GHSA-4344-FRCP-J22Q Remote code execution due to insecure deserialization

A flaw was found in the way JBoss RichFaces handled deserialization. A remote attacker could use this flaw to trigger the execution of the deserialization methods in any serializable class deployed on the server. This could lead to a variety of security impacts depending on the deserialization...

Remote code execution due to insecure deserialization

A flaw was found in the way JBoss RichFaces handled deserialization. A remote attacker could use this flaw to trigger the execution of the deserialization methods in any serializable class deployed on the server. This could lead to a variety of security impacts depending on the deserialization...

Arbitrary code execution in Richfaces

JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language EL expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310...

GHSA-4J38-WJHF-884R Arbitrary code execution in Richfaces

JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language EL expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310...

GHSA-3HX6-FQPJ-XFJR RichFaces vulnerable to Expression Language Injection

JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language EL variable mapper and execute arbitrary Java code via a MediaOutputResource's resource request, aka RF-14309...

RichFaces vulnerable to Expression Language Injection

JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language EL variable mapper and execute arbitrary Java code via a MediaOutputResource's resource request, aka RF-14309...

GHSA-J7MW-7CRR-658V Richfaces vulnerable to arbitrary code execution

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language EL injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData...

Exploit for Code Injection in Redhat Richfaces

CVE-2018-14667-poc Richfaces漏洞环境及PoC 靶场：vulenvironment下的war包直接丢到tomcat即可 PoC build:build artifactId run:java -jar CVE-2018-14667-poc.jar "cmd" about debug 直接将vulenvironment下的war包下的war解压，然后从idea导入，并将tomcat下的lib添加到library path request demo： GET...

CVE-2015-0279: Expression Language Injection in FortiSIEM

An expression language injection vulnerability in FortiSIEM JBoss RichFaces library may allow a remote attacker to inject expression language EL expressions and execute arbitrary Java code via the do parameter...

CVE-2013-4521

RichFaces implementation in Nuxeo Platform 5.6.0 before HF27 and 5.8.0 before HF-01 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data. NOTE: this vulnerability may overlap CVE-2013-216...

Deserialization of untrusted data

RichFaces implementation in Nuxeo Platform 5.6.0 before HF27 and 5.8.0 before HF-01 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data. NOTE: this vulnerability may overlap CVE-2013-216...

CVE-2013-4521

RichFaces implementation in Nuxeo Platform 5.6.0 before HF27 and 5.8.0 before HF-01 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data. NOTE: this vulnerability may overlap CVE-2013-216...

CVE-2013-4521

CVE-2013-4521 affects the RichFaces deserialization path in Nuxeo Platform (versions 5.6.0 before HF27 and 5.8.0 before HF-01). The vulnerability arises because the implementation does not restrict which classes’ deserialization methods can be called, enabling a remote attacker to execute arbitra...

CVE-2018-14667

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language EL injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData...

Exploit for Code Injection in Redhat Richfaces

CVE-2018-14667-poc Richfaces漏洞环境及PoC 靶场：vulenvironment下的w...

Tufin Secure Change Remote Code Execution Exploit

Tufin SecureChange uses Richfaces version 4.3.5 which suffers from a remote code execution vulnerability. Product: Secure Change Vendor: Tufin Subject: Tufin SecureChange uses Richfaces 4.3.5, vulnerable to CVE-2015-0279 unauthenticated RCE CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H base score...

The vulnerability of the RichFaces library, related to errors in code generation, allows attackers to execute arbitrary Java code.

The vulnerability of the RichFaces library is related to errors in code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary Java code with privileges of the target server...

Remote Code Execution (RCE)

richfaces is vulnerable to Remote code Execution RCE attacks. The vulnerability is due to improper Expression Language EL sanitization in the UserResource class. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects gadget chains...

Arbitrary Code Execution

richfaces is vulnerable to arbitrary code execution attacks. The vulnerabitiy exists as JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language EL expressions and execute arbitrary Java code via a /DATA/ substring in a path with an...

Remote Code Execution Through Deserialization Attack

RichFaces is vulnerable to remote code execution through deserialization attacks. The ResourceBuilderImpl.java class in RichFaces does not restrict the classes which can be deserialized, allowing remote attackers to execute code...