Sep 18, 2024
3 new incidents, 1 with updates.
Started
- ClosedPatched
Microsoft SQL Server Reporting Services Remote Code Execution
Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account. Added to the CISA KEV catalog on 2024-09-18. CISA lists known use in ransomware campaigns. CVE-2020-0618 was assigned before 2024; the KEV listing came in 2024.
Microsoft SQL ServerClosed Sep 18, 2024
- ClosedPatched
Oracle ADF Faces Deserialization of Untrusted Data
Oracle ADF Faces library, included with Oracle JDeveloper Distribution, contains a deserialization of untrusted data vulnerability leading to unauthenticated remote code execution. Added to the CISA KEV catalog on 2024-09-18. CVE-2022-21445 was assigned before 2024; the KEV listing came in 2024.
Oracle ADF FacesClosed Sep 18, 2024
- ClosedPatched
Oracle WebLogic Server Remote Code Execution
Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution. Added to the CISA KEV catalog on 2024-09-18. CVE-2020-14644 was assigned before 2024; the KEV listing came in 2024.
Oracle WebLogic ServerClosed Sep 18, 2024
Updated
- ClosedPatched
Apache HugeGraph-Server Improper Access Control
Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code. Added to the CISA KEV catalog on 2024-09-18.
Apache HugeGraph-ServerClosed Sep 18, 2024
