120 matches found
IBM Operational Decision Manager - JNDI Injection
IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145. id: CVE-2024-22319 info: name: IBM Operational Decision Manager -...
IBM Operational Decision Manager - Java Deserialization
IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, and 8.12.0.1 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization. By sending specially crafted request, an attacker could exploit this vulnerability to...
Richsploit
Richsploit Richsploit: эксплуатационный набор для RichFaces. Обзор Richsploit можно использовать для эксплуатации JSF-конечных точек, использующих RichFaces. Уязвимы все версии от 3.1.0 и выше. usage: Richsploit -e,--exploit 0: CVE-2013-2165 1: CVE-2015-0279 2: CVE-2018-12532 3: CVE-2018-12533 4:...
mojarra-2.2.13-patched
Mojarra 2.2.13 – обратный порт исправления CVE-2020-6950 Этот репозиторий содержит воспроизводимый обратный порт исправления для CVE-2020-6950 в Mojarra 2.2.13. Он создан в первую очередь для обеспечения прослеживаемости и поддержки устаревших приложений, которые по причинам совместимости не могу...
wildfly-clustering-faces-mojarra: com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include
A flaw was found in EAP. Any estate hosting a JSF app using the user-controlled-include pattern would permit EL injection, achieving unauthenticated RCE as the server process user...
wildfly-clustering-faces-mojarra: com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include
A flaw was found in EAP. Any estate hosting a JSF app using the user-controlled-include pattern would permit EL injection, achieving unauthenticated RCE as the server process user...
wildfly-clustering-faces-mojarra: com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include
A flaw was found in EAP. Any estate hosting a JSF app using the user-controlled-include pattern would permit EL injection, achieving unauthenticated RCE as the server process user...
CVE-2017-1000486
README - CVE-2020-1039909 Primefaces Remote Code Execution ============================================================ SOBRE A VULNERABILIDADE CVE-2020-1039909 e uma vulnerabilidade de execucao remota de codigo RCE no framework Primefaces JSF. A falha permite que um atacante execute comandos...
wildfly-clustering-faces-mojarra: com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include
A flaw was found in EAP. Any estate hosting a JSF app using the user-controlled-include pattern would permit EL injection, achieving unauthenticated RCE as the server process user...
Malicious code in jsf-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6a2a0bbd4939a789673bdca08866c9be58dd361df175695e7f8c1141bed4e47 On require'jsf-utils', lib/string/pathcase.js runs a top-level async IIFE that fetches a JavaScript payload from https://jsonkeeper.com/b/BPB86 and...
MAL-2026-6921 Malicious code in jsf-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6a2a0bbd4939a789673bdca08866c9be58dd361df175695e7f8c1141bed4e47 On require'jsf-utils', lib/string/pathcase.js runs a top-level async IIFE that fetches a JavaScript payload from https://jsonkeeper.com/b/BPB86 and...
EUVD-2015-5177
Malware in sbrugna...
EUVD-2011-4288
Malware in sbrugna...
EUVD-2009-1549
Malware in sbrugna...
EUVD-2017-10599
Malware in sbrugna...
CVE-2024-13980 H3C Intelligent Management Center (iMC) /byod/index.xhtml RCE
H3C Intelligent Management Center IMC versions up to and including E0632H07 contains a remote command execution vulnerability in the /byod/index.xhtml endpoint. Improper handling of JSF ViewState allows unauthenticated attackers to craft POST requests with forged javax.faces.ViewState parameters,...
CVE-2024-13980: Deserialization of Untrusted Data
H3C Intelligent Management Center IMC versions up to and including E0632H07 contains a remote command execution vulnerability in the /byod/index.xhtml endpoint. Improper handling of JSF ViewState allows unauthenticated attackers to craft POST requests with forged javax.faces.ViewState parameters,...
Malicious code in @zalastax/nolb-jsf (npm)
The package @zalastax/nolb-jsf was found to contain malicious code...
MAL-2025-12069 Malicious code in @zalastax/nolb-jsf (npm)
The package @zalastax/nolb-jsf was found to contain malicious code...
Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is vulnerable to a denial of service (CVE-2024-45085)
Summary IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is vulnerable to a denial of service when a JSF application configured with Sun Reference Implementation 1.2 is deployed. Vulnerability Details Refer to the security bulletins listed in the...