Skip to main content
Apexward Pulse
15 reportsPriority High

Multiple OS command injection vulnerabilities disclosed

Several OS command injection vulnerabilities have been disclosed, some of which are reported to be exploited in the wild, posing a risk to UK organisations using affected systems.

First report Latest

What is going on

  • A Trend Micro product was reported to have an OS command injection vulnerability that could allow a pre-authenticated remote attacker to upload malicious code and execute commands.
  • Multiple other vulnerabilities were disclosed, including ones affecting Smartbedded Meteobridge, Dassault Systèmes DELMIA Apriso, and XWiki Platform.
  • A recent disclosure about an OS command injection vulnerability in EG Secure Solutions SiteGuard Server Edition was highlighted, with CISA adding six new vulnerabilities to its known-exploited catalogue.
  • Some of these vulnerabilities are reported to be actively exploited in the wild, according to the CISA known-exploited catalogue.
  • The latest disclosures include vulnerabilities affecting systems such as Apache Struts, Ahsay AhsayCBS, and Ivanti Endpoint Manager.
  • The timeline shows a continuous flow of new vulnerabilities being disclosed, with some having a high likelihood of exploitation in the near future.
  • What to watch: The emergence of new exploitation attempts or updates from CISA regarding the active exploitation of these vulnerabilities could change the current understanding of the threat landscape.

Reports in this story

Newest first. Each one is a separate event with its own sources and evidence.

Back to the feed