1318 matches found
EUVD-2024-40059
Malicious code in bioql PyPI...
EUVD-2025-8429
Malicious code in bioql PyPI...
Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Container Release Update
An update is now available for Red Hat Ansible Automation Platform 2.5 Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams,...
ysoserial
This is a proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization. The tool, called ysoserial, is a collection of utilities and property-oriented programming "gadget chains" discovered in common Java libraries that can, under the right conditions, exploit Jav...
CVE-2025-57773
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, because DB2 parameters are not filtered, a JNDI injection attack can be directly launched. JNDI triggers an AspectJWeaver deserialization attack, writing to various files. This vulnerability...
CVE-2025-57773
CVE-2025-57773 affects DataEase prior to version 2.10.12, where unfiltered DB2 parameters enable a JNDI injection that triggers an AspectJWeaver deserialization attack, writing to files. The exploitation requires the presence of commons-collections 4.x and aspectjweaver-1.9.22.jar. The vulnerabil...
CVE-2025-57773 Dataease DB2 Aspectweaver Deserialization Arbitrary File Write Vulnerability
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, because DB2 parameters are not filtered, a JNDI injection attack can be directly launched. JNDI triggers an AspectJWeaver deserialization attack, writing to various files. This vulnerability...
CVE-2025-57773 Dataease DB2 Aspectweaver Deserialization Arbitrary File Write Vulnerability
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, because DB2 parameters are not filtered, a JNDI injection attack can be directly launched. JNDI triggers an AspectJWeaver deserialization attack, writing to various files. This vulnerability...
PT-2025-34683
Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 2.10.12 Description: DataEase is an open source business intelligence and data visualization tool. Due to insufficient filtering of DB2 parameters, a JNDI injection attack can be launched, triggering an AspectJWeave...
CVE-2025-57773: Deserialization of Untrusted Data
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, because DB2 parameters are not filtered, a JNDI injection attack can be directly launched. JNDI triggers an AspectJWeaver deserialization attack, writing to various files. This vulnerability...
MAL-2025-19307 Malicious code in elasticsearch-collections-client (npm)
The package elasticsearch-collections-client was found to contain malicious code...
Malicious code in elasticsearch-collections-client (npm)
The package elasticsearch-collections-client was found to contain malicious code...
Security Bulletin: IBM Integration Designer is vulnerable to Deserialization of Untrusted Data (CVE-2025-6420 )
Summary Vulnerability in Apache Commons Collections used by IBM Integration Designer. IBM Integration Designer has addressed CVE-2025-6420. Vulnerability Details CVEID:CVE-2015-6420 DESCRIPTION: Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and...
CVE-2023-21850
Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain component: E-Business Collections. Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...
CVE-2023-37473
zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing callable strings ie system caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were code. This issue has been addressed in commit...
CVE-2022-25028
Home Owners Collection Management System v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the collectedby parameter under the List of Collections module...
CVE-2021-2247
Vulnerability in the Oracle Advanced Collections product of Oracle E-Business Suite component: Admin. Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanc...
CVE-2021-28242
SQL Injection in the "evoadm.php" component of b2evolution v7.2.2-stable allows remote attackers to obtain sensitive database information by injecting SQL commands into the "cfname" parameter when creating a new filter under the "Collections" tab...