Code injection

The project import functionality in SoapUI 5.3.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL project file...

PT-2018-6303

Name of the Vulnerable Software and Affected Versions: SoapUI version 5.3.0 Description: The issue allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL project file. Recommendations: For SoapUI version 5.3.0, consider restricting access to the project...

CVE-2017-16670: Improper Control of Generation of Code

The project import functionality in SoapUI 5.3.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL project file...

CVE-2017-8046

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 Ingalls SR9, versions prior to 3.0.1 Kay SR1 and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code...

CVE-2017-8046

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 Ingalls SR9, versions prior to 3.0.1 Kay SR1 and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code...

CVE-2017-8046

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 Ingalls SR9, versions prior to 3.0.1 Kay SR1 and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code...

CVE-2017-8046: Improper Input Validation

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 Ingalls SR9, versions prior to 3.0.1 Kay SR1 and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code...

Code injection

Bamboo 2.2 before 5.8.5 and 5.9.x before 5.9.7 allows remote attackers with access to the Bamboo web interface to execute arbitrary Java code via an unspecified resource...

CVE-2015-6576

Bamboo 2.2 before 5.8.5 and 5.9.x before 5.9.7 allows remote attackers with access to the Bamboo web interface to execute arbitrary Java code via an unspecified resource...

CVE-2015-6576

Bamboo 2.2 before 5.8.5 and 5.9.x before 5.9.7 allows remote attackers with access to the Bamboo web interface to execute arbitrary Java code via an unspecified resource...

PT-2017-7037

Name of the Vulnerable Software and Affected Versions Bamboo versions 2.2 through 5.8.4 Bamboo versions 5.9.x through 5.9.6 Description The issue allows remote attackers with access to the Bamboo web interface to execute arbitrary Java code. Recommendations For versions 2.2 through 5.8.4, update ...

Pivotal Spring Data REST Remote Code Execution Vulnerability

Spring Data REST is part of the Spring Data project and enables building hypermedia-driven REST web services on top of the Spring Data repository. A remote code execution vulnerability exists in Pivotal Spring Data REST, which allows an attacker to perform a remote code execution attack by...

PT-2017-9776

Name of the Vulnerable Software and Affected Versions Apache Brooklyn versions prior to 0.10.0 Description The issue allows an authenticated user to cause the JVM running Apache Brooklyn to load and run Java code without detection. This could provide access to privileges of the Java process,...

CVE-2015-0249

The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language aka VTL...

CVE-2015-0249: Improper Control of Generation of Code

The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language aka VTL...

CVE-2015-0249

The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language aka VTL...

PT-2017-6442

Name of the Vulnerable Software and Affected Versions Apache Roller versions 5.1 through 5.1.1 Description The issue allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language VTL in the weblog page template...

Rogue Wave JViews Arbitrary Java Code Vulnerability

Rogue Wave JViews is the United States Rogue Wave Software, Inc. of a set of high-performance interactive high-level graphical display for building desktop and Web applications, a set of graphical tools. A security vulnerability exists in Rogue Wave JViews. A remote attacker could exploit the...

Code injection

Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that exists in the classpath, such as test code or administration code. The issue exists because the ilog.views.faces.IlvFacesController servlet in jviews-framework-all.jar does not...

Code injection

IBM Websphere MQ JMS 7.0.1, 7.1, 7.5, 8.0, and 9.0 client provides classes that deserialize objects from untrusted sources which could allow a malicious user to execute arbitrary Java code by adding vulnerable classes to the classpath. IBM Reference : 1983457...