124 matches found
Deserialization of Untrusted Data in Jython
Jython before 2.7.1b3 allows attackers to execute arbitrary code via a crafted serialized PyFunction object...
Mageia: Security Advisory (MGASA-2015-0096)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
GitHub Security Lab: [Java] CWE-094: Jython code injection
This bug was reported directly to GitHub Security Lab...
AuthMatrix - A Burp Suite Extension That Provides A Simple Way To Test Authorization
AuthMatrix is an extension to Burp Suite that provides a simple way to test authorization in web applications and web services. With AuthMatrix, testers focus on thoroughly defining tables of users, roles, and requests for their specific target application upfront. These tables are structured in ...
Oracle Application Testing Suite Multiple Vulnerabilities (Jan 2020 CPU)
The version of Oracle Application Testing Suite installed on the remote host is affected by multiple vulnerabilities : - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager component: Oracle Flow Builder Jython. Supported versions that are affected are...
Asset Discover - Burp Suite Extension To Discover Assets From HTTP Response
Burp Suite extension to discover assets from HTTP response using passive scanning. Refer our blog Asset Discovery using Burp Suite for more details. The extension is now part of the BApp store and can be installed directly from the Burp Suite...
FLASHMINGO - Automatic Analysis Of SWF Files Based On Some Heuristics
Automatic Analysis Of SWF Files Based On Some Heuristics. Extensible Via Plugins. Install Install the Python 2.7 packages listed in requirements.txt. You can use the following command: pip install -r requirements.txt If you want to use the decompilation functionality you need to install Jython...
Oracle Enterprise Manager Cloud Control (January 2019 CPU)
The version of Oracle Enterprise Manager Cloud Control installed on the remote host is affected by multiple vulnerabilities in Enterprise Manager Base Platform component: - A remote code execution vulnerability exists in Jython before 2.7.1rc1. An unauthenticated, remote attacker can exploit this...
ZIP File Raider - Burp Extension For ZIP File Payload Testing
ZIP File Raider is a Burp Suite extension for attacking web application with ZIP file upload functionality. You can easily inject Burp Scanner/Repeater payloads in ZIP content of the HTTP requests which is not feasible by default. This extension helps to automate the extraction and compression...
Debian: Security Advisory (DLA-989-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
GLSA-201710-28 : Jython: Arbitrary code execution
The remote host is affected by the vulnerability described in GLSA-201710-28 Jython: Arbitrary code execution It was found that Jython is vulnerable to arbitrary code execution by sending a serialized function to the deserializer. Impact : Remote execution of arbitrary code by enticing a user to...
Jython: Arbitrary code execution
Background An implementation of Python written in Java. Description It was found that Jython is vulnerable to arbitrary code execution by sending a serialized function to the deserializer. Impact Remote execution of arbitrary code by enticing a user to execute malicious code. Workaround There is ...
The vulnerability of the Jython software platform, related to the restoration of unreliable data in memory, allowing a hacker to execute arbitrary code.
The vulnerability of the Jython software platform lies in the possibility of restoring unreliable data in memory. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code using a specially created serialized object of type PyFunction...
F5 Networks BIG-IP : Python and Jython vulnerability (K53192206)
REJECT Various versions of Python do not properly restrict readline calls, which allows remote attackers to cause a denial of service memory consumption via a long string, related to 1 httplib - fixed in 2.7.4, 2.6.9, and 3.3.3; 2 ftplib - fixed in 2.7.6, 2.6.9, 3.3.3; 3 imaplib - not yet fixed i...
F5 Networks BIG-IP : Python and Jython vulnerability (K78825687)
Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain sensitive information from process memory via a large size and offset in a 'buffer' function. CVE-2014-7185 C Tenable Network Security, Inc. The descriptive text and package checks in this plugi...
Oracle WebLogic Server Multiple Vulnerabilities (July 2017 CPU)
The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities : - A flaw exists in Jython due to executable classes being created with insecure permissions. A local attacker can exploit this to bypass intended access restrictions and thereby disclose...
Jython Arbitrary Code Execution Vulnerability
Jython is an implementation of the Python programming language that runs on the Java platform. An arbitrary code execution vulnerability exists in Jython. Allows an attacker to execute arbitrary code via specially designed serialized PyFunction objects...
DEBIAN-CVE-2016-4000
Jython before 2.7.1rc1 allows attackers to execute arbitrary code via a crafted serialized PyFunction object...