Multiple SMTP services are susceptible to spoofing attacks due to insufficient enforcement
Vulnerability Note VU#244112
Original Release Date: 2024-07-30 | Last Revised: 2024-08-02
https://kb.cert.org/vuls/id/244112
Vulnerability Note VU#244112
Original Release Date: 2024-07-30 | Last Revised: 2024-08-02
https://kb.cert.org/vuls/id/244112
kb.cert.org
CERT/CC Vulnerability Note VU#244112
Multiple SMTP services are susceptible to spoofing attacks due to insufficient enforcement
Critical 1Password Vulnerability: Hackers Could Exploit Security Flaw to Access Unlock Keys
https://thecyberexpress.com/critical-1password-vulnerability/
https://thecyberexpress.com/critical-1password-vulnerability/
The Cyber Express
Critical 1Password Vulnerability Targets MacOS Devices
1Password vulnerability CVE-2024-42219 effects macOS users. Update to version 8.10.38 to safeguard against potential theft of vault items and unlock keys.
Múltiples vulnerabilidades en Jenkins
Fecha 08/08/2024
Importancia 5 - Crítica
Recursos Afectados
Jenkins weekly, hasta la versión 2.470 incluida;
Jenkins LTS, hasta la versión 2.452.3 incluida.
Descripción
Varios investigadores han reportado 2 vulnerabilidades, de severidad crítica y media, que afectan al core de Jenkins. La explotación de estas vulnerabilidades podría permitir a un atacante remoto ejecutar código o acceder a información de otros usuarios.
Solución
Jenkins weekly, actualizar a 2.471;
Jenkins LTS, actualizar a 2.452.4 o 2.462.1.
https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-jenkins
Fecha 08/08/2024
Importancia 5 - Crítica
Recursos Afectados
Jenkins weekly, hasta la versión 2.470 incluida;
Jenkins LTS, hasta la versión 2.452.3 incluida.
Descripción
Varios investigadores han reportado 2 vulnerabilidades, de severidad crítica y media, que afectan al core de Jenkins. La explotación de estas vulnerabilidades podría permitir a un atacante remoto ejecutar código o acceder a información de otros usuarios.
Solución
Jenkins weekly, actualizar a 2.471;
Jenkins LTS, actualizar a 2.452.4 o 2.462.1.
https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-jenkins
www.incibe.es
Múltiples vulnerabilidades en Jenkins
Varios investigadores han reportado 2 vulnerabilidades, de severidad crítica y media, que afectan al
Vulnerabilidades críticas 0day en teléfonos IP Cisco SPA300 y SPA500
Fecha 08/08/2024
Importancia 5 - Crítica
Recursos Afectados
Todas las versiones de software que se ejecutan en los teléfonos IP de la serie Cisco Small Business:
SPA300;
SPA500.
Descripción
Se han detectado múltiples vulnerabilidades críticas 0day en la interfaz de usuario web de teléfonos IP de Cisco Small Business. Estas vulnerabilidades podrían permitir a un ciberdelincuente ejecutar comandos arbitrarios en el sistema operativo del dispositivo o provocar una condición de denegación de servicio (DoS).
Solución
Por el momento, Cisco no ha lanzado actualizaciones de software que solucionen estas vulnerabilidades. Tampoco, existen soluciones alternativas para abordar las vulnerabilidades, por lo que se recomienda a las empresas que utilicen los productos afectados, considerar la migración a dispositivos más recientes y con soporte activo.
Los ataques de denegación de servicio (DoS) buscan sobrecargar un sistema o red para interrumpir su funcionamiento, haciéndolos inaccesibles para los usuarios. Recuerda que los dispositivos móviles, tanto los empresariales como los personales que se utilizan en el ámbito laboral (BYOD), también deben de estar protegidos para evitar ciberataques.
https://www.incibe.es/empresas/avisos/vulnerabilidades-criticas-0day-en-telefonos-ip-cisco-spa300-y-spa500
Fecha 08/08/2024
Importancia 5 - Crítica
Recursos Afectados
Todas las versiones de software que se ejecutan en los teléfonos IP de la serie Cisco Small Business:
SPA300;
SPA500.
Descripción
Se han detectado múltiples vulnerabilidades críticas 0day en la interfaz de usuario web de teléfonos IP de Cisco Small Business. Estas vulnerabilidades podrían permitir a un ciberdelincuente ejecutar comandos arbitrarios en el sistema operativo del dispositivo o provocar una condición de denegación de servicio (DoS).
Solución
Por el momento, Cisco no ha lanzado actualizaciones de software que solucionen estas vulnerabilidades. Tampoco, existen soluciones alternativas para abordar las vulnerabilidades, por lo que se recomienda a las empresas que utilicen los productos afectados, considerar la migración a dispositivos más recientes y con soporte activo.
Los ataques de denegación de servicio (DoS) buscan sobrecargar un sistema o red para interrumpir su funcionamiento, haciéndolos inaccesibles para los usuarios. Recuerda que los dispositivos móviles, tanto los empresariales como los personales que se utilizan en el ámbito laboral (BYOD), también deben de estar protegidos para evitar ciberataques.
https://www.incibe.es/empresas/avisos/vulnerabilidades-criticas-0day-en-telefonos-ip-cisco-spa300-y-spa500
www.incibe.es
Vulnerabilidades críticas 0day en teléfonos IP Cisco SPA300 y SPA500
Se han detectado múltiples vulnerabilidades críticas 0day en la interfaz de usuario web de teléfonos I
Chained for attack: OpenVPN vulnerabilities discovered leading to RCE and LPE
Microsoft researchers recently identified multiple medium severity vulnerabilities in OpenVPN, an open-source project with binaries integrated into routers, firmware, PCs, mobile devices, and many other smart devices worldwide, numbering in the millions. Attackers could chain and remotely exploit some of the discovered vulnerabilities to achieve an attack chain consisting of remote code execution (RCE) and local privilege escalation (LPE).
https://www.microsoft.com/en-us/security/blog/2024/08/08/chained-for-attack-openvpn-vulnerabilities-discovered-leading-to-rce-and-lpe/
Microsoft researchers recently identified multiple medium severity vulnerabilities in OpenVPN, an open-source project with binaries integrated into routers, firmware, PCs, mobile devices, and many other smart devices worldwide, numbering in the millions. Attackers could chain and remotely exploit some of the discovered vulnerabilities to achieve an attack chain consisting of remote code execution (RCE) and local privilege escalation (LPE).
https://www.microsoft.com/en-us/security/blog/2024/08/08/chained-for-attack-openvpn-vulnerabilities-discovered-leading-to-rce-and-lpe/
Microsoft News
Chained for attack: OpenVPN vulnerabilities discovered leading to RCE and LPE
Microsoft researchers found multiple vulnerabilities in OpenVPN that could lead to an attack chain allowing remote code execution and local privilege escalation. This attack chain could enable attackers to gain full control over targeted endpoints, potentially…
Microsoft Releases August 2024 Security Updates
https://msrc.microsoft.com/update-guide/releaseNote/2024-Aug
https://msrc.microsoft.com/update-guide/releaseNote/2024-Aug
Ivanti Releases Security Updates for Avalanche, Neurons for ITSM, and Virtual Traffic Manager
Release DateAugust 13, 2024
Ivanti released security updates to address multiple vulnerabilities in Ivanti Avalanche, Neurons for ITSM, and Virtual Traffic Manager (vTM). A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. Ivanti advises users to reduce their attack surface and follow industry best practices by adhering to Ivanti’s network configuration guidance to restrict access to the management interface.
CISA encourages users and administrators to review the following Ivanti advisories and apply the necessary guidance and updates:
Security Advisory: Ivanti Avalanche
Security Advisory: Ivanti Neurons for ITSM
Security Advisory: Ivanti Virtual Traffic Manager (vTM)
https://www.cisa.gov/news-events/alerts/2024/08/13/ivanti-releases-security-updates-avalanche-neurons-itsm-and-virtual-traffic-manager
Release DateAugust 13, 2024
Ivanti released security updates to address multiple vulnerabilities in Ivanti Avalanche, Neurons for ITSM, and Virtual Traffic Manager (vTM). A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. Ivanti advises users to reduce their attack surface and follow industry best practices by adhering to Ivanti’s network configuration guidance to restrict access to the management interface.
CISA encourages users and administrators to review the following Ivanti advisories and apply the necessary guidance and updates:
Security Advisory: Ivanti Avalanche
Security Advisory: Ivanti Neurons for ITSM
Security Advisory: Ivanti Virtual Traffic Manager (vTM)
https://www.cisa.gov/news-events/alerts/2024/08/13/ivanti-releases-security-updates-avalanche-neurons-itsm-and-virtual-traffic-manager
Adobe Releases Security Updates for Multiple Products
Release DateAugust 14, 2024
Adobe released security updates to address multiple vulnerabilities in Adobe software. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system.
https://www.cisa.gov/news-events/alerts/2024/08/14/adobe-releases-security-updates-multiple-products
Release DateAugust 14, 2024
Adobe released security updates to address multiple vulnerabilities in Adobe software. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system.
https://www.cisa.gov/news-events/alerts/2024/08/14/adobe-releases-security-updates-multiple-products
Windows TCP/IP Remote Code Execution Vulnerability
CVE-2024-38063
Security Vulnerability
Released: Aug 13, 2024
CVSS Source: Microsoft
CVSS:3.1 9.8 / 8.5
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38063
https://www.bleepingcomputer.com/news/microsoft/zero-click-windows-tcp-ip-rce-impacts-all-systems-with-ipv6-enabled-patch-now/
CVE-2024-38063
Security Vulnerability
Released: Aug 13, 2024
CVSS Source: Microsoft
CVSS:3.1 9.8 / 8.5
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38063
https://www.bleepingcomputer.com/news/microsoft/zero-click-windows-tcp-ip-rce-impacts-all-systems-with-ipv6-enabled-patch-now/
FreeBSD Project maintainers addressed a high-severity flaw in OpenSSH that could allow remote code execution with elevated privileges.
The maintainers of the FreeBSD Project have released urgent security updates to address a high-severity flaw, tracked as CVE-2024-7589, (CVSS score of 7.4) in OpenSSH. A remote attacker could exploit the vulnerability to execute arbitrary code with elevated privileges.
OpenSSH is an implementation of the SSH protocol suite that offers encrypted and authenticated transport for various services, including remote shell access.
https://securityaffairs.com/166941/security/freebsd-openssh-flaw.html
The maintainers of the FreeBSD Project have released urgent security updates to address a high-severity flaw, tracked as CVE-2024-7589, (CVSS score of 7.4) in OpenSSH. A remote attacker could exploit the vulnerability to execute arbitrary code with elevated privileges.
OpenSSH is an implementation of the SSH protocol suite that offers encrypted and authenticated transport for various services, including remote shell access.
https://securityaffairs.com/166941/security/freebsd-openssh-flaw.html
Security Affairs
A FreeBSD flaw could allow remote code execution, patch it now!
FreeBSD Project maintainers addressed a high-severity flaw in OpenSSH that could allow remote code execution with elevated privileges.
Industrial Remote Access Tool Ewon Cosy+ Vulnerable to Root Access Attacks
Security vulnerabilities have been disclosed in the industrial remote access solution Ewon Cosy+ that could be abused to gain root privileges to the devices and stage follow-on attacks.
https://thehackernews.com/2024/08/industrial-remote-access-tool-ewon-cosy.html
Security vulnerabilities have been disclosed in the industrial remote access solution Ewon Cosy+ that could be abused to gain root privileges to the devices and stage follow-on attacks.
https://thehackernews.com/2024/08/industrial-remote-access-tool-ewon-cosy.html
A PoC exploit code is available for critical Ivanti vTM bug
Ivanti warned of a critical authentication bypass flaw in its Virtual Traffic Manager (vTM) appliances that can allow attackers to create rogue administrator accounts.
Ivanti addressed a critical authentication bypass vulnerability, tracked as CVE-2024-7593 (CVSS score of 9.8), impacting Virtual Traffic Manager (vTM) appliances that can allow attackers to create rogue administrator accounts.
https://securityaffairs.com/166991/hacking/ivanti-virtual-traffic-manager-flaw.html
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593
Ivanti warned of a critical authentication bypass flaw in its Virtual Traffic Manager (vTM) appliances that can allow attackers to create rogue administrator accounts.
Ivanti addressed a critical authentication bypass vulnerability, tracked as CVE-2024-7593 (CVSS score of 9.8), impacting Virtual Traffic Manager (vTM) appliances that can allow attackers to create rogue administrator accounts.
https://securityaffairs.com/166991/hacking/ivanti-virtual-traffic-manager-flaw.html
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593
Security Affairs
A PoC exploit code is available for critical Ivanti vTM bug
Ivanti warned of a critical auth bypass bug in its Virtual Traffic Manager appliances that can allow attackers to create rogue admin accounts
Remote code execution within ping script (CVE-2024-22116)
CVSS score 9.9
Resolution Fixed
Remote code execution within ping script
Description
An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereby compromising infrastructure.
https://support.zabbix.com/plugins/servlet/mobile#issue/ZBX-25016
CVSS score 9.9
Resolution Fixed
Remote code execution within ping script
Description
An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereby compromising infrastructure.
https://support.zabbix.com/plugins/servlet/mobile#issue/ZBX-25016
Ejecución de código remoto en Web Help Desk de SolarWinds
Fecha 16/08/2024
Importancia 5 - Crítica
Recursos Afectados
Web Help Desk: versiones 12.4, 12.5, 12.6, 12.7 y 12.8.
Descripción
SolarWinds ha publicado un parche para corregir una vulnerabilidad crítica que afectaría a Web Help Desk.
SolarWinds agradece a Inmarsat Government y Viasat su ayuda en esta vulnerabilidad.
https://www.incibe.es/incibe-cert/alerta-temprana/avisos/ejecucion-de-codigo-remoto-en-web-help-desk-de-solarwinds
Fecha 16/08/2024
Importancia 5 - Crítica
Recursos Afectados
Web Help Desk: versiones 12.4, 12.5, 12.6, 12.7 y 12.8.
Descripción
SolarWinds ha publicado un parche para corregir una vulnerabilidad crítica que afectaría a Web Help Desk.
SolarWinds agradece a Inmarsat Government y Viasat su ayuda en esta vulnerabilidad.
https://www.incibe.es/incibe-cert/alerta-temprana/avisos/ejecucion-de-codigo-remoto-en-web-help-desk-de-solarwinds
www.incibe.es
Ejecución de código remoto en Web Help Desk de SolarWinds
SolarWinds ha publicado un parche para corregir una vulnerabilidad crítica que afectaría a Web Help De
WHD 12.8.3 Hotfix 1
All versions of Web Help Desk (WHD) should be upgraded to WHD 12.8.3, and then the hotfix should be installed.
Aug 16, 2024•Success Center
First Published Date
8/13/2024 10:12 PM
Last Published Date
8/16/2024 8:30 PM
Overview
For your protection and to quickly deliver SolarWinds customers a secure version of WHD, we applied an aggressive security patch in WHD 12.8.3 Hotfix 1 on August 13, 2024. In a few cases, this approach impacted product functionality such as SSO. See the known issues for WHD 12.8.3 Hotfix 1.
https://support.solarwinds.com/SuccessCenter/s/article/WHD-12-8-3-Hotfix-1
All versions of Web Help Desk (WHD) should be upgraded to WHD 12.8.3, and then the hotfix should be installed.
Aug 16, 2024•Success Center
First Published Date
8/13/2024 10:12 PM
Last Published Date
8/16/2024 8:30 PM
Overview
For your protection and to quickly deliver SolarWinds customers a secure version of WHD, we applied an aggressive security patch in WHD 12.8.3 Hotfix 1 on August 13, 2024. In a few cases, this approach impacted product functionality such as SSO. See the known issues for WHD 12.8.3 Hotfix 1.
https://support.solarwinds.com/SuccessCenter/s/article/WHD-12-8-3-Hotfix-1
Solarwinds
WHD 12.8.3 Hotfix 1
All versions of Web Help Desk (WHD) should be upgraded to WHD 12.8.3, and then the hotfix should be installed.
Múltiples vulnerabilidades en Moodle
Fecha 20/08/2024
Importancia 5 - Crítica
Recursos Afectados
Versiones anteriores que no reciban soporte actualmente y, además:
Versiones 4.4 a 4.4.1;
Versiones 4.3 a 4.3.5;
Versiones 4.2 a 4.2.8;
Versiones 4.1 a 4.1.11.
Descripción
Moodle ha publicado correcciones para 16 vulnerabilidades, 8 de ellas críticas. Su explotación podría permitir ejecución de código remoto, acceso a la información e inyección de código, entre otros.
Dichas vulnerabilidades fueron reportadas por los investigadores: RedTeam Pentesting GmbH, TaiYou, Andrew Lyons, Paul Holden y TeHoFu.
https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-moodle-5
Fecha 20/08/2024
Importancia 5 - Crítica
Recursos Afectados
Versiones anteriores que no reciban soporte actualmente y, además:
Versiones 4.4 a 4.4.1;
Versiones 4.3 a 4.3.5;
Versiones 4.2 a 4.2.8;
Versiones 4.1 a 4.1.11.
Descripción
Moodle ha publicado correcciones para 16 vulnerabilidades, 8 de ellas críticas. Su explotación podría permitir ejecución de código remoto, acceso a la información e inyección de código, entre otros.
Dichas vulnerabilidades fueron reportadas por los investigadores: RedTeam Pentesting GmbH, TaiYou, Andrew Lyons, Paul Holden y TeHoFu.
https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-moodle-5
www.incibe.es
Múltiples vulnerabilidades en Moodle
Moodle ha publicado correcciones para 16 vulnerabilidades, 8 de ellas críticas.
Control de acceso inadecuado en SonicOS de SonicWall
Fecha 26/08/2024
Importancia 5 - Crítica
Recursos Afectados
SOHO (5.ª generación): 5.9.2.14-12o y versiones anteriores.
Gen6 Firewalls (SOHOW, TZ 300, TZ 300W, TZ 400, TZ 400W, TZ 500, TZ 500W, TZ 600, NSA 2650, NSA 3600, NSA 3650, NSA 4600, NSA 4650, NSA 5600, NSA 5650, NSA 6600, NSA 6650, SM 9200, SM 9250, modelos: SM 9400, SM 9450, SM 9600, SM 9650, TZ 300P, TZ 600P, SOHO 250, SOHO 250W, TZ 350, TZ 350W): 6.5.4.14-109n y versiones anteriores.
Gen7 Firewalls: TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P, TZ670, NSa 2700, NSa 3700, NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700: versión de compilación de SonicOS 7.0.1-5035 y versiones anteriores.
Descripción
SonicWall ha publicado una vulnerabilidad podría provocar un acceso no autorizado a recursos y, en condiciones específicas, provocar el bloqueo del firewall.
https://www.incibe.es/incibe-cert/alerta-temprana/avisos/control-de-acceso-inadecuado-en-sonicos-de-sonicwall
Fecha 26/08/2024
Importancia 5 - Crítica
Recursos Afectados
SOHO (5.ª generación): 5.9.2.14-12o y versiones anteriores.
Gen6 Firewalls (SOHOW, TZ 300, TZ 300W, TZ 400, TZ 400W, TZ 500, TZ 500W, TZ 600, NSA 2650, NSA 3600, NSA 3650, NSA 4600, NSA 4650, NSA 5600, NSA 5650, NSA 6600, NSA 6650, SM 9200, SM 9250, modelos: SM 9400, SM 9450, SM 9600, SM 9650, TZ 300P, TZ 600P, SOHO 250, SOHO 250W, TZ 350, TZ 350W): 6.5.4.14-109n y versiones anteriores.
Gen7 Firewalls: TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P, TZ670, NSa 2700, NSa 3700, NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700: versión de compilación de SonicOS 7.0.1-5035 y versiones anteriores.
Descripción
SonicWall ha publicado una vulnerabilidad podría provocar un acceso no autorizado a recursos y, en condiciones específicas, provocar el bloqueo del firewall.
https://www.incibe.es/incibe-cert/alerta-temprana/avisos/control-de-acceso-inadecuado-en-sonicos-de-sonicwall
www.incibe.es
Control de acceso inadecuado en SonicOS de SonicWall
SonicWall ha publicado una vulnerabilidad podría provocar un acceso no autorizado a recursos y, en con
VMSA-2024-0018:VMware Fusion update addresses a code execution vulnerability (CVE-2024-38811)
Advisory ID: VMSA-2024-0018
Advisory Severity: Important
CVSSv3 Range: 8.8
Synopsis: VMware Fusion update addresses a code-execution vulnerability (CVE-2024-38811)
Issue date: 2024-09-03
CVE(s): CVE-2024-38811
Impacted Products
VMware Fusion
Introduction
A code-execution vulnerability in VMware Fusion was responsibly reported to VMware. Updates are available to remediate this vulnerability in the affected VMware product.
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24939
Advisory ID: VMSA-2024-0018
Advisory Severity: Important
CVSSv3 Range: 8.8
Synopsis: VMware Fusion update addresses a code-execution vulnerability (CVE-2024-38811)
Issue date: 2024-09-03
CVE(s): CVE-2024-38811
Impacted Products
VMware Fusion
Introduction
A code-execution vulnerability in VMware Fusion was responsibly reported to VMware. Updates are available to remediate this vulnerability in the affected VMware product.
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24939
D-Link says it is not fixing four RCE flaws in DIR-846W routers
D-Link is warning that four remote code execution (RCE) flaws impacting all hardware and firmware versions of its DIR-846W router will not be fixed as the products are no longer supported.
https://www.bleepingcomputer.com/news/security/d-link-says-it-is-not-fixing-four-rce-flaws-in-dir-846w-routers/
D-Link is warning that four remote code execution (RCE) flaws impacting all hardware and firmware versions of its DIR-846W router will not be fixed as the products are no longer supported.
https://www.bleepingcomputer.com/news/security/d-link-says-it-is-not-fixing-four-rce-flaws-in-dir-846w-routers/
BleepingComputer
D-Link says it is not fixing four RCE flaws in DIR-846W routers
D-Link is warning that four remote code execution (RCE) flaws impacting all hardware and firmware versions of its DIR-846W router will not be fixed as the products are no longer supported.
Apache fixes critical OFBiz remote code execution vulnerability
Apache has fixed a critical security vulnerability in its open-source OFBiz (Open For Business) software, which could allow attackers to execute arbitrary code on vulnerable Linux and Windows servers.
https://www.bleepingcomputer.com/news/security/apache-fixes-critical-ofbiz-remote-code-execution-vulnerability/
Apache has fixed a critical security vulnerability in its open-source OFBiz (Open For Business) software, which could allow attackers to execute arbitrary code on vulnerable Linux and Windows servers.
https://www.bleepingcomputer.com/news/security/apache-fixes-critical-ofbiz-remote-code-execution-vulnerability/
BleepingComputer
Apache fixes critical OFBiz remote code execution vulnerability
Apache has fixed a critical security vulnerability in its open-source OFBiz (Open For Business) software, which could allow attackers to execute arbitrary code on vulnerable Linux and Windows servers.