remote-code-execution
Safeguard articles tagged "remote-code-execution" — guides, analysis, and best practices for software supply chain and application security.
63 articles
Jenkins Remote Code Execution via Groovy Metaclass (CVE-2...
CVE-2016-0792 let attackers bypass Jenkins' deserialization blacklist using Groovy's metaclass to achieve unauthenticated remote code execution via the CLI.
Nexus Repository Manager 3 Remote Code Execution (CVE-202...
CVE-2020-10199 is a critical Java EL injection flaw in Sonatype Nexus Repository Manager 3 letting authenticated users achieve remote code execution.
CVE-2023-36414: The Azure Identity SDK RCE You Should Patch
CVE-2023-36414 is a remote code execution flaw in the Azure Identity SDK for .NET. Here is how the injection works and which version closes it.
Java Deserialization Vulnerabilities: How Gadget Chains Work and How to Stop Them
Native Java deserialization can turn a single readObject() call into remote code execution. Here's how gadget chains work and how to shut them down.
Log4j Log4Shell vulnerability explained CVE-2021-44228
Log4Shell (CVE-2021-44228) let attackers gain RCE via a single logged string. Here's the CVSS/EPSS/KEV context, timeline, and how to remediate it.
CVE-2023-37466: Remote code execution via vm2 sandbox escape
A critical vm2 sandbox escape (CVE-2023-37466) lets untrusted JavaScript break out to achieve remote code execution on the host Node.js process.
CVE-2017-18342: Arbitrary code execution via PyYAML yaml....
CVE-2017-18342 lets attackers achieve remote code execution via PyYAML's yaml.load(), which deserialized untrusted YAML into live Python objects by default.
CVE-2018-11776: Remote code execution in Apache Struts2 v...
CVE-2018-11776 lets attackers achieve unauthenticated RCE in Apache Struts2 via crafted namespace/OGNL injection. Affected versions, timeline, and fixes.
CVE-2019-0230: OGNL remote code execution in Apache Struts2
CVE-2019-0230 lets attackers chain forced double OGNL evaluation in Struts2 tag attributes into remote code execution. Here's what's affected, the CVSS/EPSS context, and how to remediate it.
CVE-2020-17530: Forced OGNL evaluation RCE in Apache Struts2
CVE-2020-17530 lets attackers achieve unauthenticated RCE in Apache Struts2 via forced OGNL evaluation. Here's the scope, timeline, and how to remediate it.
CVE-2019-0232: Remote code execution in Apache Tomcat CGI...
CVE-2019-0232 lets attackers execute arbitrary commands on Windows-hosted Apache Tomcat via the CGI Servlet. Here's the CVSS 9.8 detail, affected versions, and fixes.
CVE-2022-1471: Remote code execution in SnakeYAML deseria...
CVE-2022-1471 exposes SnakeYAML deserialization to remote code execution. Here is what is affected, CVSS context, and how to remediate the flaw.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.