article thumbnail

Apache Struts users have to update FileUpload library to fix years-old flaws

Security Affairs

Apache Struts Users have to update the Commons FileUpload library in Struts 2 that is affected by two vulnerabilities. Apache Struts developers have addressed two vulnerabilities in the Commons FileUpload library in Struts 2, the flaws can be exploited for remote code execution and denial-of-service (DoS) attacks. Struts 2.3.x

Libraries 279
article thumbnail

New Pro-Ocean crypto-miner targets Apache ActiveMQ, Oracle WebLogic, and Redis installs

Security Affairs

The new malware implement new and improved rootkit and worm capabilities, it continues to target cloud applications by exploiting known vulnerabilities such as Oracle WebLogic ( CVE-2017-10271 ) and Apache ActiveMQ ( CVE-2016-3088 ) servers. One of the ways to use LD_PRELOAD is to add the crafted library to /etc/ld.so.preload.”

Cloud 303
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Oracle critical patch advisory addresses 284 flaws, 33 critical

Security Affairs

The advisory fixed the CVE-2016-1000031 flaw, a remote code execution (RCE) bug in the Apache Commons FileUpload, disclosed in November last year. The Commons FileUpload library is the default file upload mechanism in Struts 2, the CVE-2016-1000031 was discovered two years ago by experts at Tenable.

article thumbnail

INFRA:HALT flaws impact OT devices from hundreds of vendors

Security Affairs

IN FRA:HALT is a set of vulnerabilities affecting a popular TCP/IP library commonly OT devices manufactured by more than 200 vendors. NicheStack (aka InterNiche stack) is a proprietary TCP/IP stack developed originally by InterNiche Technologies and acquired by HCC Embedded in 2016. ” states the report.

article thumbnail

Mandrake Android spyware found in five apps in Google Play with over 32,000 downloads since 2022

Security Affairs

The original Mandrake campaign had two major infection waves, in 2016–2017 and 2018–2020. These included relocating malicious functions to obfuscated native libraries, using certificate pinning to secure C2 communications, and determine if it was running on a rooted device or in an emulated environment.

Libraries 318
article thumbnail

EU launches bug bounty programs for 15 software

Security Affairs

Bug bounties for other nine products ( FLUX TL , KeePass , 7-zip , Digital Signature Services (DSS) , Drupal , GNU C Library ( glibc ) , PHP Symfony , Apache Tomcat , and WSO2 ) are arranged through the Intigrity platform. GNU C Library (glibc). Digital Signature Services (DSS). 25.000,00 € 30/01/2019. 15/10/2019.

Libraries 279
article thumbnail

Hidden Cobra APT used the new ATM cash-out scheme FASTCash to hit banks worldwide

Security Affairs

The group is considered responsible for the massive WannaCry ransomware attack, a string of SWIFT attacks in 2016, and the Sony Pictures hack. According to the report published by the US-CERT, Hidden Cobra has been using the FASTCash technique since at least 2016, the APT group targets bank infrastructure to cash out ATMs.

Retail 278