Triage-CVE-2021-44228-Log4Shell-Log4j-

Triage: CVE-2021-44228 Log4Shell / Log4j In questo laboratorio, l'obiettivo era fare il triage di un'altra vulnerabilità reale e ben nota, Log4Shell, una delle vulnerabilità più sfruttate degli ultimi anni a causa di quanto fosse diffusa la libreria interessata nel software aziendale. Passo 1:...

CVE-2026-37710

Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL function...

Vulnerabilities found in PaperCut MF and PaperCut NG of PaperCut

PaperCut has vulnerabilities in PaperCut MF and PaperCut NG. An unauthorized malicious actor could potentially exploit these vulnerabilities to gain control over the PaperCut environment and execute arbitrary code. To do this, the malicious actor would need to send malicious network traffic to th...

libxml2 security update

An update is available for libxml2. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The libxml2 library is a development toolbox providing the implementation of...

RLSA-2026:60394 Moderate: libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow CVE-2026-11979 For more details about the security issues, including the impact, a CVSS score,...

CVE-2026-82078 PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can...

EUVD-2026-67714

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can...

CVE-2026-82078 PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can...

CVE-2026-82078

CVE-2026-82078 is an unsafe dynamic class loading vulnerability (CWE-470, CVSS 9.4 Critical) in the database connection utilities of PaperCut NG and PaperCut MF . The application instantiates database driver classes from configurable names without an allowlist, allowing arbitrary Java bytecode to...

Vulnerabilities in Microsoft Exchange servers

Microsoft has identified vulnerabilities in Exchange Server. A malicious individual can exploit these vulnerabilities to carry out a Denial-of-Service attack, impersonate other users, gain elevated privileges, execute arbitrary code, and/or access sensitive data. For successful exploitation, the...

CVE-2026-42007

CVE-2026-42007 affects Dovecot mail server. An attacker with valid credentials can trigger a use-after-free in the mail editing code by submitting a Sieve script using the editheader extension . This leads to memory leak and potential memory corruption during mail delivery, which can crash the de...

CVE-2026-18393

A flaw was found in FFmpeg. The tdscloadcursor function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A remote attacker could exploit this by supplying a specially crafted video file, potentially leading to a denial of service or arbitrary code...

CVE-2026-78032

SOY CMS contains an issue with deserialization of untrusted data. An arbitrary code may be executed by an attacker with the web server privilege...

RockyLinux 10 : libxml2 (RLSA-2026:60394)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:60394 advisory. libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow CVE-2026-11979 Tenable has extracted the preceding description block direct...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: wildfly-common (UTSA-2026-093018)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093018 advisory. Apache Log4j2 2.0-beta9 through 2.15.0 excluding security releases 2.12.2, 2.12.3, and 2.3.1 JNDI features used in configuration, log messages, and parameters do not...

EUVD-2026-67774

Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL function...

PaperCut NG < 24.1.9.76516 / 25.x < 25.0.12.76510 / 26.x < 26.0.4.76508 Multiple Vulnerabilities

The version of PaperCut NG installed on the remote Windows host is prior to 24.1.9.76516 or 25.x prior to 25.0.12.76510, or 26.x prior to 26.0.4.76508. It is, therefore, affected by the following vulnerabilities: - An authentication bypass vulnerability exists in the web management interface due ...

CVE-2026-37710

Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL function...

PT-2026-83282

Name of the Vulnerable Software and Affected Versions amazon-ssm-agent versions prior to 3.3.4515.0 Description Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin allows an authenticated remote user with ssm:SendCommand permissions restricted to the...

CVE-2026-6876

ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the ServiceNow AI Platform, potentially leading to more access to the ServiceNow AI Platform than...