CVE-2025-47222

A class name enumeration was found in Keyfactor SignServer versions prior to 7.3.2. Setting any chosen class name to any of the properties requiring a class path and the provided class is not expected to return different errors if the class exists in deployment or not. This returns information...

EUVD-2014-8730

Malware in sbrugna...

EUVD-2022-0672

Malicious code in bioql PyPI...

EUVD-2023-42953

Malicious code in bioql PyPI...

CVE-2023-39219

PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests...

CVE-2022-47879

A Remote Code Execution RCE vulnerability in /be/rpc.php in Jedox 2020.2.5 allows remote authenticated users to load arbitrary PHP classes from the 'rtn' directory and execute its methods. NOTE: The vendor states that the vulnerability affects installations running version 22.5 or earlier. The...

CVE-2019-12017

A remote code execution vulnerability exists in MapR CLDB code, specifically in the JSON framework that is used in the CLDB code that handles login and ticket issuance. An attacker can use the 'class' property of the JSON request sent to the CLDB to influence the JSON library's decision on which...

Exploit for Deserialization of Untrusted Data in Apache Activemq

CVE-2023-46604 01. Apache ActiveMQ & OpenWire - 1 Apac...

CVE-2024-24824

Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can be loaded and instantiated using a HTTP PUT request to the /api/system/clusterconfig/ endpoint. Graylog's cluster config system uses fully qualified class...

This Week in Spring - November 12th, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring! Spring Cloud 2024.0.0-RC1 aka Moorgate has been released In this installment of A Bootiful Podcast , I talk to Gradle developer advocate Baruch Sadogursky good news everybody! GraalVM will now support jcmd, which allows you t...

Design/Logic Flaw

Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can be loaded and instantiated using a HTTP PUT request to the /api/system/clusterconfig/ endpoint. Graylog's cluster config system uses fully qualified class...

CVE-2024-24824 graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request

Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can be loaded and instantiated using a HTTP PUT request to the /api/system/clusterconfig/ endpoint. Graylog's cluster config system uses fully qualified class...

CVE-2024-23682 Artemis Java Test Sandbox Class Loading Escape

Artemis Java Test Sandbox versions before 1.8.0 are vulnerable to a sandbox escape when an attacker includes class files in a package that Ares trusts. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed code...

CVE-2024-23682 Artemis Java Test Sandbox Class Loading Escape

Artemis Java Test Sandbox versions before 1.8.0 are vulnerable to a sandbox escape when an attacker includes class files in a package that Ares trusts. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed code...

Arbitrary Command Execution

org.jupiter-rpc:jupiter-serialization-kryo is vulnerable to Arbitrary Command Execution. The vulnerability is due to improper configuration which allows remote class loading. The deserialization vulnerability allows an attacker to execute arbitrary commands via crafted RPC requests...

CVE-2023-39219

PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests...

CVE-2023-39219

PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests...

Design/Logic Flaw

PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests...

CVE-2023-39219

CVE-2023-39219 : PingFederate Administrative Console dependency contains a weakness that can render the console unresponsive via crafted Java class loading enumeration requests. Documented as a high-severity issue with Network access and HIGH availability impact, but public details on affected ve...

PT-2023-26837 · Ping Identity · Pingfederate Administrative Console

Name of the Vulnerable Software and Affected Versions: PingFederate Administrative Console affected versions not specified Description: The issue is related to a weakness in the PingFederate Administrative Console dependency, where the console becomes unresponsive due to crafted Java class loadin...