4384 matches found
activemq -- Unsafe deserialization
Alvaro Muatoz, Matthias Kaiser and Christian Schneider reports: JMS Object messages depends on Java Serialization for marshaling/unmashaling of the message payload. There are a couple of places inside the broker where deserialization can occur, like web console or stomp object message...
JAVA serialization and deserialization and vulnerability remediation-vulnerability warning-the black bar safety net
Last week, the network security personnel once again in the Black production before being tumbled, Joomla exposure to high-risk 0Day vulnerabilities, without requiring a user login will be able to trigger. Joomla vulnerability in the official release of the upgrade version and before the patch, i...
JAVA serialization and deserialization, as well as vulnerability remediation-vulnerability warning-the black bar safety net
Last week, the network security personnel once again in the Black production before being tumbled, Joomla exposure to high-risk 0Day vulnerabilities, without requiring a user login will be able to trigger. Joomla vulnerability in the official release of the upgrade version and before the patch, i...
jakarta-commons-collections security update
0:3.2-2jpp.4 - Fix Java object de-serialization vulnerability - Resolves: CVE-2015-7501...
WordPress < 3.7.4 / 3.8.x < 3.8.4 / 3.9.x < 3.9.2 Multiple Vulnerabilities
Binary data 9025.prm...
AIX Java Advisory : java_oct2015_advisory.asc (October 2015 CPU)
The version of Java SDK installed on the remote AIX host is affected by multiple vulnerabilities in the following components : - 2D - CORBA - Deployment - JAXP - JGSS - Libraries - RMI - Security - Serialization %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'...
Amazon Linux AMI : java-1.6.0-openjdk (ALAS-2015-616)
Multiple flaws were discovered in the CORBA, Libraries, RMI, Serialization, and 2D components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. CVE-2015-4835 , CVE-2015-4881 , CVE-2015-4843 , CVE-2015-4883 , CVE-2015-4860 ,...
Adobe Flash - Type Confusion in IExternalizable.readExternal When Performing Local Serialization
Adobe Flash - Type Confusion in IExternalizable.readExternal When Performing Local Serialization Source: https://code.google.com/p/google-security-research/issues/detail?id=548 If IExternalizable.readExternal is overridden with a value that is not a function, Flash assumes it is a function even...
Adobe Flash - Type Confusion in Serialization with ObjectEncoder.dynamicPropertyWriter
Source: https://code.google.com/p/google-security-research/issues/detail?id=545 There is a type confusion issue during serialization if ObjectEncoder.dynamicPropertyWriter is overridden with a value that is not a function. In the following ActionScript:...
Adobe Flash - Type Confusion in IExternalizable.readExternal When Performing Local Serialization
Source: https://code.google.com/p/google-security-research/issues/detail?id=548 If IExternalizable.readExternal is overridden with a value that is not a function, Flash assumes it is a function even though it is not one. This leads to execution of a 'method' outside of the ActionScript object's...
Adobe Flash - Type Confusion in Serialization with ObjectEncoder.dynamicPropertyWriter
Adobe Flash - Type Confusion in Serialization with ObjectEncoder.dynamicPropertyWriter Source: https://code.google.com/p/google-security-research/issues/detail?id=545 There is a type confusion issue during serialization if ObjectEncoder.dynamicPropertyWriter is overridden with a value that is not...
Sqlmap code execution vulnerability report-vulnerability warning-the black bar safety net
Author: Nixawk know Chong Yu 4 0 4 Security lab Date: 2015-12-09 A vulnerability overview In 2 0 1 5 years 0 1 months 2 7 day, I read in the latest version of Sqlmap code, found its existing code enforcement issues. Security by python's pickle cause. pickle module implements a basic but powerful...
Vulnerability in Java Deserialization Affecting Cisco Products
A vulnerability in the Java deserialization used by the Apache Commons Collections ACC library could allow an unauthenticated, remote attacker to execute arbitrary code. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could explo...
OpenMRS 2.3 (1.11.4) - Expression Language Injection Vulnerability
Exploit for php platform in category web applications OpenMRS 2.3 1.11.4 Expression Language Injection Vulnerability Vendor: OpenMRS Inc. Product web page: http://www.openmrs.org Affected version: OpenMRS 2.3, 2.2, 2.1, 2.0 Platform 1.11.4 Build 6ebcaf, 1.11.2 and 1.10.0 OpenMRS-TB System OpenMRS...
OpenMRS 2.3 (1.11.4) - XML External Entity Processing
!/usr/bin/env python OpenMRS 2.3 1.11.4 XML External Entity XXE Processing PoC Exploit Vendor: OpenMRS Inc. Product web page: http://www.openmrs.org Affected version: OpenMRS 2.3, 2.2, 2.1, 2.0 Platform 1.11.4 Build 6ebcaf, 1.11.2 and 1.10.0 OpenMRS-TB System OpenMRS 1.9.7 Build 60bd9b Summary:...
groovy: remote execution of untrusted code in class MethodClosure
A flaw was discovered in the way applications using Groovy used the standard Java serialization mechanism. A remote attacker could use a specially crafted serialized object that would execute code directly when deserialized. All applications which rely on serialization and do not isolate the code...
Important: Red Hat Security Advisory: Red Hat JBoss Fuse 6.2.1 update
Red Hat JBoss Fuse 6.2.1, which fixes three security issues, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores,...
groovy: remote execution of untrusted code in class MethodClosure
A flaw was discovered in the way applications using Groovy used the standard Java serialization mechanism. A remote attacker could use a specially crafted serialized object that would execute code directly when deserialized. All applications which rely on serialization and do not isolate the code...
Important: Red Hat Security Advisory: Red Hat JBoss Fuse Service Works 6.2.1 update
Red Hat JBoss Fuse Service Works 6.2.1, which fixes three security issues and various bugs, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give...
groovy: remote execution of untrusted code in class MethodClosure
A flaw was discovered in the way applications using Groovy used the standard Java serialization mechanism. A remote attacker could use a specially crafted serialized object that would execute code directly when deserialized. All applications which rely on serialization and do not isolate the code...