CVE-2017-9801

When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP headers...

SMTP Header Injection

Apache Commons Email is vulnerable to SMTP Header Injections. A malicious user can inject arbitrary SMTP Headers by passing line-breaks as a subject of an email...

Oracle Enterprise Manager Grid Control Multiple Vulnerabilities (July 2017 CPU) (httpoxy)

The version of Oracle Enterprise Manager Grid Control installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in the Bouncy Castle Java library due to improper validation of a point within the elliptic curve. An...

Barracuda WAF V360 Firmware 8.0.1.014 Username / Session ID Leak

KL-001-2017-013 : Barracuda WAF Management Application Username and Session ID Leak Title: Barracuda WAF Management Application Username and Session ID Leak Advisory ID: KL-001-2017-013 Publication Date: 2017.07.06 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2017-013.tx...

Linux/x86 - Reverse TCP Shellcode (67 bytes)

/ Tiny Shell Reverse TCP Shellcode - C Language Linux/x86 Written in 2013 by Geyslan G. Bem, Hacking bits http://hackingbits.com email protected This source is licensed under the Creative Commons Attribution-ShareAlike 3.0 Brazil License. To view a copy of this license, visit...

Code42 CrashPlan Remote Code Execution Vulnerability

Code42 CrashPlan is an online data backup solution from Code42 Software, USA. A remote code execution vulnerability exists in Code42 CrashPlan version 5.4.x. A remote attacker can exploit the vulnerability by using org.apache.commons.ssl.rssl. A remote attacker can exploit this vulnerability to...

CVE-2017-9830

Remote Code Execution is possible in Code42 CrashPlan 5.4.x via the org.apache.commons.ssl.rmi.DateRMI Java class, because upon instantiation it creates an RMI server that listens on a TCP port and deserializes objects sent by TCP clients...

Apache Commons Fileupload 1.3.1 DOS(CVE-2016-3092)-vulnerability warning-the black bar safety net

Last year the commons-fileupload official announcements Commons Fileupload of a security vulnerability CVE-2016-3092, in the Commons FileUpload 1.3.2 repair. because at that time the security components use the Commons FileUpload 1.3.1 release, so with a bit of this vulnerability. Shortly before...

In-depth understanding of the JAVA deserialization vulnerability-vulnerability warning-the black bar safety net

1.Java serialization and deserialization Java serialization refers to the Java object is converted to byte sequence of the process easy to save in memory, a file, a database, the ObjectOutputStream class's writeObjectmethod can be implemented serialized. Java deserialization refers to the sequenc...

Fedora 25 : batik (2017-43b46cd2da)

Security fix for CVE-2017-5662 ---- Add missing requires on xmlgraphics-commons Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

ManageEngine Applications Manager Apache Commons Collections Insecure Deserialization (CVE-2016-9498)

An insecure deserialization vulnerability exists in ManageEngine Applications Manager. This vulnerability is due to the inclusion of the vulnerable version of Apache Commons Collections library in the classpath combined with insecure deserialization. A remote, unauthenticated attacker can exploit...

Cisco Prime LAN Management Solution Java Object Deserialization RCE (CSCux34647)

The Cisco Prime Lan Management Solution LMS running on the remote web server is affected by a remote code execution vulnerability due to unsafe deserialize calls of unauthenticated Java objects to the Apache Commons Collections ACC library. An unauthenticated, remote attacker can exploit this, by...

H3C / HPE Intelligent Management Center RMI Java Object Deserialization RCE

The H3C or HPE Intelligent Management Center iMC web server running on the remote host is affected by a remote code execution vulnerability due to unsafe deserialization of Java objects to the Apache Commons BeanUtils library via the euplat RMI registry. An unauthenticated, remote attacker can...

Code injection

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite subcomponent: Web Access Apache Commons BeanUtils. Supported versions that are affected are 8.3, 8.4, 15.1, 15.2, 16.1 and 16.2. Easily "exploitable" vulnerability allows low...

CVE-2017-3503

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite subcomponent: Web Access Apache Commons BeanUtils. Supported versions that are affected are 8.3, 8.4, 15.1, 15.2, 16.1 and 16.2. Easily "exploitable" vulnerability allows low...

CVE-2017-3503

CVE-2017-3503 is a vulnerability in the Oracle Primavera P6 Enterprise Project Portfolio Management (P6 EPPM) Web Access component (Apache Commons BeanUtils). Affected versions: 8.3, 8.4, 15.1, 15.2, 16.1, and 16.2. The description indicates an easily exploitable issue where a low-privileged atta...

CVE-2017-3503

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite subcomponent: Web Access Apache Commons BeanUtils. Supported versions that are affected are 8.3, 8.4, 15.1, 15.2, 16.1 and 16.2. Easily "exploitable" vulnerability allows low...

Oracle Primavera Products Remote Vulnerability

Oracle Primavera Products Suite is a suite of project portfolio management solutions from Oracle Corporation.Primavera P6 Enterprise Project Portfolio Management P6 EPPM is one of the components used for project planning, management and execution. Primavera P6 Enterprise Project Portfolio...

VMware vRealize Operations RCE Vulnerability (VMSA-2015-0009)

VMware vRealize Operations is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

MySQL Enterprise Monitor 3.1.x < 3.1.7.8023 / 3.2.x < 3.2.7.1204 / 3.3.x < 3.3.3.1199 Multiple Vulnerabilities (April 2017 CPU)

According to its self-reported version, the MySQL Enterprise Monitor application running on the remote host is 3.1.x prior to 3.1.7.8023, 3.2.x prior to 3.2.7.1204, or 3.3.x prior to 3.3.3.1199. It is, therefore, affected by multiple vulnerabilities : - A denial of service vulnerability exists in...