PT-2014-7888

Name of the Vulnerable Software and Affected Versions SpagoBI version 5.0.0 Description The issue concerns the accessibility engine in SpagoBI, where the default configuration does not set FEATURE SECURE PROCESSING. This allows remote authenticated users to execute arbitrary Java code via a craft...

CVE-2013-6469

JBoss Overlord Run Time Governance RTGov 1.0 for JBossAS allows remote authenticated users to execute arbitrary Java code via an MVFLEX Expression Language MVEL expression. NOTE: some of these details are obtained from third party information...

CVE-2014-0111

Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource mappings."...

PT-2014-3482

Name of the Vulnerable Software and Affected Versions Apache Syncope versions 1.0.0 through 1.0.8 Apache Syncope versions 1.1.0 through 1.1.6 Description The issue allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, derived schema...

CVE-2013-6468

JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a 1 MVFLEX Expression Language MVEL or 2 Drools expression...

PT-2014-3130

Name of the Vulnerable Software and Affected Versions Red Hat JBoss BRMS versions prior to 6.0.1 Red Hat JBoss BPM Suite versions prior to 6.0.1 JBoss Drools affected versions not specified Description The issue allows remote authenticated users to execute arbitrary Java code. This can be achieve...

CVE-2013-6468: Improper Control of Generation of Code

JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a 1 MVFLEX Expression Language MVEL or 2 Drools expression...

PT-2014-4374

Name of the Vulnerable Software and Affected Versions Android versions prior to 4.4 Description The issue allows attackers to execute arbitrary Java code by leveraging access to the searchBoxJavaBridge interface at certain Android API levels. This is due to the use of the addJavascriptInterface A...

CVE-2014-1939: Improper Control of Generation of Code

java/android/webkit/BrowserFrame.java in Android before 4.4 uses the addJavascriptInterface API in conjunction with creating an object of the SearchBoxImpl class, which allows attackers to execute arbitrary Java code by leveraging access to the searchBoxJavaBridge interface at certain Android API...

Code injection

The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file...

PT-2014-4010

Name of the Vulnerable Software and Affected Versions SoapUI versions prior to 4.6.4 Description The issue concerns the WSDL/WADL import functionality, which allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file. Recommendations For versions prior t...

CVE-2013-4271: Deserialization of Untrusted Data

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources, which allows remote attackers to execute arbitrary Java code via a serialized object, a different vulnerability than CVE-2013-4221...

PT-2013-1363

Name of the Vulnerable Software and Affected Versions McAfee Web Reporter Premium affected versions not specified Description The issue exists due to insufficient access restrictions to the invoker/EJBInvokerServlet and invoker/JMXInvokerServlet servlets. This allows a remote attacker to execute...

CVE-2013-2035

Race condition in hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java in HawtJNI before 1.8, when a custom library path is not specified, allows local users to execute arbitrary Java code by overwriting a temporary JAR file with a predictable name in /tmp...

CVE-2013-2035

Race condition in hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java in HawtJNI before 1.8, when a custom library path is not specified, allows local users to execute arbitrary Java code by overwriting a temporary JAR file with a predictable name in /tmp...

PT-2013-3515

Name of the Vulnerable Software and Affected Versions HawtJNI versions prior to 1.8 Description A race condition exists in the HawtJNI library, specifically in the Library.java file. This issue allows local users to execute arbitrary Java code by overwriting a temporary JAR file with a predictabl...

CVE-2013-2035: Improper Control of Generation of Code

Race condition in hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java in HawtJNI before 1.8, when a custom library path is not specified, allows local users to execute arbitrary Java code by overwriting a temporary JAR file with a predictable name in /tmp...

Openfire Admin Console Authentication Bypass

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' require 'rex/zip' class Metasploit3...

CVE-2012-1826: Undefined Security Weakness

dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted 1 XSLT or 2 Velocity template...

PT-2012-3571

Name of the Vulnerable Software and Affected Versions dotCMS versions 1.9 through 1.9.5.1 Description The issue allows remote authenticated users to execute arbitrary Java code via crafted templates, specifically 1 XSLT or 2 Velocity templates. Recommendations For dotCMS versions 1.9 through...