apache-commons-collections: InvokerTransformer code execution during deserialisation

It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections...

apache-commons-collections: InvokerTransformer code execution during deserialisation

It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections...

apache-commons-collections: InvokerTransformer code execution during deserialisation

It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections...

Scientific Linux Security Update : apache-commons-collections on SL7.x (noarch) (20151130)

It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons- collections...

Critical: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform security update

Updated packages for the Apache commons-collections library, which fix one security issue, are now available for Red Hat JBoss Enterprise Application Platform 5.2, 5.1.2, and 4.3.10. Red Hat Product Security has rated this update as having Critical security impact. A Common Vulnerability Scoring...

Java deserialization vulnerability batch testing-vulnerability warning-the black bar safety net

! Foreword Java de-serialization vulnerabilities appear in people's field of vision has been for some time, the Rubik's Cube security team about this vulnerability were reproduced, while the study shows a high accuracy of mass detection the idea here with all of you a safe circle of friends to...

IBM WebSphere Application Server Remote Code Execution Vulnerability

WebSphere is IBM's integrated software platform. IBM WebSphere Application Server is affected by an Apache Commons Collections remote code execution vulnerability that stems from data deserialization via constructs in the Java InvokerTransformer class. An attacker can exploit this vulnerability t...

Oracle WebLogic Apache Commons library deserialization vulnerability

Added: 11/20/2015 CVE: CVE-2015-4852 BID: 77539 Background Oracle WebLogic Server formerly BEA WebLogic Server is a Java web application platform. Apache Commons is a widely used Java library which is included in WebLogic Server. Problem A vulnerability in the Apache Commons library used by Oracl...

Oracle WebLogic Apache Commons library deserialization vulnerability

Added: 11/20/2015 CVE: CVE-2015-4852 BID: 77539 Background Oracle WebLogic Server formerly BEA WebLogic Server is a Java web application platform. Apache Commons is a widely used Java library which is included in WebLogic Server. Problem A vulnerability in the Apache Commons library used by Oracl...

Oracle WebLogic Apache Commons library deserialization vulnerability

Added: 11/20/2015 CVE: CVE-2015-4852 BID: 77539 Background Oracle WebLogic Server formerly BEA WebLogic Server is a Java web application platform. Apache Commons is a widely used Java library which is included in WebLogic Server. Problem A vulnerability in the Apache Commons library used by Oracl...

Apache Commons Collections Java Library Vulnerability

US-CERT is aware of a deserialization vulnerability in the Apache Commons Collections ACC Java library. Java applications that either directly use ACC, or contain ACC in their classpath, may be vulnerable to arbitrary code execution. US-CERT encourages users and administrators to review...

AlienVault Unified Security Management av-forward Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of AlienVault Unified Security Management. Authentication is not required to exploit this vulnerability. The specific flaw exists within the av-forward Python daemon. A remote attacker can cause the...

PHP 7 ZEND_HASH_IF_FULL_DO_RESIZE Memory Misreference Vulnerability

PHP foreign name: Hypertext Preprocessor, Chinese name: "Hypertext Preprocessor" is a general-purpose open source scripting language. An internal error misreference vulnerability exists in PHP 7 ZENDHASHIFFULLDORESIZE. When deserializing a string, if the number of elements used in a HashTable has...

ysoserial

ysoserial !GitHub releasehttps://img.shields.io/github/do...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the improper use of a reflection-based approach to type conversion. An attacker can execute arbitrary code via a crafted serialized object. Details Serialization is a process of converting an...

CVE-2011-4104

CVE-2011-4104 affects Django Tastypie (older than 0.9.10). The vulnerability arises from the from_yaml deserialization in serializers.py, where YAML data is deserialized with yaml.load, allowing remote attackers to execute arbitrary Python code. The connected documents confirm the impact and vect...

CVE-2012-6142

Affected software: HTML::EP module 0.2011 for Perl. The vulnerability is due to the module not properly using Storable::thaw during deserialization, allowing remote attackers to execute arbitrary code via a crafted request. Impact is arbitrary code execution with the described deserialization fla...

Design/Logic Flaw

The PlRPC module, possibly 0.2020 and earlier, for Perl uses the Storable module, which allows remote attackers to execute arbitrary code via a crafted request, which is not properly handled when it is deserialized...

XStream: remote code execution due to insecure XML deserialization

It was found that XStream could deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code execution in the context of the server running the XStream...

OpenJDK: insecure subject principals set handling (JAAS, 8024306)

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect integrity via vectors related to JAAS. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the...