RichFaces Expression Language Injection Vulnerability

RichFaces Framework is an open source JSF component framework. A security vulnerability exists in RichFaces Framework versions 3.X through 3.3.4. A remote attacker can exploit the vulnerability to execute arbitrary code...

Code injection

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language EL injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData...

CVE-2018-14667

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language EL injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData...

CVE-2018-14667

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language EL injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData...

RichFaces: Expression Language injection via UserResource allows for unauthenticated remote code execution

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language EL injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData...

Critical: Red Hat Security Advisory: JBoss Enterprise Application Platform 5.2.0 security update

An update is now available for Red Hat JBoss Enterprise Application Platform 5 for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

RichFaces: Expression Language injection via UserResource allows for unauthenticated remote code execution

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language EL injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData...

CVE-2018-14667

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language EL injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData. Recen...

SQL Injection Vulnerability in ZZCMS fu***.php Page

ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A SQL injection vulnerability exists in the ZZCMS fu.php page. An attacker can exploit the vulnerability to obtain sensitive information from the database...

SQL Injection Vulnerability in the Frontend of Online Learning System of Beijing Xinqi Technology Co.

Beijing Xinqi Technology Co., Ltd. is a technical service enterprise specializing in the research and development of training management software. A SQL injection vulnerability exists in the frontend of the online learning system of Beijing Xinqi Technology Co. An attacker can exploit the...

S-CMS News Portal System me***.php page suffers from SQL injection vulnerability

S-CMS news portal system is Zibo Shining Network Technology Co., Ltd. developed a specialized enterprise to provide solutions to build a station. A SQL injection vulnerability exists in the me.php page of the S-CMS news portal system. An attacker can exploit the vulnerability to obtain sensitive...

SQL Injection Vulnerability in Frontend me***.Asp Page of Rongguang Information Ordering and Consumption System

Rongguang Information Ordering and Picking Up Food Consumption System is a multi-functional ordering system developed by Shenzhen Rongguang Information Co. SQL injection vulnerability exists in the front-end me.Asp page of Rongguang Information Ordering and Consumption System, which can be...

RichFaces: Injection of arbitrary EL expressions allows remote code execution via org.richfaces.renderkit.html.Paint2DResource

JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language EL expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310...

SQL injection vulnerability in ShopsN open source online store full web system (CNVD-2018-22114)

ShopsN free version of the B2C e-commerce is a product of Shanghai Yisu Network Technology Co., Ltd. a full-featured enterprise-class commercial standards in line with the real allow free commercial use of open source online store full network system. ShopsN open source online store system has a...

SQL Injection Vulnerability in PHPMyWind Backend

PHPMyWind is a PHP+MySQL based, W3C compliant website building engine for enterprise level website building. A SQL injection vulnerability exists in the backend of PHPMyWind. An attacker can exploit the vulnerability to obtain sensitive database information...

Component AlphaIndex Dictionaries SQL Injection Vulnerability in Joomla!

Joomla! is the United States Open Source Matters team developed a set of open source content management system CMS. A SQL injection vulnerability exists in the Joomla! component AlphaIndex Dictionaries. The vulnerability is caused by an attacker inserting SQL commands into the query string of a w...

SQL injection vulnerability in ShopsN open source online store full web system (CNVD-2018-21970)

ShopsN free version of the B2C e-commerce is a Shanghai Yisu Network Technology Co., Ltd. in line with the enterprise-level commercial standards full-featured really allow free commercial use of open source online store full network system. ShopsN v2.3.5 official version of the existence of SQL...

CVE-2018-17283

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...

UCMS SQL Injection Vulnerability

UCMS is a content management system written in PHP. A SQL injection vulnerability exists in the install/index.php file in UCMS version 1.4.6. A remote attacker can exploit this vulnerability to execute SQL commands with the help of the 'mysqldbname' parameter...

RichFaces: Injection of arbitrary EL expressions allows remote code execution via org.richfaces.renderkit.html.Paint2DResource

JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language EL expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310...