Apache Struts 2.x < 2.3.1.1 Multiple Vulnerabilities

The version of Apache Struts running on the remote host is prior to 2.3.1.1. It, therefore, affected by multiple vulnerabilities: - The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary command...

PT-2020-20572

Name of the Vulnerable Software and Affected Versions Netflix Titus versions prior to v0.1.1-rc.274 Description The issue concerns the use of Java Bean Validation custom constraint validators in Netflix Titus. It allows for the injection of arbitrary data into error message templates, which can...

Unspecified Vulnerability in codeBeamer

Intland Software codeBeamer ALM is an application lifecycle management platform from Intland Software, Germany. The platform supports application lifecycle management, requirements management, risk management and software development. A security vulnerability exists in codeBeamer versions prior t...

CVE-2019-20635

codeBeamer before 9.5.0-RC3 does not properly restrict the ability to execute custom Java code and access the Java class loader via computed fields...

CVE-2019-20635

CVE-2019-20635 affects codeBeamer prior to 9.5.0-RC3. The root cause is insufficient restriction of computing fields that can execute custom Java code and access the Java class loader. Impact, as stated, is the possibility to run custom Java code via these fields, with the risk of subsequent acce...

PT-2020-10611

Name of the Vulnerable Software and Affected Versions codeBeamer versions prior to 9.5.0-RC3 Description The issue is related to the ability to execute custom Java code and access the Java class loader via computed fields. This is due to improper restrictions in the software. Recommendations For...

CVE-2020-9761

An issue was discovered in UNCTAD ASYCUDA World 2001 through 2020. The Java RMI Server has an Insecure Default Configuration, leading to Java Code Execution from a remote URL because an RMI Distributed Garbage Collector method is called...

CVE-2020-9761

An issue was discovered in UNCTAD ASYCUDA World 2001 through 2020. The Java RMI Server has an Insecure Default Configuration, leading to Java Code Execution from a remote URL because an RMI Distributed Garbage Collector method is called...

PT-2020-7624

Name of the Vulnerable Software and Affected Versions Kingsoft Office version 5.3.1 Huawei P2 devices before V100R001C00B043 Description The issue allows man-in-the-middle attackers to conduct downgrade attacks and execute arbitrary Java code by leveraging a network position between the client an...

Apache Flink JAR Upload Java Code Execution

This module uses job functionality in Apache Flink dashboard web interface to upload and execute a JAR file, leading to remote execution of arbitrary Java code as the web server user. This module has been tested successfully on Apache Flink versions: 1.9.3 on Ubuntu 18.04.4; 1.11.2 on Ubuntu...

U.S. Dept Of Defense: RCE on █████ via CVE-2017-10271

Summary: Happy Friday! The server at ██████ is vulnerable to CVE-2017-10271 "Oracle WebLogic Server Remote Command Execution". Description: The following request takes 12 seconds 12000 milliseconds to complete: POST /wls-wsat/RegistrationPortTypeRPC HTTP/1.1 Host: ██████████ Content-Length: 423...

Atlassian Confluence Widget Connector Macro Velocity Template Injection Exploit

Widget Connector Macro is part of Atlassian Confluence Server and Data Center that allows embed online videos, slideshows, photostreams and more directly into page. A template parameter can be used to inject remote Java code into a Velocity template, and gain code execution. Authentication is not...

CVE-2018-16169

Cybozu Remote Service 3.0.0 to 3.1.0 allows remote authenticated attackers to upload and execute Java code file on the server via unspecified vectors...

CVE-2018-16171

Directory traversal vulnerability in Cybozu Remote Service 3.0.0 to 3.1.8 allows remote attackers to execute Java code file on the server via unspecified vectors...

CVE-2018-16171

Directory traversal vulnerability in Cybozu Remote Service 3.0.0 to 3.1.8 allows remote attackers to execute Java code file on the server via unspecified vectors...

PT-2019-9234

Name of the Vulnerable Software and Affected Versions Cybozu Remote Service versions 3.0.0 through 3.1.0 Description The issue allows remote authenticated attackers to upload and execute Java code files on the server. Recommendations For Cybozu Remote Service versions 3.0.0 through 3.1.0, at the...

CVE-2018-16171: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Cybozu Remote Service 3.0.0 to 3.1.8 allows remote attackers to execute Java code file on the server via unspecified vectors...

CVE-2018-16169: Unrestricted Upload of File with Dangerous Type

Cybozu Remote Service 3.0.0 to 3.1.0 allows remote authenticated attackers to upload and execute Java code file on the server via unspecified vectors...

Cybozu Remote Service Directory Traversal Vulnerability (CNVD-2019-07167)

Cybozu Remote Service is Cybozu's remote service management software for accessing Cybozu's internal systems. A directory traversal vulnerability exists in the 'client certificates registration' function in Cybozu Remote Service versions 3.0.0 through 3.1.8, which can be exploited to execute...

PT-2018-14765

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.0 through 9.0 Description The issue allows remote attackers to execute arbitrary Java code through an administrative client class with a serialized object from untrusted sources. Recommendations For...