Deserialization Of Untrusted Data

nifi-jms-processors is vulnerable to Deserialization of Untrusted Data. The vulnerability exists due to improper URL validation in JndiJmsConnectionFactoryProvider of JndiJmsConnectionFactoryProperties.java; if an attacker has access to the provider URL and library property configuration, they ca...

CVE-2023-34212 Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components

The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location...

CVE-2023-34212 Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components

The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location...

CVE-2023-34212 Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components

The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location...

CVE-2023-29632

PrestaShop jmspagebuilder 3.x is vulnerable to SQL Injection via ajaxjmspagebuilder.php...

Remote Code Execution (RCE)

org.skyscreamer:nevado-jms is vulnerable to Remote Code Execution RCE. Lack of proper checking for user supplied messages allows an attacker to upload and execute malicious code on the system via maliciously crafted messages...

GHSA-7GM3-MWJW-J53W Command injection in nevado-jms

Skyscreamer Open Source Nevado JMS v1.3.2 does not perform security checks when receiving messages. This allows attackers to execute arbitrary commands via supplying crafted data...

Command injection in nevado-jms

Skyscreamer Open Source Nevado JMS v1.3.2 does not perform security checks when receiving messages. This allows attackers to execute arbitrary commands via supplying crafted data...

CVE-2023-31826

Skyscreamer Open Source Nevado JMS v1.3.2 does not perform security checks when receiving messages. This allows attackers to execute arbitrary commands via supplying crafted data...

CVE-2023-31826

Skyscreamer Open Source Nevado JMS v1.3.2 does not perform security checks when receiving messages. This allows attackers to execute arbitrary commands via supplying crafted data...

Security feature bypass

Skyscreamer Open Source Nevado JMS v1.3.2 does not perform security checks when receiving messages. This allows attackers to execute arbitrary commands via supplying crafted data...

CVE-2023-31826

Skyscreamer Open Source Nevado JMS v1.3.2 does not perform security checks when receiving messages. This allows attackers to execute arbitrary commands via supplying crafted data...

CVE-2023-31826

Skyscreamer Open Source Nevado JMS v1.3.2 does not perform security checks when receiving messages. This allows attackers to execute arbitrary commands via supplying crafted data...

PT-2023-23480 · Skyscreamer · Nevado Jms

Name of the Vulnerable Software and Affected Versions: Skyscreamer Open Source Nevado JMS version 1.3.2 Description: The issue allows attackers to execute arbitrary commands by supplying crafted data due to the lack of security checks when receiving messages. Recommendations: For Skyscreamer Open...

Nevado JMS 安全漏洞

Nevado JMS is a Skyscreamer open source JMS driver for the Queue and Notification Service SQS/SNS for AmazonWeb Services. A security vulnerability exists in Nevado JMS version v1.3.2, which stems from a lack of security checks when receiving messages, and can be exploited by an attacker to execut...

CVE-2023-31826

CVE-2023-31826 affects Skyscreamer Open Source Nevado JMS v1.3.2, where message handling omits security checks. The root cause is lack of input validation in message reception, enabling arbitrary command execution via crafted data. Public references (NVD/Red Hat/Veracode/GHSA OSV) describe Remote...

CVE-2023-31826

Skyscreamer Open Source Nevado JMS v1.3.2 does not perform security checks when receiving messages. This allows attackers to execute arbitrary commands via supplying crafted data...

CVE-2023-30203

Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the eventid parameter at /php-jms/resultsheet.php...

Sql injection

Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the judgeid parameter at /php-jms/editjudge.php...

CVE-2023-30204

Judging Management System v1.0 is affected by a SQL injection vulnerability in the judge_id parameter of /php-jms/edit_judge.php. The issue is confirmed across multiple feeds linked to CVE-2023-30204, with CVSS v3.1 scores of 9.8 (CRITICAL, NETWORK external access, no user interaction required). ...