CVE-2014-0111

Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource mappings."...

CVE-2013-6468

JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a 1 MVFLEX Expression Language MVEL or 2 Drools expression...

CVE-2013-6468: Improper Control of Generation of Code

JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a 1 MVFLEX Expression Language MVEL or 2 Drools expression...

PT-2014-3130

Name of the Vulnerable Software and Affected Versions Red Hat JBoss BRMS versions prior to 6.0.1 Red Hat JBoss BPM Suite versions prior to 6.0.1 JBoss Drools affected versions not specified Description The issue allows remote authenticated users to execute arbitrary Java code. This can be achieve...

PT-2014-4374

Name of the Vulnerable Software and Affected Versions Android versions prior to 4.4 Description The issue allows attackers to execute arbitrary Java code by leveraging access to the searchBoxJavaBridge interface at certain Android API levels. This is due to the use of the addJavascriptInterface A...

PT-2014-4010

Name of the Vulnerable Software and Affected Versions SoapUI versions prior to 4.6.4 Description The issue concerns the WSDL/WADL import functionality, which allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file. Recommendations For versions prior t...

CVE-2013-4271: Deserialization of Untrusted Data

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources, which allows remote attackers to execute arbitrary Java code via a serialized object, a different vulnerability than CVE-2013-4221...

PT-2013-1363

Name of the Vulnerable Software and Affected Versions McAfee Web Reporter Premium affected versions not specified Description The issue exists due to insufficient access restrictions to the invoker/EJBInvokerServlet and invoker/JMXInvokerServlet servlets. This allows a remote attacker to execute...

Openfire Admin Console Authentication Bypass

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' require 'rex/zip' class Metasploit3...

CVE-2012-1826: Undefined Security Weakness

dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted 1 XSLT or 2 Velocity template...

PT-2012-3571

Name of the Vulnerable Software and Affected Versions dotCMS versions 1.9 through 1.9.5.1 Description The issue allows remote authenticated users to execute arbitrary Java code via crafted templates, specifically 1 XSLT or 2 Velocity templates. Recommendations For dotCMS versions 1.9 through...

PT-2011-3162

Name of the Vulnerable Software and Affected Versions JBoss Seam 2 framework versions 2.2.x and earlier Red Hat JBoss Enterprise SOA Platform versions 4.3.0.CP04 and 5.1.0 JBoss Enterprise Application Platform aka JBoss EAP or JBEAP versions 4.3.0.CP09 and 5.1.0 Description The issue is related t...