PT-2023-29495 · Perforce · Helix Core

Name of the Vulnerable Software and Affected Versions: Helix Core versions prior to 2023.2 Description: An unauthenticated remote Denial of Service DoS via the commit function was identified. This issue was reported by Jason Geffner. Recommendations: For Helix Core versions prior to 2023.2, updat...

Perforce Software Perforce Helix Resource Management Error Vulnerability

Perforce Software Perforce Helix is an application software from Perforce Software, Inc. It provides application lifecycle management for products. A resource management error vulnerability exists in Perforce Software Perforce Helix versions prior to 2023.2, which stems from a vulnerability that...

CVE-2023-45849: Improper Control of Generation of Code

An arbitrary code execution which results in privilege escalation was discovered in Helix Core versions prior to 2023.2. Reported by Jason Geffner...

CVE-2023-35767: Uncontrolled Resource Consumption

In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service DoS via the shutdown function was identified. Reported by Jason Geffner...

PT-2023-25298 · Perforce · Helix Core

Name of the Vulnerable Software and Affected Versions: Helix Core versions prior to 2023.2 Description: An unauthenticated remote Denial of Service DoS via the shutdown function was identified. The issue was reported by Jason Geffner. Recommendations: For Helix Core versions prior to 2023.2, upda...

PT-2023-7827 · Perforce · Helix Core

Name of the Vulnerable Software and Affected Versions: Helix Core versions prior to 2023.2 Description: An arbitrary code execution issue was discovered, resulting in privilege escalation. This issue allows a remote attacker to execute arbitrary code with system account privileges. The...

PT-2023-32307 · Perforce · Helix Core

Name of the Vulnerable Software and Affected Versions: Helix Core versions prior to 2023.2 Description: An unauthenticated remote Denial of Service DoS via the buffer was identified. The issue was reported by Jason Geffner. Recommendations: For Helix Core versions prior to 2023.2, update to versi...

Perforce Software Perforce Helix Resource Management Error Vulnerability

Perforce Software Perforce Helix is an application software from Perforce Software, Inc. It provides application lifecycle management for products. A resource management error vulnerability exists in Perforce Software Perforce Helix Core prior to version 2023.2, which stems from a vulnerability...

Perforce Software Perforce Helix Resource Management Error Vulnerability

Perforce Software Perforce Helix is an application software from Perforce Software, Inc. It provides application lifecycle management for products. A resource management error vulnerability exists in Perforce Software Perforce Helix Core prior to version 2023.2, which stems from a feature that ca...

Perforce Software Perforce Helix Code Injection Vulnerability

Perforce Software Perforce Helix is an application software from Perforce Software, Inc. It provides application lifecycle management for products. A code injection vulnerability exists in Perforce Software Perforce Helix Core versions prior to 2023.2. An attacker exploiting this vulnerability...

CVE-2023-5759: Uncontrolled Resource Consumption

In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service DoS via the buffer was identified. Reported by Jason Geffner...

CVE-2023-45319: Uncontrolled Resource Consumption

In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service DoS via the commit function was identified. Reported by Jason Geffner...

Deserialization vulnerability in Helix workflow and REST

An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. The code can be run...

GHSA-JHCR-HPH9-G7WM Deserialization vulnerability in Helix workflow and REST

An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. The code can be run...

CVE-2023-38647

An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. The code can be run...

Deserialization of untrusted data

An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. The code can be run...

CVE-2023-38647 Apache Helix: Deserialization vulnerability in Helix workflow and REST

An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. The code can be run...

CVE-2023-38647 Apache Helix: Deserialization vulnerability in Helix workflow and REST

An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. The code can be run...

CVE-2023-38647 Apache Helix: Deserialization vulnerability in Helix workflow and REST

An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. The code can be run...

CVE-2023-38647

CVE-2023-38647 describes a deserialization vulnerability in Apache Helix workflow and REST where SnakeYAML can deserialize java.net.URLClassLoader to load a JAR from a URL, and then javax.script.ScriptEngineManager to execute code with that ClassLoader. This unbounded deserialization can likely l...