The vulnerability of ZTE NR8000 series radio relay system micro-programming software relates to the deserialization process of Java objects, allowing an attacker to execute arbitrary code.

The vulnerability of ZTE NR8000 series radio relay system microprogramming software is related to the process of deserializing Java objects when processing requests via the Java RMI Remote Method Invocation service, using the Apache Commons Collections ACC library. Exploiting this vulnerability...

Apache Commons Jelly Security Bypass Vulnerability

Apache Commons Jelly is the United States Apache Apache Software Foundation of a Java and XML-based scripting engine . A security vulnerability exists in Apache Commons Jelly version 1.0. An attacker can exploit this vulnerability to bypass security restrictions and perform unauthorized operation...

ArcGIS Server 10.3.1 RMIClassLoader useCodebaseOnly=false Code Execution Exploit

ArcGIS Server version 10.3.1 suffers from an RMIClassLoader useCodebaseOnly=false remote code execution vulnerability. Using an Esri-provided image on Azure's Marketplace, ArcGIS Server 10.3.1 started Java's rmid on port 1098 and explicitly set the property java.rmi.server.useCodebaseOnly equal t...

HP UCMDB Server BeanUtils Java Deserialization RCE

The HP Universal Configuration Management Database UCMDB Server running on the remote host is affected by a remote code execution vulnerability due to unsafe deserialize calls of unauthenticated Java objects to the Apache Commons BeanUtils library. An unauthenticated, remote attacker can exploit...

XML External Entity (XXE)

Apache commons-jelly is vulnerable to XML external entity XXE. When jelly XML files are parsed with a custom doctype declared as a SYSTEM entity with a URL at the beginning of the file, the parser will connect to the URL at instantiation...

CVE-2017-10932

All versions prior to V12.17.20 of the ZTE Microwave NR8000 series products - NR8120, NR8120A, NR8120, NR8150, NR8250, NR8000 TR and NR8950 are the applications of C/S architecture using the Java RMI service in which the servers use the Apache Commons Collections ACC library that may result in Ja...

Deserialization of untrusted data

All versions prior to V12.17.20 of the ZTE Microwave NR8000 series products - NR8120, NR8120A, NR8120, NR8150, NR8250, NR8000 TR and NR8950 are the applications of C/S architecture using the Java RMI service in which the servers use the Apache Commons Collections ACC library that may result in Ja...

CVE-2017-10932

All versions prior to V12.17.20 of the ZTE Microwave NR8000 series products - NR8120, NR8120A, NR8120, NR8150, NR8250, NR8000 TR and NR8950 are the applications of C/S architecture using the Java RMI service in which the servers use the Apache Commons Collections ACC library that may result in Ja...

Apache Commons Jelly connects to url with certain custom doctype definitions.

Severity: Medium Vendor: The Apache Software Foundation Versions Affected: commons-jelly-1.0 core, namely commons-jelly-1.0.jar Description: During jelly xml file parsing with xerces, if a custom doctype entity is declared with a ?SYSTEM? entity with a url and that entity is used in the body of t...

CVE-2017-12621

During Jelly xml file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity XXE...

CVE-2017-10932

All versions prior to V12.17.20 of the ZTE Microwave NR8000 series products - NR8120, NR8120A, NR8120, NR8150, NR8250, NR8000 TR and NR8950 are the applications of C/S architecture using the Java RMI service in which the servers use the Apache Commons Collections ACC library that may result in Ja...

CVE-2017-12621

The CVE-2017-12621 issue is an XXE vulnerability in Apache Commons Jelly when parsing Jelly XML and a SYSTEM entity URL is used in the document, causing the parser to connect to that URL during instantiation. Affected version: Apache Commons Jelly before 1.0.1. Impact per sources indicates potent...

Critical Flaw in Apache Struts2 Lets Hackers Take Over Web Servers

Security researchers have discovered a critical remote code execution vulnerability in the popular Apache Struts web application framework, allowing a remote attacker to run malicious code on the affected servers. Apache Struts is a free, open-source, Model-View-Controller MVC framework for...

MGASA-2017-0322 Updated apache-commons-email packages fix security vulnerability

In apache-commons-email before 1.5, when a call-site passes a subject for an email that contains line-breaks, the caller can add arbitrary SMTP headers CVE-2017-9801...

FreeBSD : Axis2 -- Security vulnerability on dependency Apache Commons FileUpload (c1265e85-7c95-11e7-93af-005056925db4)

Apache Axis2 reports : The commons-fileupload dependency has been updated to a version that fixes CVE-2016-1000031 AXIS2-5853. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright...

Apache Commons Email Input Validation Vulnerability

Apache Commons Email is the United States Apache Apache Software Foundation, an application programming interface that provides e-mail sending capabilities. A security vulnerability exists in Apache Commons Email versions 1.0 through 1.4. An attacker can exploit the vulnerability to add arbitrary...

CVE-2017-9801

When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP headers...

Sql injection

When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP headers...

CVE-2017-9801

When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP headers...

CVE-2017-9801

CVE-2017-9801 affects Apache Commons Email (versions 1.0–1.4). A call-site passing an email subject containing line-breaks can be exploited to inject arbitrary SMTP headers, due to a flaw in how setSubject handles input. This can lead to SMTP header manipulation and potential information exposure...