Security Bulletin: Multiple vulnerabilities in Apache Commons Collections affect IBM InfoSphere Information Server

Summary Multiple vulnerabilities in Apache Commons Collections used by IBM InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2015-4852 DESCRIPTION: The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers t...

Security Bulletin: Vulnerability in Apache Commons affects IBM WebSphere Application Server (CVE-2015-7450)

Summary An Apache Commons Collections vulnerability for handling Java object deserialization was addressed by WebSphere Application Server and WebSphere Application Server Hypervisor Edition. This vulnerability does not affect the IBM HTTP Server or versions of WebSphere Application Server prior ...

Mulesoft Mule Unsafe Deserialization

The MuleSoft Mule runtime engine before 3.8.0 allows remote attackers to execute arbitrary code because of Java Deserialization, related to Apache Commons Collections...

GHSA-CVCF-W75C-GW5R Mulesoft Mule Unsafe Deserialization

The MuleSoft Mule runtime engine before 3.8.0 allows remote attackers to execute arbitrary code because of Java Deserialization, related to Apache Commons Collections...

Security Bulletin: Vulnerability in Apache Commons affects IBM Standards Processing Engine (CVE-2015-7450)

Summary An Apache Commons Collections vulnerability for handling Java object deserialization was addressed by IBM Standards Processing Engine. Vulnerability Details CVEID: CVE-2015-7450 DESCRIPTION: Apache Commons Collections could allow a remote attacker to execute arbitrary code on the system,...

Jenkins CLI Deserialization of Untrusted Data vulnerability

The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-.jar file and the "Groovy variant in ysoserial"...

GHSA-FJQ5-5J5F-MVXH Deserialization of Untrusted Data in Apache commons collections

It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections...

net.osgiliath.framework:net.osgiliath.features.karaf-features-full (>=0.0.1, <=0.0.3), net.osgiliath.framework:net.osgiliath.features.karaf-features-jpa (>=0.0.1, <=0.0.3) +48 more potentially affected by CVE-2015-7501 via org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections (>=3.2.1_1, <=3.2.1_3)

org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections MAVEN version =3.2.11, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =2.2.0, =1.0.2, =1.0.8 - org.frie...

Deserialization of Untrusted Data in Apache commons collections

It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections...

Mageia: Security Advisory (MGASA-2019-0399)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GLSA-202107-37 : Apache Commons Collections: Remote code execution

The remote host is affected by the vulnerability described in GLSA-202107-37 Apache Commons Collections: Remote code execution Some classes in the Apache Commons Collections functor package deserialized potentially untrusted input by default. Impact : Deserializing untrusted input using Apache...

Apache Commons Collections: Remote code execution

Background Apache Commons Collections extends the JCF classes with new interfaces, implementations and utilities. Description Some classes in the Apache Commons Collections functor package deserialized potentially untrusted input by default. Impact Deserializing untrusted input using Apache Commo...

The vulnerability of Apache Commons Collections and Cisco’s software products lies in the possibility of restoring unreliable data structures in memory, allowing attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of Apache Commons Collections and Cisco’s software products lies in the rehydration of unreliable data structures in memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...

SUSE: Security Advisory (SUSE-SU-2016:0242-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2016:0228-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update

apache-commons-collections jss 4.8.1-2 - Bug 1932803 - HSM + FIPS: CMCRequest with a shared secret resulting in error 4.8.1-1 - Rebase to upstream JSS v4.8.1 - Red Hat Bugilla 1908541 - jss broke SCEP - missing PasswordChallenge class - Red Hat Bugilla 1489256 - RFE jss should support RSA with OA...

CentOS: Security Advisory for jakarta-commons-collections (CESA-2015:2671)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

ysoserial

This is a proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization. The tool, called ysoserial, is a collection of utilities and property-oriented programming "gadget chains" discovered in common Java libraries that can, under the right conditions, exploit Jav...

ysoserial

This is a Java-based tool called ysoserial, which generates payloads that exploit unsafe Java object deserialization. The tool is designed to create payloads that can be used to attack vulnerable Java applications. The tool uses a variety of payloads, including CommonsCollectionsK1,...

GHSA-P694-23Q3-RVRC Remote Code Execution in Apache Synapse

In Apache Synapse, by default no authentication is required for Java Remote Method Invocation RMI. So Apache Synapse 3.0.1 or all previous releases 3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1 allows remote code execution attacks that can be performed by injecting specially crafted serialized objects...