Missing Authentication for Critical Function in Apache Cassandra

The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request. This issue is a regression of CVE-2015-0225. The regression was introduced in...

CVE-2022-20763: Deserialization of Untrusted Data

A vulnerability in the login authorization components of Cisco Webex Meetings could allow an authenticated, remote attacker to inject arbitrary Java code. This vulnerability is due to improper deserialization of Java code within login requests. An attacker could exploit this vulnerability by...

CVE-2021-39128: Improper Neutralization of Special Elements Used in a Template Engine

Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers with JIRA Administrators access to execute arbitrary Java code via a server-side template injection vulnerability in the Email Template feature. The affected versions of Jira...

Atlassian Jira 代码注入漏洞

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. A security vulnerability exists in Atlassian Jira that can be exploited by a remote attacker with a "Jira administrator" to acce...

Updated velocity packages fix security vulnerability

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache...

CVE-2020-13936: Undefined Security Weakness

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache...

PT-2021-9474 · Alfresco · Alfresco Enterprise Content Management

Name of the Vulnerable Software and Affected Versions: Alfresco Enterprise Content Management ECM versions prior to 6.2.1 Description: An issue was discovered that allows a user with privileges to edit a FreeMarker template to execute arbitrary Java code or run arbitrary system commands with the...

CVE-2020-12873: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An issue was discovered in Alfresco Enterprise Content Management ECM before 6.2.1. A user with privileges to edit a FreeMarker template e.g., a webscript may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running Alfresco...

USN-4584-1 htmlunit vulnerability

It was discovered that HtmlUnit incorrectly initialized Rhino engine. An Attacker could possibly use this issue to execute arbitrary Java code...

CVE-2020-9297

Netflix Titus, all versions prior to version v0.1.1-rc.274, uses Java Bean Validation JSR 380 custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary...

Code injection

Netflix Titus uses Java Bean Validation JSR 380 custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being passe...

CVE-2020-5529

HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specific initialization of Rhino engine is...

HtmlUnit Code Execution Vulnerability

HtmlUnit is a Java-based library . A code execution vulnerability exists in HtmlUnit that can be exploited by an attacker to execute arbitrary Java code...

CVE-2014-2271

cn.wps.moffice.common.beans.print.CloudPrintWebView in Kingsoft Office 5.3.1, as used in Huawei P2 devices before V100R001C00B043, falls back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and execute arbitrary Java...

CVE-2014-2271: Improper Input Validation

cn.wps.moffice.common.beans.print.CloudPrintWebView in Kingsoft Office 5.3.1, as used in Huawei P2 devices before V100R001C00B043, falls back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and execute arbitrary Java...

Apache Struts ClassLoader Manipulation Vulnerabilities (S2-021) - Linux

ClassLoader Manipulation in Apache Struts allows remote attackers to execute arbitrary Java code. This VT has been deprecated and merged into the VT SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

The vulnerability of the RichFaces library, related to errors in code generation, allows attackers to execute arbitrary Java code.

The vulnerability of the RichFaces library is related to errors in code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary Java code with privileges of the target server...

IBM WebSphere Application Server Code Execution Vulnerability (CNVD-2018-26213)

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. It is a platform for Java EE and Web services applications, and is the foundation of the IBM WebSphere software platform. A code execution vulnerability exists in IBM WAS, which can ...

CVE-2018-1904

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code through an administrative client class with a serialized object from untrusted sources. IBM X-Force ID: 152533...

Code injection

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code through an administrative client class with a serialized object from untrusted sources. IBM X-Force ID: 152533...