219 matches found
Remote Code Execution
xalan:xalan is vulnerable to remote code execution. An attacker is able to corrupt Java class files generated by the internal XSLTC compiler and execute harmful Java bytecodes on the host machine due to an integer truncation flaw which occurs during XSLT style sheet processing...
Apache Xalan Java XSLT library integer truncation issue when processing malicious XSLT stylesheets
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. A fix for this issue was published in September 20...
CVE-2022-34169
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 o...
CVE-2022-34169
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 o...
XWork in Apache Struts Reveals Sensitive Information
XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772....
OSV-2022-385 Uncaught exception in jaz.Zer.<clinit>
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47116 Crash type: Uncaught exception Crash state: jaz.Zer. java.base/java.lang.Class.forName0 java.base/java.lang.Class.forName...
USN-5313-1: OpenJDK vulnerabilities
It was discovered that OpenJDK incorrectly handled deserialization filters. An attacker could possibly use this issue to insert, delete or obtain sensitive information. CVE-2022-21248 It was discovered that OpenJDK incorrectly read uncompressed TIFF files. An attacker could possibly use this issu...
ColdFusion verifyldapserver vulnerability
Added: 03/07/2022 Background Adobe ColdFusion is a web application development platform written in Java. Problem The verifyldapserver method in utils.cfc allows a remote attacker to cause the server to download a Java class from an arbitrary LDAP server, leading to remote code execution. Resoluti...
Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
vuln4japi A vulnerable Java based REST API for demonstrating C...
Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
log4shell.tools !buildhttps://github.com/alexbakker/log4sh...
Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
CVE-2021-44228 A Zeek package which raises notices, tags HTTP...
Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
Python Log4RCE An all-in-one pure Python3 PoC for CVE-2021-4...
Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
Python Log4RCE An all-in-one pure Python3 PoC for CVE-2021-4...
Aiven Ltd: Apache Flink RCE via GET jar/plan API Endpoint
Summary: Aiven has not restricted access to the GET jars/jarid/plan API. This endpoint can be used to load java class files with the specified arguments that are in the java classpath on the server. This can be abused to gain RCE on the Apache Flink Server. Steps To Reproduce: The video below sho...
CVE-2021-23262
Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE...
CVE-2021-23262
Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE...
Security feature bypass
Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE...
CVE-2021-23262 Snakeyaml deserialization vulnerability bypass
Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE...
CVE-2021-23262: Improper Control of Dynamically-Managed Code Resources
Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE...
