PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Vulnerabilities in Checkpoint ICA Management Tool

swarm.ptsecurity.com | research | #vulnerability-research | #cve | #command-injection | #checkpoint
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Two flaws in Check Point's ICA Management Tool: an argument injection into the cpca process's sendmail invocation, and a shell command injection in the certificate management interface, plus notes on SSL configuration and exposure risks.
Published
Collected

Related coverage

research · crowdstrike.com
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
The Falcon platform provides out-of-the-box visibility and detection coverage for post-exploitation activities of CVE-2026-109618 and CVE-2026-109619.
research · swarm.ptsecurity.com
Cisco Hyperflex: How We Got RCE Through Login Form and Other Findings
An assessment of Cisco HyperFlex HX that found three vulnerabilities: command injection in the installer VM (CVE-2021-1497, CVSS 9.8) and the data platform (CVE-2021-1498), plus a file upload flaw (CVE-2021-1499) — including RCE reached through the login form.
research · swarm.ptsecurity.com
Swarm of Palo Alto PAN-OS vulnerabilities
Analysis of four Palo Alto PAN-OS firewall vulnerabilities: authenticated command injection (CVE-2020-2037, CVE-2020-2038), unauthenticated denial of service (CVE-2020-2039) and reflected XSS (CVE-2020-2036) — each able to leak data, disrupt components or expose internal segments.
research · portswigger.net
Drag and Pwnd: Leverage ASCII characters to exploit VS Code
Control characters like SOH and carriage return, forwarded blindly by node-pty, enable command injection through VS Code run configurations and filenames dropped into terminals on macOS and Ubuntu.
research · blog.quarkslab.com
State of Post-Quantum Cryptography implementations
In this blogpost, we first review the landscape of Post-Quantum Cryptography implementations across some of the most popular cryptographic libraries. Following that, we present the results of a differential fuzzing campaign on few of the presented implementations.
research · bishopfox.com
Separating Signal from Slop: Triaging CVEs in the Age of AI Security Research
CVE disclosures are up 85% while exploitation barely moved. Bishop Fox breaks down four Nginx CVEs that looked critical but rarely affect real deployments.
Back