Denial Of Service (DoS)

karaf is susceptible to denial of service DoS attacks. It does not prevent a local attacker from invoking the shutdown command to all listening high ports, leading to the karaf server shutting down...

Authentication flaw

Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial of service shutdown by sending a shutdown command to all listening high ports...

CVE-2014-0219

Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial of service shutdown by sending a shutdown command to all listening high ports...

CVE-2014-0219

Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial of service shutdown by sending a shutdown command to all listening high ports...

CVE-2014-0219

Apache Karaf before 4.0.10 is affected by CVE-2014-0219. The issue allows local users to trigger a denial of service by sending a shutdown command to the shutdown port exposed on the loopback interface, targeting all listening high ports. The vulnerability stems from a misconfigured shutdown port...

CVE-2015-1778

The custom authentication realm used by karaf-tomcat's "opendaylight" realm in Opendaylight before Helium SR3 will authenticate any username and password combination...

Design/Logic Flaw

The custom authentication realm used by karaf-tomcat's "opendaylight" realm in Opendaylight before Helium SR3 will authenticate any username and password combination...

CVE-2015-1778

CVE-2015-1778 concerns OpenDaylight’s OpenDaylight Helium lineage. The vulnerability arises from the custom authentication realm used by karaf-tomcat’s opendaylight realm, which will authenticate any username/password combination in OpenDaylight installations prior to Helium SR3. The result is an...

Unauthorized Access

karaf-webconsole is vulnerable to unauthorized access. The vulnerability exists when the gogo feature is installed with the webconsole feature, causing the /gogo endpoint to be accessed without authentication...

BlackBerry Good Enterprise Mobility Server Arbitrary Command Execution Vulnerability

The BlackBerry Good Enterprise Mobility Server GEMS is an enterprise mobility server from BlackBerry Canada. A security vulnerability exists in Apache Karaf in BlackBerry GEMS versions 2.1.5.3 through 2.2.22.25. A remote attacker could exploit the vulnerability by executing commands to gain local...

CVE-2016-3129

A remote shell execution vulnerability in the BlackBerry Good Enterprise Mobility Server GEMS implementation of the Apache Karaf command shell in GEMS versions 2.1.5.3 to 2.2.22.25 allows remote attackers to obtain local administrator rights on the GEMS server via commands executed on the Karaf...

Remote code execution

A remote shell execution vulnerability in the BlackBerry Good Enterprise Mobility Server GEMS implementation of the Apache Karaf command shell in GEMS versions 2.1.5.3 to 2.2.22.25 allows remote attackers to obtain local administrator rights on the GEMS server via commands executed on the Karaf...

CVE-2016-3129

A remote shell execution vulnerability in the BlackBerry Good Enterprise Mobility Server GEMS implementation of the Apache Karaf command shell in GEMS versions 2.1.5.3 to 2.2.22.25 allows remote attackers to obtain local administrator rights on the GEMS server via commands executed on the Karaf...

CVE-2016-3129

The CVE-2016-3129 entry describes a remote code execution vulnerability in BlackBerry Good Enterprise Mobility Server (GEMS) via the Apache Karaf command shell. Affected versions are 2.1.5.3 through 2.2.22.25. An attacker can execute commands to gain local administrator rights on the GEMS server....

LDAP Code Injection

org.apache.karaf.jaas.modules is vulnerable to LDAP code injection. This is caused because the username is not encoded...

Apache Karaf Remote Code Execution Vulnerability

Karaf is an open source project under the Apache , to provide a can be used to deploy a variety of components , applications, OSGi containers . A remote code execution vulnerability exists in Apache Karaf. An attacker exploiting the vulnerability could execute arbitrary code in the context of an...

CVE-2016-8648

It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via JMX operations. An attacker could use this flaw to execute remote code on the server as the user running the Java Virtual Machine if the target MBean contain...

Apache Karaf Default Credentials (SSH)

The remote Apache Karaf is using known default credentials. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Apache Karaf Login Utility

This module attempts to log into Apache Karaf's SSH. If the TRYDEFAULTCRED option is set, then it will also try the default 'karaf' credential. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'net/ssh' require...

Apache Karaf Default Credentials Command Execution

This module exploits a default misconfiguration flaw on Apache Karaf versions 2.x-4.x. The 'karaf' user has a known default password, which can be used to login to the SSH service, and execute operating system commands from remote. Module Options msf use...