Apache Struts 2 Remote Code Execution (CVE-2017-5638)

Description Crowd used a version of Struts 2 that was vulnerable to CVE-2017-5638|https://cwiki.apache.org/confluence/display/WW/S2-045. Attackers can use this vulnerability to execute Java code of their choice on systems that have a vulnerable version of Crowd. Affected versions: All versions of...

PT-2017-7614

Name of the Vulnerable Software and Affected Versions IBM Websphere MQ JMS versions 7.0.1, 7.1, 7.5, 8.0, and 9.0 Description The issue allows a malicious user to execute arbitrary Java code by adding vulnerable classes to the classpath, as the JMS client provides classes that deserialize objects...

Microsoft Power Point 2016 - Java Code Execution

Microsoft Power Point 2016 - Java Code Execution Exploit Title: Microsoft Power Point Java Payload Code Execution Exploit Author: Fady Mohamed Osman @fadyosman Exploit-db : http://www.exploit-db.com/author/?a=2986 Demo Video : https://www.youtube.com/watch?v=DOJSUJK7hRo Video Tutorial :...

Microsoft Power Point 2016 - Java Code Execution

Exploit Title: Microsoft Power Point Java Payload Code Execution Exploit Author: Fady Mohamed Osman @fadyosman Exploit-db : http://www.exploit-db.com/author/?a=2986 Demo Video : https://www.youtube.com/watch?v=DOJSUJK7hRo Video Tutorial : https://www.youtube.com/watch?v=Lih-iuXgEM Youtube Channel...

Java (OGNL) code execution in Apache Struts 2 when devMode is enabled

Overview Apache Struts 2 provided by the Apache Software Foundation is a software framework for creating Java web applications. There is a known risk that arbitrary Java OGNL code may be executed in Apache Struts 2 when devMode is enabled in production environment. It is confirmed that...

CVE-2016-6809

Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization...

PT-2016-6747

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS versions 7.0 through 7.0.0.42 IBM WebSphere Application Server WAS versions 8.0 through 8.0.0.12 IBM WebSphere Application Server WAS versions 8.5 through 8.5.5.10 IBM WebSphere Application Server WAS...

CVE-2016-5062: Incorrect Resource Transfer Between Spheres

The web server in Aternity before 9.0.1 does not require authentication for getMBeansFromURL loading of Java MBeans, which allows remote attackers to execute arbitrary Java code by registering MBeans...

The vulnerability of the microprogramming software of the DELL SonicWALL Universal Management Appliance em5000 and the DELL SonicWALL Global Management System allows a intruder to execute arbitrary Java code.

The vulnerability of the CLIServer microprogramming software for automated network management by DELL SonicWALL Universal Management Appliance em5000, as well as the DELL SonicWALL Global Management System, is related to the lack of measures for input data cleansing. Exploiting this vulnerability...

Apache OFBiz Security Bypass Vulnerability

Apache OFBiz also known as Apache Open For Business Project is the United States Apache Apache Software Foundation of a set of enterprise resource planning ERP system. The system provides a set of Java-based Web application components and tools. A security bypass vulnerability exists in Apache...

CVE-2016-1524: Undefined Security Weakness

Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 1.5.0.11 and earlier allow remote attackers to execute arbitrary Java code by using 1 fileUpload.do or 2 lib-1.0/external/flash/fileUpload.do to upload a JSP file, and then accessing it via a direct request for ...

PT-2016-4850

Name of the Vulnerable Software and Affected Versions NETGEAR Management System NMS300 versions 1.5.0.11 and earlier Description The issue allows remote attackers to execute arbitrary Java code by uploading a JSP file using "fileUpload.do" or "lib-1.0/external/flash/fileUpload.do" and then...

Wieland wieplan 4.1 Document Parsing Java Code Execution Using XMLDecoder

Wieland wieplan 4.1 Document Parsing Java Code Execution Using XMLDecoder Vendor: Wieland Electric GmbH Product web page: http://www.wieland-electric.com Affected version: 4.1 Build 9 Summary: Your new software for the configuration of Wieland terminal rails. wieplan enables you to plan a...

Wieland wieplan 4.1 Document Parsing Java Code Execution Using XMLDecoder

Summary Your new software for the configuration of Wieland terminal rails. wieplan enables you to plan a complete terminal rail in a very simple way and to then place an order with Wieland. The configured terminal rail can be stored in DXF format and read into a CAD tool for further processing. D...

Wieland wieplan 4.1 - Document Parsing Java Code Execution Using XMLDecoder

Exploit for multiple platform in category local exploits Wieland wieplan 4.1 Document Parsing Java Code Execution Using XMLDecoder Vendor: Wieland Electric GmbH Product web page: http://www.wieland-electric.com Affected version: 4.1 Build 9 Summary: Your new software for the configuration of...

PT-2016-2697

Name of the Vulnerable Software and Affected Versions Dell SonicWALL GMS versions 7.2 through 8.1 before Hotfix 168056 Dell SonicWALL Analyzer versions 7.2 through 8.1 before Hotfix 168056 Dell SonicWALL UMA EM5000 versions 7.2 through 8.1 before Hotfix 168056 Description The issue is related to...

Wieland wieplan 4.1 - Document Parsing Java Code Execution Using XMLDecoder

Wieland wieplan 4.1 Document Parsing Java Code Execution Using XMLDecoder Vendor: Wieland Electric GmbH Product web page: http://www.wieland-electric.com Affected version: 4.1 Build 9 Summary: Your new software for the configuration of Wieland terminal rails. wieplan enables you to plan a complet...

PT-2016-3895

Name of the Vulnerable Software and Affected Versions Atlassian Bamboo versions prior to 5.9.9 Atlassian Bamboo versions 5.10.x prior to 5.10.0 Description The issue allows remote attackers to execute arbitrary Java code via serialized data to the JMS port. Recommendations For versions prior to...

CVE-2015-7913

agserverservice.exe in the AggreGate Server Service in Tibbo AggreGate before 5.30.06 allows local users to execute arbitrary Java code with SYSTEM privileges by using the Apache Axis AdminService deployment method to publish a class...

CVE-2015-7913: Undefined Security Weakness

agserverservice.exe in the AggreGate Server Service in Tibbo AggreGate before 5.30.06 allows local users to execute arbitrary Java code with SYSTEM privileges by using the Apache Axis AdminService deployment method to publish a class...