Rapid7 Blog جمعه ۸ آبان ۱۴۰۵ · ۱۹:۳۱

Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764)

OverviewAn origin-validation flaw in BeyondTrust Remote Support lets an unauthenticated attacker write files on the appliance and execute code as the site's operating-system user. The entry point is the public customer connection used to start a support session. No account credentials or user interaction are required.The flaw sits between the internal message router, brain, and an appliance-side customer worker, thin…

Vulnerabilities & Zero-Day Phishing Programming & Languages Networking & Internet Operating Systems

Read the full article at Rapid7 Blog Removal request

This page shows only the headline and the short summary. The full text is published by the original source.

Related news

Full archive →

AWS Security Bulletins جمعه ۸ آبان ۱۴۰۵ · ۲۱:۰۹

CVE-2026-119086 - Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel

Bulletin ID: 2026-158-AWS Publication Date: 10/30/2026 10:30 AM PDT Description: FreeRTOS-Kernel is a real-time operating system kernel for microcontrollers and small microprocessors, distributed by Amazon. We identified CVE-2026-119086, the queue-set selection path does not fully validate that the referenced kernel object is a queue set before operating on it. On MPU-enabled builds with queue sets enabled, an unpriv…

Vulnerabilities & Zero-Day Cloud Computing Operating Systems

Source

Cloudflare Blog جمعه ۸ آبان ۱۴۰۵ · ۲۱:۰۸

4 real? Tracking exploitation and patching of eMudhra’s weak keys

Four, just four: that’s the key to break into any unpatched connection on the Internet that is using eMudhra certificates. Here’s how we quickly patched Cloudflare, what evidence we can see of attempted exploitation, and how much of the rest of the Internet remains exposed.

Vulnerabilities & Zero-Day Cryptography Incident Response & Forensics

Source

AWS Security Bulletins جمعه ۸ آبان ۱۴۰۵ · ۲۰:۰۴

CVE-2026-119116 and CVE-2026-119148 - Issues in AWS Nitro Enclaves SDK for C

Bulletin ID: 2026-157-AWS Publication Date: 10/30/2026 09:00 AM PDT Description: We identified CVE-2026-119116, a use-after-free in the SetClient command handler of the kmstool-enclave example application, where an application that executes on the parent EC2 instance could send crafted messages over vsock to corrupt heap memory inside the enclave and execute arbitrary code within it. Only enclave images that include…

Vulnerabilities & Zero-Day Cloud Computing

Source

شهر سخت‌افزار جمعه ۸ آبان ۱۴۰۵ · ۲۰:۰۰

SMS of Death؛ پیامک نامرئی که می‌تواند گوشی اندرویدی شما را بلااستفاده کند

یک پیامک خاص می‌تواند بدون اینکه آن را باز کنید، سرویس تماس گوشی اندرویدی شما را از کار بیندازد. این آسیب‌پذیری که با نام غیررسمی SMS of Death شناخته می‌شود، در شرایط شدیدتر حتی ممکن است گوشی را وارد چرخه راه‌اندازی مجدد کند. نکته نگران‌کننده اینجاست که پیام مخرب می‌تواند پیش از نمایش در صندوق پیامک‌ها، باعث بروز اختلال شود.

Vulnerabilities & Zero-Day

Source