302 matches found
CVE-2026-56758
The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment. When parsing certain fields within the calling AP title, an attacker controlled length value of zero or one may cause the parser to read past the end of a heap buffer...
PT-2026-66623
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A flaw exists in the ACSE layer during the processing of AARQ PDUs Application Association Request Protocol Data Units during MMS connection establishment. An...
CVE-2026-50505
CVE-2026-50505 is a Windows Message Queuing (MSMQ) remote code execution vulnerability described as a use-after-free in MSMQ that could allow an authorized attacker to execute code over a network. Public sources (MSRC update guidance) confirm updates addressing this issue and advise applying the ...
CVE-2026-43866
A flaw was found in Apache Camel JMS components. A remote attacker can exploit a deserialization vulnerability by sending a specially crafted ObjectMessage to a queue or topic consumed by an affected Camel application. This bypasses existing security checks, allowing the attacker to inject...
Deserialization of Untrusted Data
Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the JmsBinding.extractBodyFromJms process when handling JMS ObjectMessages with the mapJmsMessage option enabled. An attacker can inject arbitrary Exchange state by publishing a crafted ObjectMessage...
Deserialization of Untrusted Data
Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the JmsBinding.extractBodyFromJms process when handling JMS ObjectMessages with the mapJmsMessage option enabled. An attacker can inject arbitrary Exchange state by publishing a crafted ObjectMessage...
CVE-2026-42527 Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure
Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter pattern shipped with several Apache Camel components for defense-in-depth deserialization filtering 'java.;javax.;org.apache.camel.;!', or the no-'javax.' variant in the aggregation-repository component...
CVE-2026-41855
CVE-2026-41855 affects Spring Framework components MappingJackson2MessageConverter and JacksonJsonMessageConverter in untrusted JMS environments, enabling arbitrary class instantiation and gadget deserialization that could lead to unauthorized actions. Affected versions include Spring Framework 7...
PT-2026-47692
Path traversal vulnerability in the SMS app. Impact: Successful exploitation of this vulnerability may affect availability...
Apache CXF 安全漏洞
Apache CXF is an open-source web service framework developed by the Apache Foundation in the United States. This framework supports various web service standards and multiple front-end programming APIs. There are security vulnerabilities in Apache CXF; these vulnerabilities arise from incomplete...
GHSA-JG2M-9X48-3GVJ Apache Camel has an incomplete fix for CVE-2025-27636
The fix for CVE-2025-27636 added setLowerCasetrue to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCasetrue call was not applied to five non-HTTP HeaderFilterStrategy...
CVE-2025-48609
In multiple functions of MmsProvider.java, there is a possible way to arbitrarily delete files which affect telephony, SMS, and MMS functionalities due to a path traversal error. This could lead to local denial of service with no additional execution privileges needed. User interaction is not...
CVE-2025-48609
In multiple functions of MmsProvider.java, there is a possible way to arbitrarily delete files which affect telephony, SMS, and MMS functionalities due to a path traversal error. This could lead to local denial of service with no additional execution privileges needed. User interaction is not...
CVE-2025-48609
In multiple functions of MmsProvider.java, there is a possible way to arbitrarily delete files which affect telephony, SMS, and MMS functionalities due to a path traversal error. This could lead to local denial of service with no additional execution privileges needed. User interaction is not...
CVE-2025-48609
CVE-2025-48609 involves a path traversal issue in MmsProvider.java across Google Android components that can allow arbitrary file deletion and impact telephony, SMS, and MMS features. The vulnerability can cause a local denial of service without extra privileges or user interaction, as reported b...
CVE-2025-48609
In multiple functions of MmsProvider.java, there is a possible way to arbitrarily delete files which affect telephony, SMS, and MMS functionalities due to a path traversal error. This could lead to local denial of service with no additional execution privileges needed. User interaction is not...
CVE-2026-23685
CVE-2026-23685 describes a deserialization vulnerability in the SAP NetWeaver JMS service. An attacker authenticated as an administrator with local access can submit specially crafted content to the server; if processed by the application, this may trigger unintended logic execution that leads to...
BIT-MOODLE-2025-3645 Moodle: idor in messaging web service allows access to some user details
A flaw was found in Moodle. Insufficient capability checks in a messaging web service allowed users to view other users' names and online statuses...
