CVE-2021-32824 Regular expression Denial of Service in MooTools

Apache Dubbo is a java based, open source RPC framework. Versions prior to 2.6.10 and 2.7.10 are vulnerable to pre-auth remote code execution via arbitrary bean manipulation in the Telnet handler. The Dubbo main service port can be used to access a Telnet Handler which offers some basic methods t...

CVE-2022-HW-POC

2022-HW-POC 2022 Webbing Protection Action POC Summary Discl...

fastjson: autoType shutdown restriction bypass leads to deserialization

A flaw was found in com.alibaba:fastjson, a fast JSON parser/generator for Java. Affected versions of this package are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions...

Important: Red Hat Security Advisory: Red Hat Fuse 7.11.0 release and security update

A minor version update from 7.10 to 7.11 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scorin...

CVE-2022-25845

A flaw was found in com.alibaba:fastjson, a fast JSON parser/generator for Java. Affected versions of this package are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Mitigation Users who can not...

AutoTypeCheck Code Execution

The vulnerability of the AutoTypeCheck mechanism in the Fastjson programming language library is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

Deserialization of untrusted data by Fastjson library leads to RCE

Threat Level Vulnerability Report For a detailed advisory, download the pdf file here Summary Applications using the Fastjson java library are impacted by remote code execution vulnerability...

High-Severity RCE Vulnerability Reported in Popular Fastjson Library

Cybersecurity researchers have detailed a recently patched high-severity security vulnerability in the popular Fastjson library that could be potentially exploited to achieve remote code execution. Tracked as CVE-2022-25845 CVSS score: 8.1, the issue relates to a case of deserialization of...

ai.houyi:dorado (>=0.0.1, <=0.0.8), ai.houyi:dorado-core (>=0.0.11, <=0.0.51) +11552 more potentially affected by CVE-2022-25845 via com.alibaba:fastjson (>=1.2.25, <=1.2.80)

com.alibaba:fastjson MAVEN version =1.2.25, =0.0.1, =0.0.11, =0.0.16, =0.0.1, =0.0.14, =0.0.47, =0.0.14, =0.1.1, =j8.2.2.0, =j8.2.2.0, =finchley.sr2.sr1, =finchley.sr4, =j8.2.2.0, =finchley.sr2.sr1, =finchley.sr2.sr1, =2.1.0 and more Source cves: CVE-2022-25845 Source advisory:...

CVE-2022-25845

The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not...

Unsafe deserialization in com.alibaba:fastjson

The package com.alibaba:fastjson before 1.2.83 is vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not...

CVE-2022-25845: Deserialization of Untrusted Data

The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not...

Fastjson code-related vulnerabilities

Fastjson is a Java-based fast JSON parser/generator. versions prior to Fastjson 1.2.83 have a security vulnerability that stems from the ease of bypassing the default autoType off restriction to deserialize untrusted data, which is exploited by attackers to cause code execution...

Deserialization of Untrusted Data

Overview com.alibaba:fastjson is a fast JSON parser/generator for Java. Affected versions of this package are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows...

Fastjson Remote Code Execution Vulnerability (CNVD-2022-40233)

Fastjson is an open source JSON parsing library , it can parse JSON format strings , support for Java Bean serialized to JSON strings , you can also deserialize from JSON strings to JavaBean. Fastjson has a remote code execution vulnerability that can be exploited by an attacker to bypass the...

ai.mattmann.mnemosyne:cas-product (>=1.11.0, <=1.13.8), ai.mattmann.mnemosyne:pcs-services (>=1.12.0, <=1.13.8) +662 more potentially affected by CVE-2016-6812 via org.apache.cxf:cxf-core (>=3.1.0, <=3.1.8)

org.apache.cxf:cxf-core MAVEN version =3.1.0, =1.11.0, =1.12.0, =1.2.18, =1.0.0, =3.13, =1.0.0, =2.2.1, =2.3.1, =2.2.1, =2.2.1, =2.2.4 and more Source cves: CVE-2016-6812 Source advisory: GHSA-VW2C-5WPH-V92R...

ai.mattmann.mnemosyne:cas-product (>=1.11.0, <=1.13.8), ai.mattmann.mnemosyne:pcs-services (>=1.12.0, <=1.13.8) +843 more potentially affected by CVE-2017-5653 via org.apache.cxf:cxf-core (>=3.1.0, <=3.1.10)

org.apache.cxf:cxf-core MAVEN version =3.1.0, =1.11.0, =1.12.0, =1.2.18, =6.2.0.5, =6.2.0.6, =1.0.0, =3.13, =1.0.0, =1.0.4 and more Source cves: CVE-2017-5653 Source advisory: OSV:GHSA-HGG6-8X62-M9GF...

PT-2022-2951

Name of the Vulnerable Software and Affected Versions com.alibaba:fastjson versions prior to 1.2.83 Description The vulnerability is related to the deserialization of untrusted data by bypassing the default autoType shutdown restrictions in the Fastjson library. This can be exploited under certai...

PT-2022-37744

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47192 Crash type: Uncaught exception Crash state: com.alibaba.fastjson.JSONPath.deepScan java.base/java.lang.Boolean.valueOf com.alibaba.fastjson.parser.ParserConfig$2.apply...

PT-2022-36944

Name of the Vulnerable Software and Affected Versions No specific software or version information is provided in the given input. Description The issue is related to an uncaught exception. Technical details include the involvement of com.alibaba.fastjson.JSONPath.getPropertyValue,...