11’s BitLocker encryption, enabling the extraction of Full Volume Encryption Keys (FVEKs)...

Read More

• Vulnerabilities

CVE-2024-49112
PoC Exploit Released for Zero-Click vulnerability in Windows

By infosecbulletin / Thursday , January 2 2025

SafeBreach Labs revealed a zero-click vulnerability in the Windows Lightweight Directory Access Protocol (LDAP) service, dubbed “LDAP Nightmare”. This critical...

Read More

• Bank
• National

Financial Threat Assessment 2024
BCSI marks Bangladeshi 28 banks high, 10 medium for cyber attack

By infosecbulletin / Tuesday , December 31 2024

Bangladesh Cyber Security Intelligence (BCSI) has published Financial Threat Assessment report for 2024. In an era where financial institutions and...

Read More

• Vulnerabilities

Misconfigured Kubernetes RBAC in Azure Airflow Could Expose Entire Cluster

By infosecbulletin / Tuesday , December 31 2024

Cybersecurity researchers have uncovered three security weaknesses in Microsoft's Azure Data Factory Apache Airflow integration that, if successfully exploited, could...

Read More

• Cyber Attack

US Treasury says it was hacked by China via third party: Beijing denies

By infosecbulletin / Tuesday , December 31 2024

The US Treasury Department said on Monday that Chinese-linked hackers were able to gain access to ‘unclassified documents’ after compromising...

Read More

• Alert
• Vulnerabilities

PoC Exploited Released for Oracle Weblogic Server Vul

By infosecbulletin / Monday , December 30 2024

Security researchers have warned that a Proof-of-Concept (PoC) exploit has been publicly released for a critical vulnerability affecting Oracle WebLogic...

Read More

• International

Microsoft warn dev urgently to update .NET installer link

By infosecbulletin / Monday , December 30 2024

Microsoft is forcing .NET developers to quickly update their apps and developer pipelines so they do not use 'azureedge.net' domains...

Read More

• International

Look back; The Worst Hacks of 2024

By infosecbulletin / Monday , December 30 2024

In 2024, digital security experienced major breaches as cybercriminals and state-backed groups exploited vulnerabilities for large-scale attacks. These incidents were...

Read More

• Uncategorized

HIPAA to be updated with new cybersecurity regulations, White House

By infosecbulletin / Sunday , December 29 2024

Proposed new cybersecurity rules for healthcare institutions will focus on how they protect user data under HIPAA, as stated by...

Read More

• Bank

New NGate Trojan Drains Bank Accounts via ATMs

By infosecbulletin / Sunday , December 29 2024

Malware analysts at Doctor Web have identified new versions of the NGate banking trojan. This malware steals data from the...

Read More

“An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.” reads the advisory published by Apache Software Foundation. Upgrade to Struts 2.5.33 or higher, as advised by the foundation.

Steven Seeley from Source Incite reported the vulnerability. Apache has not confirmed any active exploitation in attacks.

ALSO READ:

Mid-sized Canadian firms pay an average $1.13 million to ransomware gangs