CVE-2020-9496

CVE-2020-9496 affects Apache OFBiz 17.12.x. The vulnerability stems from unsafe deserialization in the XML-RPC endpoint (/webtools/control/xmlrpc), enabling cross-site scripting and remote code execution via crafted XML-RPC requests. Affected version shown in sources includes 17.12.01 (and later ...

CVE-2020-1948

This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More detai...

Design/Logic Flaw

This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More detai...

CVE-2020-1948

This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More detai...

CVE-2020-1948

CVE-2020-1948 affects Apache Dubbo before 2.7.8 (and related versions) where deserialization of untrusted data in RPC requests can trigger remote code execution. The vulnerability targets the Dubbo Provider component and allows an attacker to send RPC calls with unrecognized service/method names ...

Apache OFBiz XML-RPC Java Deserialization

This module exploits a Java deserialization vulnerability in Apache OFBiz's unauthenticated XML-RPC endpoint /webtools/control/xmlrpc for versions prior to 17.12.01 using the ROME gadget chain. Versions up to 18.12.11 are exploitable utilizing an auth bypass CVE-2023-51467 and use the...

Huawei EulerOS: Security Advisory for glusterfs (EulerOS-SA-2020-1720)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for samba (EulerOS-SA-2020-1746)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Remote Code Execution (RCE)

dubbo-rpc-dubbo is vulnerable to remote code execution RCE. The library does not ignore deserialization when service or method not found, allowing a malicious user to execute malicious code by sending the rpc requests with unrecognized service name or method name...

EulerOS Virtualization 3.0.6.0 : glusterfs (EulerOS-SA-2020-1720)

According to the versions of the glusterfs packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in RPC request using gfs3renamereq in glusterfs server. An authenticated attacker could use this flaw to writ...

EulerOS Virtualization 3.0.6.0 : samba (EulerOS-SA-2020-1746)

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U MS-SFU Kerbero...

Security fix for the ALT Linux 9 package freerdp version 2.1.2-alt1

2.1.2-alt1 built June 25, 2020 Andrey Cherepanov in task 253866 June 23, 2020 Andrey Cherepanov - New version. - Fixes: + CVE-2020-4033 Out of bound read in RLEDECOMPRESS + CVE-2020-4031 Use-After-Free in gdiSelectObject + CVE-2020-4032 Integer casting vulnerability in updaterecvsecondaryorder +...

CVE-2020-9480

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication spark.authenticate via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even...

Authentication flaw

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication spark.authenticate via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even...

The vulnerability of the /rpc/api component of the Red Hat Spacewalk system management software allows a attacker to disclose sensitive information, cause service failures, or execute arbitrary code.

The vulnerability of the /rpc/api component of the Red Hat Spacewalk software suite relates to incorrect restrictions on XML links to external objects. Exploitation of this vulnerability could allow a malicious actor to disclose sensitive information, cause service failures, or execute arbitrary...

Morgan Stanley Hobbes Out-of-Bounds Read/Write Vulnerability

Morgan Stanley Hobbes is an embedded language compiler and runtime program from Morgan Stanley USA. An out-of-bounds read/write vulnerability exists in Morgan Stanley Hobbes version 2020-05-21 and earlier. The vulnerability stems from a lack of boundary checking in the array implementation. An...

CVE-2020-13656

In Morgan Stanley Hobbes through 2020-05-21, the array implementation lacks bounds checking, allowing exploitation of an out-of-bounds OOB read/write vulnerability that leads to both local and remote code via RPC execution...

Out-of-bounds

In Morgan Stanley Hobbes through 2020-05-21, the array implementation lacks bounds checking, allowing exploitation of an out-of-bounds OOB read/write vulnerability that leads to both local and remote code via RPC execution...

CVE-2020-13656

In Morgan Stanley Hobbes through 2020-05-21, the array implementation lacks bounds checking, allowing exploitation of an out-of-bounds OOB read/write vulnerability that leads to both local and remote code via RPC execution...

CVE-2020-13656

Morgan Stanley Hobbes contains an out-of-bounds read/write vulnerability in its array implementation, reported up to 2020-05-21. The缺 bound checking flaw allows an attacker to trigger OOB access, enabling code execution via RPC. Affected version details: Hobbes 2020-05-21 and earlier (per CNVD-20...