CatDV 9.2 - RMI Authentication Bypass Exploit

Exploit Title: CatDV 9.2 - RMI Authentication Bypass Exploit Author: Christopher Ellis, Nick Gonella, Workday Inc. Vendor Homepage: https://catdv.com/ Software Link: https://www.squarebox.com/download/CatDVServer9.2.0.exe Version: 9.2 and lower Tested on: Windows, Mac import org.h2.engine.User;...

CatDV 9.2 Authentication Bypass

Exploit Title: CatDV 9.2 - RMI Authentication Bypass Date: 3/1/2021 Exploit Author: Christopher Ellis, Nick Gonella, Workday Inc. Vendor Homepage: https://catdv.com/ Software Link: https://www.squarebox.com/download/CatDVServer9.2.0.exe Version: 9.2 and lower Tested on: Windows, Mac import...

CatDV 9.2 - RMI Authentication Bypass

Exploit Title: CatDV 9.2 - RMI Authentication Bypass Date: 3/1/2021 Exploit Author: Christopher Ellis, Nick Gonella, Workday Inc. Vendor Homepage: https://catdv.com/ Software Link: https://www.squarebox.com/download/CatDVServer9.2.0.exe Version: 9.2 and lower Tested on: Windows, Mac import...

The vulnerability of the org.aoju.busproxy.provider.remoting.RmiProvider component in the Jackson-databind library of the FasterXML project allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the org.aoju.busproxy.provider.remoting.RmiProvider component in the Jackson-databind library of the FasterXML project is related to the restoration of unreliable data in memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrit...

Security Bulletin: IBM Network Performance Insight 1.3.1 affected by Apache Cassandra vulnerability (CVE-2020-13946)

Summary IBM Network Performance Insight 1.3.1 affected by Apache Cassandra vulnerability CVE-2020-13946 Vulnerability Details CVEID: CVE-2020-13946 DESCRIPTION: Apache Cassandra is vulnerable to a man-in-the-middle attack, caused by a RMI rebind vulnerability. By manipulating the RMI registry, an...

Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to a security vulnerability (CVE-2020-4958)

Summary IBM has announced a release for IBM Security Identity Governance and Intelligence IGI in response to security vulnerability. The vulnerability is due to the RMI connectors that do not appear to be authenticated. Vulnerability Details CVEID: CVE-2020-4958 DESCRIPTION: IBM Security Identity...

Security Bulletin: Apache ActiveMQ Vulnerability Affects IBM Control Center (CVE-2020-13920)

Summary Apache ActiveMQ is vulnerable to a man-in-the-middle attack. Vulnerability Details CVEID: CVE-2020-13920 DESCRIPTION: Apache ActiveMQ is vulnerable to a man-in-the-middle attack, caused by improper authentication validation when connecting to the JMX RMI registry. By creating another serv...

Security Bulletin: Vulnerability in Apache Cassandra affecting Watson Knowledge Catalog for IBM Cloud Pak for Data

Summary There is a man-in-the-middle attack vulnerability in the Apache Cassandra service packaged as part of Watson Knowledge Catalog for IBM Cloud Pak for Data. The issue is now addressed. Vulnerability Details CVEID: CVE-2020-13946 DESCRIPTION: Apache Cassandra is vulnerable to a...

Virtuozzo 6 : java-1.8.0-openjdk / java-1.8.0-openjdk-debug / etc (VZLSA-2019-0774)

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider

A flaw was found in jackson-databind 2.x prior to version 2.9.10.4. The interaction between serialization gadgets and typing is mishandled in the bus-proxy. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

Apache Cassandra 1.2.x <= 1.2.19 / 2.0.x <= 2.0.13 / 2.1.x <= 2.1.3 RCE

The default configuration in Apache Cassandra running on the remote host version 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 bound an unauthenticated JMX/RMI interface to all network interfaces. A remote attacker able to access the RMI, an API for the transport and remote...

Apache Cassandra < 2.1.22 / 2.2.x < 2.2.18 / 3.0.x < 3.0.22 / 3.11.x < 3.11.8 Information Disclosure Vulnerability

The version of Apache Cassandra running on the remote host is prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2. It is, therefore, affected by information disclosure vulnerability. An unauthenticated, local attacker without access to the Apache Cassandra process or configuration files can...

Remote Code Execution in Apache Synapse

In Apache Synapse, by default no authentication is required for Java Remote Method Invocation RMI. So Apache Synapse 3.0.1 or all previous releases 3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1 allows remote code execution attacks that can be performed by injecting specially crafted serialized objects...

Apache Synapse < 3.0.1 Remote Code Execution Vulnerability

All Apache Synapse releases previous to 3.0.1 installed on the remote host are affected by a Remote Code Execution vulnerability. This can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.2.1 commons-collections-3.2.1.jar or previous...

jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider

A flaw was found in jackson-databind 2.x prior to version 2.9.10.4. The interaction between serialization gadgets and typing is mishandled in the bus-proxy. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

RmiTaste - Allows Security Professionals To Detect, Enumerate, Interact And Exploit RMI Services By Calling Remote Methods With Gadgets From Ysoseria

RmiTaste allows security professionals to detect, enumerate, interact and attack RMI services by calling remote methods with gadgets from ysoserial. It also allows to call remote method with specific parameters. Disclaimer RmiTaste was written to aid security professionals in identifying insecure...

Debian DLA-2400-1 : activemq security update

Apache ActiveMQ, a Java message broker, uses LocateRegistry.createRegistry to create the JMX RMI registry and binds the server to the 'jmxrmi' entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker...

[SECURITY] [DLA 2400-1] activemq security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2400-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany October 07, 2020 https://wiki.debian.org/LTS -...

HP Device Manager 4.x < 4.7 SP 13 / 5.x < 5.0.4 Multiple Vulnerabilities

According to its self-reported version number, the version of HP Device Manager installed on the remote Windows host is 4.x prior to 4.7 SP 13 or 5.x prior to 5.0.4. It is, therefore, affected by multiple vulnerabilities: - A weak cipher implementation that is susceptible to dictionary attacks...

HP Device Manager Cavalcade of Critical CVEs (CVE-2020-6925:6927): What You Need to Know

HP released a security bulletin on Sept. 25, 2020, disclosing a set of vulnerabilities in HP Device Manager that—when some are chained together—can result in a remote attacker gaining SYSTEM privileges on the target node. Note: A backdoor database user exists in the PostgreSQL database used by HP...