InfoSecBulletin Cybersecurity for mankind
The Apache Software Foundation fixed a critical file upload vulnerability in the Struts 2 open-source framework. This flaw, tracked as CVE-2023-50164, could allow remote code execution.
An attacker can manipulate file upload parameters to upload a malicious file and execute code on the server.
MITRE discloses 2024 CWE Top 25 critical software flaw
Python NodeStealer: harvest credit card and Facebook Ads Manager
Cisco Talos
Over 60% of Emails with QR Codes are spam
CERT-In Flags Multiple Critical Vulnerabilities in Zoom app
Daily Security Digest Dated 11/23/24
SafetyDetectives’ Research
Malware evades Microsoft Defender and 2FA, stealing $24K in crypto (video)
Over 145,000 ICS Across 175 Countries Found Exposed Online
World to see AI powered “human washing machines”
Hacker compromised over 2000 Palo Alto Networks Firewalls
“Forces Penpals” exposed US and UK Military Social Network’s 1 Million Records
“An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.” reads the advisory published by Apache Software Foundation. Upgrade to Struts 2.5.33 or higher, as advised by the foundation.
Steven Seeley from Source Incite reported the vulnerability. Apache has not confirmed any active exploitation in attacks.
ALSO READ:
Mid-sized Canadian firms pay an average $1.13 million to ransomware gangs
