Information disclosure

In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the availability and integrity of the system...

Exploit for Path Traversal in Apache Flink

CVE-2020-17518 Apache Flink RESTful API Arbitrary File Upload...

Apache Struts 2.x < 2.3.1.1 Multiple Vulnerabilities

The version of Apache Struts running on the remote host is prior to 2.3.1.1. It, therefore, affected by multiple vulnerabilities: - The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary command...

Security Bulletin: Vulnerability in Apache Commons affects Rational Developer for System z (CVE-2015-7450)

Summary An Apache Commons Collections vulnerability for handling Java object deserialization was addressed by Rational Developer for System z Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this. Follow this link for more information...

USN-4584-1 htmlunit vulnerability

It was discovered that HtmlUnit incorrectly initialized Rhino engine. An Attacker could possibly use this issue to execute arbitrary Java code...

USN-4584-1: HtmlUnit vulnerability

It was discovered that HtmlUnit incorrectly initialized Rhino engine. An Attacker could possibly use this issue to execute arbitrary Java code...

Barapass, Tsunami scanner, vulnerabilities in Windows DNS Server and SAP products, weird attack on Twitter

This episode is based on posts from my Telegram channel avleonovcom, published in the last 2 weeks. So, if you use Telegram, please subscribe. I update it frequently. Barapass update I recently released an update to my password manager barapass. BTW, it seems to be my only pet project at the MVP...

CVE-2020-9297

Netflix Titus, all versions prior to version v0.1.1-rc.274, uses Java Bean Validation JSR 380 custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary...

Code injection

Netflix Titus, all versions prior to version v0.1.1-rc.274, uses Java Bean Validation JSR 380 custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary...

PT-2020-20572

Name of the Vulnerable Software and Affected Versions Netflix Titus versions prior to v0.1.1-rc.274 Description The issue concerns the use of Java Bean Validation custom constraint validators in Netflix Titus. It allows for the injection of arbitrary data into error message templates, which can...

F5 Networks BIG-IP : TMUI RCE (CVE-2020-5902) (Direct Check)

A remote code execution vulnerability exists in Traffic Management User Interface TMUI, also referred to as the Configuration utility. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary system commands, create or delete files, disable services,...

Exploit for Path Traversal in F5 Big-Ip_Access_Policy_Manager

CVE-2020-5902...

CVE-2015-0279: Expression Language Injection in FortiSIEM

An expression language injection vulnerability in FortiSIEM JBoss RichFaces library may allow a remote attacker to inject expression language EL expressions and execute arbitrary Java code via the do parameter...

Code injection

Netflix Titus uses Java Bean Validation JSR 380 custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being passe...

Unspecified Vulnerability in codeBeamer

Intland Software codeBeamer ALM is an application lifecycle management platform from Intland Software, Germany. The platform supports application lifecycle management, requirements management, risk management and software development. A security vulnerability exists in codeBeamer versions prior t...

CVE-2019-20635

codeBeamer before 9.5.0-RC3 does not properly restrict the ability to execute custom Java code and access the Java class loader via computed fields...

CVE-2019-20635

codeBeamer before 9.5.0-RC3 does not properly restrict the ability to execute custom Java code and access the Java class loader via computed fields...

Code injection

codeBeamer before 9.5.0-RC3 does not properly restrict the ability to execute custom Java code and access the Java class loader via computed fields...

CVE-2019-20635

CVE-2019-20635 affects codeBeamer prior to 9.5.0-RC3. The root cause is insufficient restriction of computing fields that can execute custom Java code and access the Java class loader. Impact, as stated, is the possibility to run custom Java code via these fields, with the risk of subsequent acce...

PT-2020-10611

Name of the Vulnerable Software and Affected Versions codeBeamer versions prior to 9.5.0-RC3 Description The issue is related to the ability to execute custom Java code and access the Java class loader via computed fields. This is due to improper restrictions in the software. Recommendations For...