Virtuozzo 6 : java-1.8.0-openjdk / java-1.8.0-openjdk-debug / etc (VZLSA-2017-1789)

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...

Potential deserialization of untrusted data in Vaadin 7 and 8 when JMX or RMI are enabled

Certain classes in com.vaadin:vaadin-server version 7 all versions of Vaadin 7, and com.vaadin:vaadin-compatibility-server version 8 all versions of Vaadin 8 allows attacker to perform unsafe deserialization when JMX or RMI are enabled. See CWE-502: Deserialization of Untrusted Data Description...

Deserialization of untrusted data

A Java deserialization vulnerability in Cisco Unity Express CUE could allow an unauthenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An...

Cisco Unity Express Arbitrary Command Execution Vulnerability

A Java deserialization vulnerability in Cisco Unity Express CUE could allow an unauthenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An...

Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass)

// All respects goes to Zhiyi Zhang of 360 ESG Codesafe Team // URL: https://blogs.projectmoon.pw/2018/10/19/Oracle-WebLogic-Two-RCE-Deserialization-Vulnerabilities/ package ysoserial.payloads; import com.sun.jndi.rmi.registry.ReferenceWrapperStub; import sun.rmi.server.UnicastRef; import...

Improper Input Validation

Fastjson allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java...

SUSE SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2018:1692-2)

This update for java-170-openjdk to version 7u181 fixes the following issues : S8162488: JDK should be updated to use LittleCMS 2.8 S8180881: Better packaging of deserialization S8182362: Update CipherOutputStream Usage S8183032: Upgrade to LittleCMS 2.9 S8189123: More consistent classloading...

SUSE SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2018:1690-2)

This update for java-180-openjdk to version 8u171 fixes the following issues : These security issues were fixed : S8180881: Better packaging of deserialization S8182362: Update CipherOutputStream Usage S8183032: Upgrade to LittleCMS 2.9 S8189123: More consistent classloading S8189969,...

SUSE-SU-2018:1692-2 Security update for java-1_7_0-openjdk

This update for java-170-openjdk to version 7u181 fixes the following issues: + S8162488: JDK should be updated to use LittleCMS 2.8 + S8180881: Better packaging of deserialization + S8182362: Update CipherOutputStream Usage + S8183032: Upgrade to LittleCMS 2.9 + S8189123: More consistent...

openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2018-1143) (Spectre)

This update for java-180-openjdk to the jdk8u181 icedtea 3.9.0 release fixes the following issues : These security issues were fixed : - CVE-2018-2938: Difficult to exploit vulnerability allowed unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful...

openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2018-1138)

This update for java-180-openjdk to the jdk8u181 icedtea 3.9.0 release fixes the following issues : These security issues were fixed : - CVE-2018-2938: Difficult to exploit vulnerability allowed unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful...

Deserialization of untrusted data

The TP-LINK EAP Controller is TP-LINK's software for remotely controlling wireless access point devices. It utilizes a Java remote method invocation RMI service for remote control. The RMI interface does not require any authentication before use, so it lacks user authentication for RMI service...

CVE-2018-5393 TP-Link EAP Controller versions 2.5.3 and earlier lack RMI authentication

The TP-LINK EAP Controller is TP-LINK's software for remotely controlling wireless access point devices. It utilizes a Java remote method invocation RMI service for remote control. The RMI interface does not require any authentication before use, so it lacks user authentication for RMI service...

CVE-2018-5393

The CVE-2018-5393 issue affects TP-LINK EAP Controller (incl. Linux) with RMI-based remote control and no authentication for RMI commands in versions 2.5.3 and earlier. A deserialization attack over Java RMI could allow a remote attacker to take control of the target server and execute Java funct...

TP-Link EAP Controller lacks RMI authentication and is vulnerable to deserialization attacks

Overview The TP-LINK EAP Controller is TP-LINK's software for remotely controlling wireless access point devices. EAP Controller for Linux lacks user authentication for RMI service commands, as well as utilizes an outdated vulnerable version of Apache commons-collections, which may allow an...

CVE-2018-11247

The JMX/RMI interface in Nasdaq BWise 5.0 does not require authentication for an SAP BO Component, which allows remote attackers to execute arbitrary code via a session on port 81...

Design/Logic Flaw

The JMX/RMI interface in Nasdaq BWise 5.0 does not require authentication for an SAP BO Component, which allows remote attackers to execute arbitrary code via a session on port 81...

CVE-2018-11247

The JMX/RMI interface in Nasdaq BWise 5.0 does not require authentication for an SAP BO Component, which allows remote attackers to execute arbitrary code via a session on port 81...

CVE-2018-11247

Summary: CVE-2018-11247 affects Nasdaq BWise 5.0 via the JMX/RMI interface (SAP BO Component). The vulnerability arises from no authentication on port 81, enabling remote attackers to load and execute arbitrary code. The exploit path described involves connecting to the MBean server and using met...

Nasdaq BWise 5.0 JMX/RMI Interface Remote Code Execution

CONVISO-18-001 - Nasdaq BWise JMX/RMI RCE 1. Advisory Information Conviso Advisory ID: CONVISO-18-001 CVE ID: CVE-2018-11247 CVSS v2: CVSS v2: 8.8,AV:N/AC:M/Au:N/C:C/I:C/A:N Date: 16/05/2018 2. Affected Components Nasdaq BWise 5.0 JMX/RMI interface 3. Description Nasdaq BWise 5.0, through its...