Arbitrary File Write

one-java-agent-plugin is vulnerable to arbitrary file write. An attacker can overwrite the executable files or invoke them remotely through the unzip function of IOUtils.java by providing a specially crafted archive...

GHSA-9HR3-J9MC-XMQ2 Path Traversal in com.alibaba.oneagent:one-java-agent-plugin

All versions of package com.alibaba.oneagent:one-java-agent-plugin are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip using a specially crafted archive that holds directory traversal filenames e.g. ../../evil.exe. The attacker can overwrite executable files and either invoke...

CVE-2022-25842 Arbitrary File Write via Archive Extraction (Zip Slip)

All versions of package com.alibaba.oneagent:one-java-agent-plugin are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip using a specially crafted archive that holds directory traversal filenames e.g. ../../evil.exe. The attacker can overwrite executable files and either invoke...

CVE-2022-25842

All versions of package com.alibaba.oneagent:one-java-agent-plugin are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip using a specially crafted archive that holds directory traversal filenames e.g. ../../evil.exe. The attacker can overwrite executable files and either invoke...

one-java-agent 路径遍历漏洞

one-java-agent is to provide plug-in support to unify the management of numerous Java Agent. A security vulnerability exists in all versions of com.alibaba.oneagent:one-java-agent-plugin, which can be exploited by an attacker to overwrite executables and remotely invoke them or wait for the syste...

CVE-2022-25842: Improper Limitation of a Pathname to a Restricted Directory

All versions of package com.alibaba.oneagent:one-java-agent-plugin are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip using a specially crafted archive that holds directory traversal filenames e.g. ../../evil.exe. The attacker can overwrite executable files and either invoke...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip using a specially crafted archive that holds directory traversal filenames e.g. ../../evil.exe. The attacker can overwrite executable files and either invoke them remotely or wait for...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

Log4jHotPatch This is a tool which injects a Java agent into...

APM Java Agent Security Update

APM Java Agent Local Privilege Escalation issue ESA-2021-30 A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious plugin to an application running the APM Java agent. By using this vulnerability, an attacker could execute code at...

APM Java Agent Local Privilege Escalation

A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious file to an application running with the APM Java agent. Using this vector, a malicious or compromised user account could use the agent to run commands at a higher level of...

CVE-2021-37941

A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious file to an application running with the APM Java agent. Using this vector, a malicious or compromised user account could use the agent to run commands at a higher level of...

CVE-2021-37941

A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious file to an application running with the APM Java agent. Using this vector, a malicious or compromised user account could use the agent to run commands at a higher level of...

CVE-2021-37941

A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious file to an application running with the APM Java agent. Using this vector, a malicious or compromised user account could use the agent to run commands at a higher level of...

Privilege escalation

A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious file to an application running with the APM Java agent. Using this vector, a malicious or compromised user account could use the agent to run commands at a higher level of...

CVE-2021-37941

Summary: The CVE-2021-37941 issue affects the Elastic APM Java Agent. It enables local privilege escalation by allowing a user to attach a malicious file to an application running with the agent, potentially executing commands with higher privileges. Affected software: APM Java Agent (Elastic). A...

CVE-2021-37941

A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious file to an application running with the APM Java agent. Using this vector, a malicious or compromised user account could use the agent to run commands at a higher level of...

GE APM 安全漏洞

GE APM is an equipment monitoring system from General Electric GE. The system provides continuous monitoring of equipment operating status and faults. A security vulnerability exists in the GE APM Java agent that stems from the discovery of a local elevation of privilege issue in the APM Java...

CVE-2021-37941: Improper Privilege Management

A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious file to an application running with the APM Java agent. Using this vector, a malicious or compromised user account could use the agent to run commands at a higher level of...

APM Java Agent Security Update

APM Java Agent Local Privilege Escalation issue ESA-2021-29 A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious file to an application running with the APM Java agent. Using this vector, a malicious or compromised user account...

New Relic: Untrusted deserialization issue when loading newrelic.yml file in Java agent leads to code execution on host

Hi team, The New Relic Java agent is using SnakeYAML for deserialization of the newrelic.yml config file. SnakeYAML has a 'feature' which can lead to code execution, this is documented here. With the !!com.some.Class "arg1", "arg2" notation it's possible to call Java code during the deserializati...