Everything Firewall Scoop has reported about Remote Code Execution: 13 stories, newest first. Part of our Vulnerabilities coverage.
Self-managed GitLab users must update immediately to fix a critical integer overflow bug allowing remote code execution without login credentials.
A critical remote code execution flaw in Oracle WebCenter Content allows unauthenticated attackers to seize control of affected servers without credentials.
A CVSS 9.9 flaw in Oracle Essbase allows low-privileged attackers to seize full control via HTTP, exposing environments running version 21.8.3.0.0 to immediate compromise.
Two critical vulnerabilities in PHP allow attackers to execute code remotely without credentials, affecting all web-serving deployments using supported versions.
A stack-based buffer overflow in the batchupg feature of this router model permits arbitrary code execution via authenticated HTTP requests.
A stack-based buffer overflow in Advantech ADAM-3600 units prior to version 2.8.5.0 enables authenticated attackers to execute arbitrary code via long file paths.
Attackers are actively exploiting a chain of four vulnerabilities in Plex Media Server to install cryptominers and proxy software on unpatched systems.
A high-severity flaw in Craft CMS allows logged-in users to execute arbitrary code by abusing the Twig group filter without proper safeguards.
Attackers can execute code on WooCommerce sites by uploading PHP files through a bypassed Google Drive integration endpoint without logging in.
A high-severity heap-based buffer overflow in Office Access lets remote attackers run code without authentication, affecting specific LTSC and M365 builds.
Microsoft confirms a heap-based buffer overflow in Windows Error Reporting allows remote attackers to execute code without authentication.
Microsoft confirms a heap-based buffer overflow in Windows Media Foundation enables remote code execution by unauthorized attackers via network access.
A critical remote code execution vulnerability in IBM identity products allows authenticated attackers to take control of systems via a protection failure.