CVE-2021-36981

CVE-2021-36981 Verinice.Pro 1.22.1에서 신뢰할 수 없는 데이터의 안전하지 않은 Java 역직렬화로 인해 C3P0 가젯을 사용한 원격 코드 실행 발생 인증 필요 PoC 코드로 역직렬화 취약점을 악용합니다. 참조: https://www.secianus.de/worum-geht-es/aktuelle-meldung/cve-2021-36981-verinicepro-unsafe-java-deserialization 및 https://verinice.com/en/support/security-advisory...

cp30_XXE_partial_fix

c3p0 c3p0는 성숙하고 고도의 동시성을 지원하는 JDBC 커넥션 풀링Connection pooling 라이브러리로, PreparedStatement의 캐싱 및 재사용을 지원합니다. LGPL v.2.1 또는 EPL v.1.0 라이선스 중에서 선택할 수 있습니다. c3p0는 이제 github에서 유지관리됩니다. c3p0는 Sonatype의 오픈소스 소프트웨어 저장소에서 관리형 의존성managed dependency으로 제공되며, groupId: com.mchange, artifactId: c3p0 아래에 있습니다. 사용 가능...

c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects

A flaw was found in c3p0, a Java Database Connectivity JDBC Connection pooling library. This vulnerability allows an attacker to achieve arbitrary code execution by providing maliciously crafted Java-serialized objects or javax.naming.Reference instances. By manipulating the userOverridesAsString...

c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects

A flaw was found in c3p0, a Java Database Connectivity JDBC Connection pooling library. This vulnerability allows an attacker to achieve arbitrary code execution by providing maliciously crafted Java-serialized objects or javax.naming.Reference instances. By manipulating the userOverridesAsString...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.19 Update

An update is now available for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability scoring System CVSS base score, which gives a detailed severity rating, ...

RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.3.19 Update (Important) (RHSA-2026:73644)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73644 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release ...

RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.1.16 (RHSA-2026:73976)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73976 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release ...

Astra Linux – Vulnerability in c3p0

C3P0 versions less than 0.9.5.4 may be exploited by a “billion laughs attack” when loading XML configuration, due to the lack of protections against recursive entity expansion during the loading of configuration files...

CLSA-2026-1789372028 TuxCare security update for com.mchange:c3p0 (2 CVEs)

TuxCare rebuilt com.mchange:c3p0 to address 2 CVEs. Fixed in 0.9.5.3-tuxcare.1...

CLSA-2026-1789372000 TuxCare security update for com.mchange:c3p0 (1 CVE)

TuxCare rebuilt com.mchange:c3p0 to address 1 CVE. Fixed in 0.9.2.1-tuxcare.1...

CLSA-2026-1789371869 TuxCare security update for com.mchange:c3p0 (2 CVEs)

TuxCare rebuilt com.mchange:c3p0 to address 2 CVEs. Fixed in 0.9.5.2-tuxcare.1...

CLSA-2026-1788527318 TuxCare security update for com.mchange:c3p0 (1 CVE)

TuxCare rebuilt com.mchange:c3p0 to address 1 CVE. Fixed in 0.9.5.4-tuxcare.3...

Security Bulletin: IBM QRadar SIEM contains components with known vulnerabilities

Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON...

CLSA-2026-1787905903 TuxCare security update for com.mchange:c3p0 (1 CVE)

TuxCare rebuilt com.mchange:c3p0 to address 1 CVE. Fixed in 0.9.5.4-tuxcare.1...

USN-8642-1 c3p0 vulnerabilities

It was discovered that c3p0 was vulnerable to remote code execution via maliciously crafted serialized objects and JNDI references. An attacker could use this to execute arbitrary code, bypass security restrictions, or cause a denial of service...

USN-8642-1: c3p0 vulnerabilities

It was discovered that c3p0 was vulnerable to remote code execution via maliciously crafted serialized objects and JNDI references. An attacker could use this to execute arbitrary code, bypass security restrictions, or cause a denial of service...

c3p0: c3p0: Remote code execution via deserialization vulnerability

A flaw was found in c3p0, a JDBC Connection pooling library. This vulnerability allows a remote attacker to potentially execute arbitrary code by crafting a malicious data source object. When an application deserializes this object and automatically resolves its properties, it can trigger...

CLSA-2026-1786007625 TuxCare security update for com.mchange:c3p0 (1 CVE)

TuxCare rebuilt com.mchange:c3p0 to address 1 CVE. Fixed in 0.9.5.5-tuxcare.3...

CLSA-2026-1784077471 TuxCare security update for com.mchange:c3p0 (1 CVE)

TuxCare rebuilt com.mchange:c3p0 to address 1 CVE. Fixed in 0.9.5.5-tuxcare.1...

The vulnerability of the userOverridesAsString method in the JDBC driver library allows a hacker to execute arbitrary code.

The vulnerability of the userOverridesAsString method in the JDBC driver handling library in c3p0 is related to incorrect code generation management. Exploiting this vulnerability allows an attacker to execute arbitrary code using specially created Java serializable objects and instances of...