GHSA-XJRR-XV9M-4PW5 Improper Input Validation in alilibaba:fastjson

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is...

cc.openkit:open_kit (>=1.1.6, <=1.1.18), cn.51daxia:zzz-websocket (>=1.0, <=1.1) +1621 more potentially affected by CVE-2017-18349 via com.alibaba:fastjson (>=1.1.15, <=1.2.24)

com.alibaba:fastjson MAVEN version =1.1.15, =1.1.6, =1.0, =1.0.0, =1.0.0, =6.1.7, =6.2.08, =6.1.0, =6.1.7, =6.1.0, =6.1.0, =1.0.0, =6.1.0, =6.1.12c, =6.1.14a, =1.0.0, =6.0.01 and more Source cves: CVE-2017-18349 Source advisory: GHSA-XJRR-XV9M-4PW5...

cc.kebei:onion-easy-orm (3.0.0), cc.kebei:onion-easy-orm-core (3.0.0) +1972 more potentially affected by CVE-2017-18349 via com.alibaba:fastjson (>=1.1.15, <=1.2.30)

com.alibaba:fastjson MAVEN version =1.1.15, =1.1.6, =1.0.0, =1.0, =1.0.0, =1.0.0, =6.1.7, =6.2.08, =6.1.0, =6.1.7, =6.1.0, =6.2.09 and more Source cves: CVE-2017-18349 Source advisory: OSV:GHSA-XJRR-XV9M-4PW5...

ro.pippo:pippo-demo-basic (0.4.0), ro.pippo:pippo-demo-controller (0.4.0) +2 more potentially affected by CVE-2017-18349 via ro.pippo:pippo-fastjson (0.4.0)

ro.pippo:pippo-fastjson MAVEN version 0.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on ro.pippo:pippo-fastjson and may be impacted: - ro.pippo:pippo-demo-basic 0.4.0 - ro.pippo:pippo-demo-controller 0.4.0 - ro.pippo:pippo-demo-crud 0.4.0 -...

ro.pippo:pippo-demo-basic (0.4.1), ro.pippo:pippo-demo-controller (0.4.1) +2 more potentially affected by CVE-2017-18349 via ro.pippo:pippo-fastjson (0.4.1)

ro.pippo:pippo-fastjson MAVEN version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on ro.pippo:pippo-fastjson and may be impacted: - ro.pippo:pippo-demo-basic 0.4.1 - ro.pippo:pippo-demo-controller 0.4.1 - ro.pippo:pippo-demo-crud 0.4.1 -...

ro.pippo:pippo-demo-basic (0.4.2), ro.pippo:pippo-demo-controller (0.4.2) +2 more potentially affected by CVE-2017-18349 via ro.pippo:pippo-fastjson (0.4.2)

ro.pippo:pippo-fastjson MAVEN version 0.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on ro.pippo:pippo-fastjson and may be impacted: - ro.pippo:pippo-demo-basic 0.4.2 - ro.pippo:pippo-demo-controller 0.4.2 - ro.pippo:pippo-demo-crud 0.4.2 -...

ro.pippo:pippo-demo-basic (0.5.0), ro.pippo:pippo-demo-controller (0.5.0) +2 more potentially affected by CVE-2017-18349 via ro.pippo:pippo-fastjson (0.5.0)

ro.pippo:pippo-fastjson MAVEN version 0.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on ro.pippo:pippo-fastjson and may be impacted: - ro.pippo:pippo-demo-basic 0.5.0 - ro.pippo:pippo-demo-controller 0.5.0 - ro.pippo:pippo-demo-crud 0.5.0 -...

ro.pippo:pippo-demo-ajax (0.6.0), ro.pippo:pippo-demo-basic (0.6.0) +3 more potentially affected by CVE-2017-18349 via ro.pippo:pippo-fastjson (0.6.0)

ro.pippo:pippo-fastjson MAVEN version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on ro.pippo:pippo-fastjson and may be impacted: - ro.pippo:pippo-demo-ajax 0.6.0 - ro.pippo:pippo-demo-basic 0.6.0 - ro.pippo:pippo-demo-controller 0.6.0 -...

ro.pippo:pippo-demo-ajax (0.6.1), ro.pippo:pippo-demo-basic (0.6.1) +3 more potentially affected by CVE-2017-18349 via ro.pippo:pippo-fastjson (0.6.1)

ro.pippo:pippo-fastjson MAVEN version 0.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on ro.pippo:pippo-fastjson and may be impacted: - ro.pippo:pippo-demo-ajax 0.6.1 - ro.pippo:pippo-demo-basic 0.6.1 - ro.pippo:pippo-demo-controller 0.6.1 -...

io.andromeda:lyricist (>=0.2.3, <=0.2.4), io.andromeda:lyricist-demo (0.2.3) potentially affected by CVE-2017-18349 via ro.pippo:pippo-fastjson (0.9.1)

ro.pippo:pippo-fastjson MAVEN version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on ro.pippo:pippo-fastjson and may be impacted: - io.andromeda:lyricist =0.2.3, =0.2.4 - io.andromeda:lyricist-demo 0.2.3 Source cves: CVE-2017-18349 Source...

io.andromeda:fragments (>=0.0.10, <=0.0.18) potentially affected by CVE-2017-18349 via ro.pippo:pippo-fastjson (1.1.0)

ro.pippo:pippo-fastjson MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on ro.pippo:pippo-fastjson and may be impacted: - io.andromeda:fragments =0.0.10, =0.0.18 Source cves: CVE-2017-18349 Source advisory: OSV:GHSA-XJRR-XV9M-4PW5...

io.andromeda:fragments (>=0.0.10, <=0.0.18) potentially affected by CVE-2017-18349 via ro.pippo:pippo-fastjson (1.1.0)

ro.pippo:pippo-fastjson MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on ro.pippo:pippo-fastjson and may be impacted: - io.andromeda:fragments =0.0.10, =0.0.18 Source cves: CVE-2017-18349 Source advisory: GHSA-XJRR-XV9M-4PW5...

Pippo FastjsonEngine Fastjson Arbitrary Code Execution Vulnerability

Pippo is a Java-based Web framework . FastjsonEngine is one of the JSON processing engine . Fastjson is one of the Java-based JSON parser/generator . Pippo 1.11.0 version of FastjsonEngine used by Fastjson 1.2.25 before the version of parseObject has a security vulnerability. A remote attacker ca...

CVE-2017-18349

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is...

Cross site request forgery (csrf)

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is...

CVE-2017-18349

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is...

CVE-2017-18349

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is...

CVE-2017-18349

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is...

cc.kebei:onion-easy-orm (3.0.0), cc.kebei:onion-easy-orm-core (3.0.0) +1972 more potentially affected by CVE-2017-18349 via com.alibaba:fastjson (>=1.1.15, <=1.2.30)

com.alibaba:fastjson MAVEN version =1.1.15, =1.1.6, =1.0.0, =1.0, =1.0.0, =1.0.0, =6.1.7, =6.2.08, =6.1.0, =6.1.7, =6.1.0, =6.2.09 and more Source cves: CVE-2017-18349 Source advisory: MEND:CVE-2017-18349...

io.andromeda:fragments (>=0.0.10, <=0.0.18), io.andromeda:lyricist (>=0.2.3, <=0.2.4) +6 more potentially affected by CVE-2017-18349 via ro.pippo:pippo-fastjson (>=0.4.0, <=1.1.0)

ro.pippo:pippo-fastjson MAVEN version =0.4.0, =0.0.10, =0.2.3, =0.6.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.6.1 Source cves: CVE-2017-18349 Source advisory: MEND:CVE-2017-18349...