Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Juniper SSLVPN / JunOS RCE and Multiple Vulnerabilities

pwn.ai | vulnerability | #rce | #xss | #deserialization | #juniper | #cve-2022-22241 | #cve-2022-22242

Summary

Octagon Networks details two Juniper pre-auth bugs: CVE-2022-22241, a Phar deserialization chain in J-Web leading to RCE, and CVE-2022-22242, a reflected XSS on the error page.
Published
Collected

original ↗

Related coverage

vulnerability · bishopfox.com
Master Key Included: Detecting SolarWinds ARM CVE-2026-28326
CVE-2026-28326 is an unauthenticated RCE in SolarWinds ARM where a hardcoded shared secret on TCP 55555 leads to SYSTEM-level code execution. Patch now.
vulnerability · idnsec.com
[CVE-2026-93485] Comment2XSS: Zero-Click Pre-Auth XSS to Potential RCE in WordPress Core
An unauthenticated stored XSS (CVE-2026-93485) in WordPress core's wpautop() turns crafted comments into zero-click XSS, escalating to RCE via the admin session. Fixed in 7.1.1, backported to 4.7.36.
tool · github.com
Comment2Shell: Zero-Click Pre-Auth RCE Exploit Kit for WordPress (CVE-2026-93485)
Affects all WordPress installations from version 4.7.0 through 7.1.0 without requiring credentials or interaction beyond opening a post. Administrators should verify upgrading to 7.1.1 or backported releases, and monitor server logs for suspicious comment payloads and unexpected plugin uploads.
vulnerability · portswigger.net
Pre-auth RCE in ForgeRock OpenAM (CVE-2021-35464)
A pre-auth RCE in ForgeRock OpenAM via unsafe deserialization in its Jato framework: the jato.pageSession parameter accepted Java objects exploitable with a custom ysoserial chain (CVE-2021-35464).
vulnerability · bishopfox.com
CVE-2019-18935: Remote Code Execution via Insecure Deserialization in Telerik UI
Caleb Gross details CVE-2019-18935: insecure JSON deserialization in Telerik UI for ASP.NET AJAX yields remote code execution; includes the CVE-2017-11317 upload chain and patching.
vulnerability · bishopfox.com
OpenMRS - Insecure Object Deserialization
Critical insecure object deserialization in OpenMRS (CVE-2018-19276) lets unauthenticated attackers run commands via the REST API, risking massive healthcare data exposure.
back