CVE-2021-41588

CVE-2021-41588 affects Gradle Enterprise before 2021.1.3. A crafted HTTP request can trigger deserialization of arbitrary unsafe Java objects, with exploitation requiring access to the encryption and signing keys. Several sources indicate the issue may enable remote code execution and impacts pri...

Meow Gallery < 4.1.9 - Contributor+ SQL Injection

The plugin does not sanitise, validate or escape the ids attribute of its gallery shortcode available for users as low as Contributor before using it in an SQL statement, leading to an authenticated SQL Injection issue. The injection also allows the returned values to be manipulated in a way that...

CVE-2021-34371

Neo4j through 3.4.18 with the shell server enabled exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadget chains...

CVE-2021-34371

Summary of the issue (CVE-2021-34371): Neo4j up to version 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, such as via setSessionVariable. This can enable remote code execution because gadget chains exist in the affected environment. In pr...

ForgeRock Access Management < 7.0 RCE

The version of ForgeRock Access Management detected on the remote host is affected by a remote code execution vulnerability due to unsafe object deserialization. An unauthenticated, remote attacker can exploit this to execute code on the remote host. Note that Nessus has not tested for this issue...

Exploit for Deserialization of Untrusted Data in Apache Ofbiz

CVE-2020-9496 - RCE Because the 2 xmlrpc related requets in we...

Untrusted Object Deserialization

Qcubed is vulnerable to untrusted object deserialization. An attacker is able to inject untrusted PHP object of the POST-variable “strProfileData” and execute code via a malicious POST request...

Arbitrary Code Execution

chromium is vulnerable to arbitrary code execution. A remote attacker to execute arbitrary code inside a sandbox via a malicious HTML page due to insecure execution of user supplied Javascript during object deserialization resulting in an out-of-bounds write...

Exploit for CVE-2020-2883

what's this This project which based weblogiccmd is a poc for...

SUSE-SU-2020:1511-2 Security update for java-11-openjdk

This update for java-11-openjdk fixes the following issues: Java was updated to jdk-11.0.7+10 April 2020 CPU, bsc1169511. Security issues fixed: - CVE-2020-2754: Fixed an incorrect handling of regular expressions that could have resulted in denial of service bsc1169511. - CVE-2020-2755: Fixed an...

Oracle WebLogic Server Java Object Deserialization RCE (CVE-2020-2883)

Binary data oracleweblogicservercve20202883.nbin...

SUSE SLES12 Security Update : ruby2.1 (SUSE-SU-2020:1570-1)

This update for ruby2.1 fixes the following issues : Security issues fixed : CVE-2015-9096: Fixed an SMTP command injection via CRLFsequences in a RCPT TO or MAIL FROM command bsc1043983. CVE-2016-7798: Fixed an IV Reuse in GCM Mode bsc1055265. CVE-2017-0898: Fixed a buffer underrun vulnerability...

SUSE-SU-2020:1572-1 Security update for java-11-openjdk

This update for java-11-openjdk fixes the following issues: Java was updated to jdk-11.0.7+10 April 2020 CPU, bsc1169511. Security issues fixed: - CVE-2020-2754: Fixed an incorrect handling of regular expressions that could have resulted in denial of service bsc1169511. - CVE-2020-2755: Fixed an...

SUSE-SU-2020:1570-1 Security update for ruby2.1

This update for ruby2.1 fixes the following issues: Security issues fixed: - CVE-2015-9096: Fixed an SMTP command injection via CRLFsequences in a RCPT TO or MAIL FROM command bsc1043983. - CVE-2016-7798: Fixed an IV Reuse in GCM Mode bsc1055265. - CVE-2017-0898: Fixed a buffer underrun...

WebLogic Server Deserialization Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WebLogic Server Deserialization RCE BadAttributeValueExpException ExtComp', 'Description' = %q There exists a Java object deserialization...

openSUSE Security Update : java-11-openjdk (openSUSE-2020-757)

This update for java-11-openjdk fixes the following issues : Java was updated to jdk-11.0.7+10 April 2020 CPU, bsc1169511. Security issues fixed : - CVE-2020-2754: Fixed an incorrect handling of regular expressions that could have resulted in denial of service bsc1169511. - CVE-2020-2755: Fixed a...

openSUSE: Security Advisory for java-11-openjdk (openSUSE-SU-2020:0757-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for java-11-openjdk (important)

openSUSE Security Update: Security update for java-11-openjdk Announcement ID: openSUSE-SU-2020:0757-1 Rating: important References: 1167462 1169511 Cross-References: CVE-2020-2754 CVE-2020-2755 CVE-2020-2756 CVE-2020-2757 CVE-2020-2767 CVE-2020-2773 CVE-2020-2778 CVE-2020-2781 CVE-2020-2800...

SUSE-SU-2020:1511-1 Security update for java-11-openjdk

This update for java-11-openjdk fixes the following issues: Java was updated to jdk-11.0.7+10 April 2020 CPU, bsc1169511. Security issues fixed: - CVE-2020-2754: Fixed an incorrect handling of regular expressions that could have resulted in denial of service bsc1169511. - CVE-2020-2755: Fixed an...

Security Bulletin: Vulnerability in Apache Commons affects WebSphere Message Broker and IBM Integration Bus (CVE-2015-7450)

Summary An Apache Commons Collections vulnerability for handling Java object deserialization was addressed in the Global Cache component of WebSphere Message Broker and IBM Integration Bus Vulnerability Details CVEID: CVE-2015-7450 DESCRIPTION: Apache Commons Collections could allow a remote...