Cpe:2.3:a:heyewei:jfinalcms:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aheyeweijfinalcms/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 25 Aug 2026 09:59:33 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgArbitrary Code Execution Vulnerability in RPM Package Managerhttps://feed.craftedsignal.io/briefs/2026-08-rpm-vulnerability/Tue, 25 Aug 2026 09:59:33 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-rpm-vulnerability/A local vulnerability in the RPM package management utility allows an attacker to execute arbitrary code with the privileges of the user executing the command.The BSI has reported a vulnerability in the RPM (RPM Package Manager) utility that allows a local attacker to execute arbitrary code. The flaw, identified as CVE-2024-8782, is triggered when an attacker influences the package installation or query process, leading to the execution of attacker-controlled code under the context of the user running the RPM command. This vulnerability poses a risk to Linux systems where users with local access, or automated scripts, perform package operations on untrusted or manipulated package files. Defenders should prioritize updating RPM packages to the latest vendor-supplied versions to mitigate this local escalation path.

Impact

Successful exploitation allows a local attacker to gain the execution privileges of the current user, potentially leading to unauthorized system changes, data exfiltration, or further privilege escalation if the RPM command is executed by privileged accounts or as root.

Recommendation

  • Identify all Linux systems utilizing RPM for package management.
  • Apply the latest security patches for the RPM utility provided by the respective Linux distribution vendor to resolve CVE-2024-8782.
  • Audit scripts and CI/CD pipelines that automate RPM package installations for potential exposure to untrusted input.
]]>lowadvisoryvulnerabilitylinuxcode-execution