SQL injection in your password vault: ManageEngine PAM products at 8.8

An invalid pointer bug in Firefox's Graphics component lets an attacker escalate privileges. In practice, a malicious webpage could exploit this to break out of the browser sandbox or run code with elevated permissions. No reports of exploitation in the wild yet, but memory corruption bugs in graphics pipelines tend to be reliable targets.

Affected estate

Anyone managing Firefox, Firefox ESR, or Thunderbird installations on desktops or terminals

How to check

Run 'firefox --version' or check Help > About Firefox. For Thunderbird, check Help > About Thunderbird.

Included because

privilege escalation; browser-based attack vector; large install base; CVSS 8.8

Action

Push the updated browser and mail client versions through your patch management or software deployment system.

Why it matters

Privilege escalation from a webpage visit could give an attacker control over the user's session or system without additional interaction.

Source

Mozilla Foundation Security Advisory

Jolokia's JSR-160 proxy feature doesn't properly validate JMX service URLs supplied by clients. An attacker can craft a request that bypasses the existing denylist, forcing the Jolokia agent JVM to make JNDI lookups against an attacker-controlled LDAP server. This can lead to SSRF, credential theft (JMX creds forwarded to the attacker's endpoint), and potentially remote code execution depending on what's on the classpath.

Affected estate

Anyone running Jolokia with JSR-160 proxy mode enabled, especially on internet-facing or shared-network JVMs

How to check

Search your application deployments for Jolokia JARs or WARs. Check Jolokia configuration for proxy mode ('jsr160Proxy' in jolokia-access.xml or agent config). Verify the Jolokia version in your dependency tree.

Included because

denylist bypass; JNDI/LDAP injection; potential RCE; CVSS 8.1; commonly exposed in Java environments

Action

Upgrade Jolokia to the patched release. As a short-term mitigation, disable JSR-160 proxy or restrict network access to the Jolokia endpoint.

Why it matters

This is a denylist bypass that can chain into RCE via JNDI/LDAP injection, a well-understood and weaponizable attack path.

Source

Red Hat / NVD

A post-authentication OS command injection bug in the SonicWall SMA1000 Appliance Management Console lets an admin-level attacker run arbitrary OS commands on the appliance. The catch: the attacker needs to already be authenticated as an administrator, and specific conditions must be met. That lowers the immediate risk, but if an admin account is compromised (or an insider goes rogue), this gives full OS-level control over the appliance.

Affected estate

Anyone running SonicWall SMA1000 appliances with the Appliance Management Console exposed

How to check

Log into the SMA1000 AMC and check the firmware version under System > Status. Compare against SonicWall's advisory for fixed versions.

Included because

post-auth but admin-level RCE; VPN gateway appliance; CVSS 7.8; SonicWall appliances are frequent targets

Action

Update the SMA1000 firmware to the patched release. Restrict AMC access to trusted management networks only.

Why it matters

Even though admin auth is required, a compromised admin credential turns this into full OS-level RCE on your VPN gateway appliance.

Source

SonicWall advisory

An unauthenticated attacker can send a specially crafted Accept-Language header to OpenShift's OAuth server login or error pages, triggering quadratic-time parsing that pegs the CPU. This bypasses the earlier fix for CVE-2022-32149 by using underscore separators instead of hyphens. The result: a denial of service that blocks authentication for every user in the cluster.

Affected estate

OpenShift cluster operators running the built-in OAuth server for authentication

How to check

Run 'oc get clusteroperator authentication' and check the oauth-server pod image version. Review the cluster's OAuth route to confirm it's exposed.

Included because

unauthenticated; DoS against authentication; bypass of previous CVE fix; CVSS 7.5; affects shared cluster infrastructure

Action

Update the OAuth server component via the OpenShift update channel. As a stopgap, add a WAF or proxy rule to reject Accept-Language headers with excessive underscore-separated subtags.

Why it matters

An unauthenticated attacker can lock out all cluster users from logging in, which is a full authentication denial of service with no credentials required.

Source

Red Hat / NVD