CVE-2016-2009

HPE Network Node Manager i NNMi 9.20, 9.23, 9.24, 9.25, 10.00, and 10.01 allows remote authenticated users to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections ACC library...

PT-2016-4958

Name of the Vulnerable Software and Affected Versions HPE Network Node Manager i NNMi versions 9.20 through 9.25, 10.00, 10.01 Description The issue allows remote authenticated users to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections ACC...

CVE-2016-2009: Improper Access Control

HPE Network Node Manager i NNMi 9.20, 9.23, 9.24, 9.25, 10.00, and 10.01 allows remote authenticated users to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections ACC library...

Apache Camel: source code security analysis report

Several vulnerabilities were discovered in The Apache Software Foundation 'Apache Camel' software: Using Synchronization Primitives in EJB components Missing Verification of Executable Files' Digital Signature when Executing them from Untrusted Sources Violating the Java Object Model Using...

CVE-2016-2003

HPE P9000 Command View Advanced Edition Software CVAE 7.x and 8.x before 8.4.0-00 and XP7 CVAE 7.x and 8.x before 8.4.0-00 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections ACC library...

Command injection

HPE P9000 Command View Advanced Edition Software CVAE 7.x and 8.x before 8.4.0-00 and XP7 CVAE 7.x and 8.x before 8.4.0-00 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections ACC library...

PT-2016-4955

Name of the Vulnerable Software and Affected Versions HPE P9000 Command View Advanced Edition Software CVAE versions 7.x through 8.x before 8.4.0-00 XP7 CVAE versions 7.x through 8.x before 8.4.0-00 Description The issue allows remote attackers to execute arbitrary commands via a crafted serializ...

CVE-2016-2003: Undefined Security Weakness

HPE P9000 Command View Advanced Edition Software CVAE 7.x and 8.x before 8.4.0-00 and XP7 CVAE 7.x and 8.x before 8.4.0-00 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections ACC library...

CVE-2015-5348

CVE-2015-5348 affects Apache Camel: deserialization of HTTP requests using content-header: application/x-java-serialized-object via camel-jetty or camel-servlet, allowing remote code execution. Affected: Camel 2.6.x–2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1. Root cause: insecure Java...

CVE-2015-5348

Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using 1 camel-jetty or 2 camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request...

PT-2016-3685

Name of the Vulnerable Software and Affected Versions Apache Camel versions 2.6.x through 2.14.x Apache Camel versions 2.15.x before 2.15.5 Apache Camel versions 2.16.x before 2.16.1 Description The issue allows remote attackers to execute arbitrary commands via a crafted serialized Java object i...

CVE-2016-2170

Apache OFBiz 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library...

Design/Logic Flaw

Apache OFBiz 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library...

CVE-2016-2170

Apache OFBiz 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library...

PT-2016-5045

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions 12.04.x through 12.04.05 Apache OFBiz versions 13.07.x through 13.07.02 Description The issue allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons...

CVE-2016-2170: Improper Input Validation

Apache OFBiz 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library...

Design/Logic Flaw

HPE Asset Manager 9.40, 9.41, and 9.50 and Asset Manager CloudSystem Chargeback 9.40 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections ACC library...

CVE-2016-2000

HPE Asset Manager 9.40, 9.41, and 9.50 and Asset Manager CloudSystem Chargeback 9.40 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections ACC library...

PT-2016-1644

Name of the Vulnerable Software and Affected Versions HPE Asset Manager versions 9.40 through 9.50 Asset Manager CloudSystem Chargeback version 9.40 Description The issue is related to incorrect data processing, allowing a remote attacker to execute arbitrary commands using a specially crafted...

HP Operations Orchestration 10.x < 10.51 Java Object Deserialization RCE

The version of HP Operations Orchestration installed on the remote host is 10.x prior to 10.51. It is, therefore, affected by a remote code execution vulnerability due to unsafe deserialize calls of unauthenticated Java objects to the Apache Commons Collections ACC library. An unauthenticated,...