1563 matches found
CVE-2019-14892
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code...
CVE-2019-14892
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code...
Deserialization of untrusted data
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code...
CVE-2019-14892
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code...
FasterXML jackson-databind Remote Code Execution Vulnerability
FasterXML jackson-databind is a simple Java-based application library , Jackson can easily convert Java objects into json objects and xml documents , the same can be json, xml into Java objects . A remote code execution vulnerability exists in FasterXML jackson-databind. The vulnerability hi due ...
Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Application Developer for WebSphere (CVE-2014-3566, CVE-2014-3065, CVE-2014-6457)
Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, Versions 6, and 7 that are used by Rational Application Developer. This also includes a fix for the Padding Oracle On Downgraded Legacy Encryption POODLE SSLv3 vulnerability CVE-2014-3566. These were disclosed as part ...
Huawei EulerOS: Security Advisory for java-1.8.0-openjdk (EulerOS-SA-2018-1028)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Android ashmem Read-Only Bypasses Exploit
Android suffers from ashmem read-only bypass vulnerabilities via remapfilepages and ASHMEMUNPIN. Android: ashmem readonly bypasses via remapfilepages and ASHMEMUNPIN This bug report describes two ways in which an attacker can modify the contents of a read-only ashmem fd. I'm not sure at this poin...
CVE-2014-8337: Unrestricted Upload of File with Dangerous Type
Unrestricted file upload vulnerability in includes/classes/uploadify-v2.1.4/uploadify.php in HelpDEZk 1.0.1 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the directory specified...
CVE-2014-5140: Improper Neutralization of Special Elements used in an SQL Command
The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly handle : colon characters, which allows remote authenticated users to conduct SQL injection attacks via the First name and Last name fields in the address book...
Server-Side Template Injection
pebble is vulnerable to server-side template injection. The fix for an older vulnerability that validates for getClass can be bypassed to inject arbitrary code through the template using Java classes that have TYPE static field containing values that is an instance of java.lang.Class. For example...
Arbitrary Code Execution
odata-client-proxy is vulnerable to arbitrary code execution. The vulnerability exists as the classes that were deserialized were not checked in AbstractService, allowing unsafe deserialization that can lead to arbitrary code execution...
Important: Red Hat Security Advisory: Red Hat Data Grid 7.3.2 security update
An update for Red Hat Data Grid is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...
Remote Code Execution
jackson-databind is vulnerable to remote code execution. The application does not block the xalan classes during deserialization, which would allow a remote attacker to leverage the vulnerability to execute arbitrary code...
CVE-2018-2602
It was discovered that the I18n component of OpenJDK could use an untrusted search path when loading resource bundle classes. A local attacker could possibly use this flaw to execute arbitrary code as another local user by making their Java application load an attacker controlled class file...
CVE-2019-16931: Improper Neutralization of Input During Web Page Generation
A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers...
Critical severity vulnerability that affects generator-jhipster
Account takeover and privilege escalation is possible in applications generated by generator-jhipster before 6.3.0. This is due to a vulnerability in the generated java classes: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator PRNG Generated applications must be manually...
GHSA-MWP6-J9WF-968C Critical severity vulnerability that affects generator-jhipster
Account takeover and privilege escalation is possible in applications generated by generator-jhipster before 6.3.0. This is due to a vulnerability in the generated java classes: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator PRNG Generated applications must be manually...
CVE-2019-15822: Improper Limitation of a Pathname to a Restricted Directory
The wps-child-theme-generator plugin before 1.2 for WordPress has classes/helpers.php directory traversal...