groovy:groovy-all (>=1.1-beta-1, <=1.1-beta-2), net.sf.gnasher:gnasher (0.2) +25 more potentially affected by CVE-2014-3004 via castor:castor (0.9.9)

castor:castor MAVEN version 0.9.9 is affected by a known vulnerability. The following packages have a transitive dependency on castor:castor and may be impacted: - groovy:groovy-all =1.1-beta-1, =1.0-beta-1, =1.0-beta-1, =1.0-beta-1, =1.0-beta-1, =1.0-beta-1, =1.0-beta-1, =1.0-beta-1, =1.0-beta-1...

Improper Restriction of XML External Entity Reference in Castor

The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity XXE attacks via a crafted XML document...

Mageia: Security Advisory (MGASA-2014-0556)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

marshalsec

This repository is an offensive tool for Java deserialization exploitation. It is a Java-based tool that exploits Java object deserialization vulnerabilities, which can lead to remote code execution RCE and other security issues. The tool includes payload generators for various Java marshalling...

Security Bulletin: Security vulnerabilitiy has been fixed in IBM Security Identity Manager (93519)

Summary Security vulnerability has been fixed in IBM Security Identity Manager Vulnerability Details Third Party Entry: 93519 DESCRIPTION: Castor Library could allow a remote attacker to obtain sensitive information, caused by an XML External Entity Injection XXE error when processing XML data. B...

Security Bulletin: Castor Vulnerability Affects IBM Control Center (CVE-2014-3004)

Summary Castor Library could allow a remote attacker to obtain sensitive information, caused by an XML External Entity Injection XXE error when processing XML data. Vulnerability Details CVEID: CVE-2014-3004 DESCRIPTION: Castor Library could allow a remote attacker to obtain sensitive information...

marshalsec

This is a Java-based tool for exploiting Java object deserialization vulnerabilities, specifically targeting BlazeDS AMF Action Message Format versions 0, 3, and X. The tool, named "marshalsec," is designed to test and demonstrate the exploitation of these vulnerabilities, which can lead to remot...

marshalsec

This is a Java-based tool called "marshalsec" that exploits Java object deserialization vulnerabilities in various marshalling libraries. The tool is designed to test and demonstrate the exploitation of these vulnerabilities, which can lead to remote code execution RCE and other security issues...

marshalsec

This repository is an offensive tool for Java deserialization exploitation. It is a Java-based tool for exploiting Java object deserialization vulnerabilities, which can lead to remote code execution RCE and other security issues. The tool includes various payload generators for different Java...

Castor XML Disclosure

The vulnerability of the Castor XML software component for Cisco WebEx Meetings Server relates to errors in restricting XML references to external objects. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...

Cisco WebEx Meetings Server XML Injection

I. VULNERABILITY ------------------------- Cisco WebEx Meetings Server XML External Entity II. CVE REFERENCE ------------------------- CVE-2018-18895 III. VENDOR ------------------------- http://cisco.com IV. TIMELINE ------------------------ 18/09/2018 Vulnerability discovered 19/09/2018 Vendor...

Camel-castor component in Apache Camel is vulnerable to Java object de-serialisation

The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws...

GHSA-VF4Q-8MR7-5C5C Camel-castor component in Apache Camel is vulnerable to Java object de-serialisation

The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws...

org.apache.camel:camel-castor-starter (2.20.0) potentially affected by CVE-2017-12634 via org.apache.camel:camel-castor (2.20.0)

org.apache.camel:camel-castor MAVEN version 2.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-castor and may be impacted: - org.apache.camel:camel-castor-starter 2.20.0 Source cves: CVE-2017-12634 Source advisory:...

org.apache.camel:camel-castor-starter (>=2.18.0, <=2.19.3) potentially affected by CVE-2017-12634 via org.apache.camel:camel-castor (>=2.18.0, <=2.19.3)

org.apache.camel:camel-castor MAVEN version =2.18.0, =2.18.0, =2.19.3 Source cves: CVE-2017-12634 Source advisory: GHSA-VF4Q-8MR7-5C5C...

org.apache.camel:camel-castor-starter (2.20.0) potentially affected by CVE-2017-12634 via org.apache.camel:camel-castor (2.20.0)

org.apache.camel:camel-castor MAVEN version 2.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-castor and may be impacted: - org.apache.camel:camel-castor-starter 2.20.0 Source cves: CVE-2017-12634 Source advisory:...

org.apache.camel:camel-castor-starter (>=2.18.0, <=2.19.3) potentially affected by CVE-2017-12634 via org.apache.camel:camel-castor (>=2.18.0, <=2.19.3)

org.apache.camel:camel-castor MAVEN version =2.18.0, =2.18.0, =2.19.3 Source cves: CVE-2017-12634 Source advisory: OSV:GHSA-VF4Q-8MR7-5C5C...

PT-2018-1978

Name of the Vulnerable Software and Affected Versions Cisco WebEx Meetings Server affected versions not specified Description The issue is related to errors in restricting XML external entity references in the Castor XML component of the Cisco WebEx Meetings Server software. This could allow a...

Security Bulletin: Vulnerability in Castor library affects IBM Cúram(CVE-2014-3004)

Summary IBM Cúram is shipped with a third party library called Castor, which is vulnerable to an XML External Entity Injection XXE error. Vulnerability Details CVEID: CVE-2014-3004 DESCRIPTION: Castor Library could allow a remote attacker to obtain sensitive information, caused by an XML External...

Security Bulletin: Rational Test Control Panel component in Rational Test Workbench and Rational Test Virtualization Server affected by Castor Library vulnerablity (CVE-2014-3004)

Summary The Castor Project Castor library is vulnerable affecting the Rational Test Control Panel component in IBM Rational Test Workbench and Rational Test Virtualization Server. Vulnerability Details CVE ID: CVE-2014-3004 Description: Castor Library could allow a remote attacker to obtain...