CVE-2023-31826

Skyscreamer Open Source Nevado JMS v1.3.2 does not perform security checks when receiving messages. This allows attackers to execute arbitrary commands via supplying crafted data...

CVE-2023-31826

CVE-2023-31826 affects Skyscreamer Open Source Nevado JMS v1.3.2, where message handling omits security checks. The root cause is lack of input validation in message reception, enabling arbitrary command execution via crafted data. Public references (NVD/Red Hat/Veracode/GHSA OSV) describe Remote...

Nevado JMS 安全漏洞

Nevado JMS is a Skyscreamer open source JMS driver for the Queue and Notification Service SQS/SNS for AmazonWeb Services. A security vulnerability exists in Nevado JMS version v1.3.2, which stems from a lack of security checks when receiving messages, and can be exploited by an attacker to execut...

CVE-2023-31826

Skyscreamer Open Source Nevado JMS v1.3.2 does not perform security checks when receiving messages. This allows attackers to execute arbitrary commands via supplying crafted data...

CVE-2023-31826

Skyscreamer Open Source Nevado JMS v1.3.2 does not perform security checks when receiving messages. This allows attackers to execute arbitrary commands via supplying crafted data...

CVE-2023-30203

Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the eventid parameter at /php-jms/resultsheet.php...

Sql injection

Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the judgeid parameter at /php-jms/editjudge.php...

CVE-2023-30204

Judging Management System v1.0 is affected by a SQL injection vulnerability in the judge_id parameter of /php-jms/edit_judge.php. The issue is confirmed across multiple feeds linked to CVE-2023-30204, with CVSS v3.1 scores of 9.8 (CRITICAL, NETWORK external access, no user interaction required). ...

USN-5998-1 apache-log4j1.2 vulnerabilities

It was discovered that the SocketServer component of Apache Log4j 1.2 incorrectly handled deserialization. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 ESM. CVE-2019-17571 It was discovered that the JMSSink component of Apache Log4j 1....

CVE-2023-24641

Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the sid parameter at /php-jms/updateview.php...

CVE-2023-24643

Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the sid parameter at /php-jms/updateBlankTxtview.php...

SUSE CVE-2018-19360

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization...

SUSE CVE-2020-10672

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory aka aries.transaction.jms...

SUSE CVE-2020-14061

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and...

Security Bulletin: IBM DataPower Gateway affected by vulnerability in Java (CVE-2022-21626)

Summary IBM has addressed the CVE, which potentially affects JDBC, IMS Callout and JMS components Vulnerability Details CVEID:CVE-2022-21626 DESCRIPTION: An unspecified vulnerability in Java SE related to the Security component could allow an unauthenticated attacker to cause a denial of service...

OESA-2022-2065 log4j12 security update

With log4j it is possible to enable logging at runtime without modifying the application binary. Security Fixes: JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and...

Remote Code Execution (RCE)

Apache Flume is vulnerable to remote code execution. The vulnerability exists due to improper validations of jms source and provider url where the attacker can use the jms source with an unsafe provider url causing arbitrary code executions...

CVE-2022-42468

Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol...

CVE-2022-42468

Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol...

CVE-2022-42468

Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol...