1083 matches found
Deserialization of untrusted data
Divisa Proxia Suite 9 9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.8.43 and 9.7.10, 10.0 10.0.32, and 10.1 10.1.5, SparkSpace 1.0 1.0.30, 1.1 1.1.2, and 1.2 1.2.4, and Proxia PHR 1.0 1.0.30 and 1.1 1.1.2 allows remote code execution via untrusted Java deserialization. The proxia-error cookie is insecurely...
CVE-2019-18956
Divisa Proxia Suite 9 9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.8.43 and 9.7.10, 10.0 10.0.32, and 10.1 10.1.5, SparkSpace 1.0 1.0.30, 1.1 1.1.2, and 1.2 1.2.4, and Proxia PHR 1.0 1.0.30 and 1.1 1.1.2 allows remote code execution via untrusted Java deserialization. The proxia-error cookie is insecurely...
CVE-2019-18956
CVE-2019-18956 affects Divisa Proxia Suite (various 9.x, 10.x versions), SparkSpace, and Proxia PHR. The flaw is remote code execution via untrusted Java deserialization triggered by the insecure handling of the proxia-error cookie in every request. An unauthenticated attacker can craft a seriali...
OpenMRS Java Deserialization Remote Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'OpenMRS Java Deserialization RCE', 'Description' = %q OpenMRS is an open-source platform that supplies users with a customizable medical record...
PT-2019-15733
Name of the Vulnerable Software and Affected Versions Divisa Proxia Suite versions prior to 9.12.16 Divisa Proxia Suite version 9.11.19 Divisa Proxia Suite version 9.10.26 Divisa Proxia Suite version 9.9.8 Divisa Proxia Suite version 9.8.43 Divisa Proxia Suite version 9.7.10 Divisa Proxia Suite...
CVE-2019-18956: Deserialization of Untrusted Data
Divisa Proxia Suite 9 9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.8.43 and 9.7.10, 10.0 10.0.32, and 10.1 10.1.5, SparkSpace 1.0 1.0.30, 1.1 1.1.2, and 1.2 1.2.4, and Proxia PHR 1.0 1.0.30 and 1.1 1.1.2 allows remote code execution via untrusted Java deserialization. The proxia-error cookie is insecurely...
JBOSS EAP/AS Remoting Unified Invoker RCE
An unauthenticated attacker with network access to the JBOSS EAP/AS use exploit/multi/misc/jboss/remotingunifiedinvokerrce msf undefinedremotingunifiedinvokerrce show actions ...actions... msf undefinedremotingunifiedinvokerrce set ACTION msf undefinedremotingunifiedinvokerrce show options ...sho...
Deserialized Double Dirty
Recently I was able to fully root a NetApp OnCommand Performance Manager appliance using a Java Deserialization vulnerability and Dirty COW...
CVE-2019-18580
Dell EMC Storage Monitoring and Reporting version 4.3.1 contains a Java RMI Deserialization of Untrusted Data vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by sending a crafted RMI request to execute arbitrary code on the target host...
Padding Oracle Attack
Apache Shiro is vulnerable to padding oracle attack. The attack is possible as it adopts RememberMe configuration for cookies as a default and uses CBC mode of encryption, which would allow an attacker to perform a Java deserialization attack that results in remote code execution...
JetBrains TeamCity Java Deserialization Vulnerability
TeamCity is a Java-based build management and continuous integration server from JetBrains. An insecure Java deserialization vulnerability exists in JetBrains TeamCity versions prior to 2019.1.4. An attacker can exploit this vulnerability to achieve remote code execution...
CVE-2019-18364
In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution...
CVE-2019-18364
In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution...
CVE-2019-18364
In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution...
CVE-2019-18364
JetBrains TeamCity before version 2019.1.4 suffers insecure Java deserialization that could potentially allow remote code execution. This was acknowledged in the JetBrains Q3 2019 security bulletin, with the issue resolved in TeamCity 2019.1.4. Remediation: upgrade TeamCity to 2019.1.4 or later t...
Exploit for CVE-2019-2890
1 Enable the XXER tool python xxer.py -H 192.168.17.223 2...
CVE-2019-18364: Deserialization of Untrusted Data
In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution...
PT-2019-15373
Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2019.1.4 Description The issue is related to insecure Java Deserialization, which could potentially allow remote code execution. Recommendations For versions prior to 2019.1.4, update to version 2019.1.4 or...