261 matches found
CVE-2021-36981
CVE-2021-36981 Verinice.Pro 1.22.1 Unsafe Java deserialization of untrusted data, leading to Remote Code Execution using C3P0 gadget authenticated PoC code to exploit the deserialization vulnerability. See...
cp30_XXE_partial_fix
c3p0 c3p0 is a mature, highly concurrent JDBC Connection pooling library, with support for caching and reuse of PreparedStatements. It is licensed under LGPL v.2.1 or EPL v.1.0, at your option. c3p0 is now maintained on github. c3p0 is available as managed dependency on Sonatype's open-source...
c3p0: c3p0: Remote code execution via deserialization vulnerability
A flaw was found in c3p0, a JDBC Connection pooling library. This vulnerability allows a remote attacker to potentially execute arbitrary code by crafting a malicious data source object. When an application deserializes this object and automatically resolves its properties, it can trigger...
Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : c3p0 vulnerabilities (USN-8642-1)
The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8642-1 advisory. It was discovered that c3p0 was vulnerable to remote code execution via maliciously crafted serialized...
c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects
A flaw was found in c3p0, a Java Database Connectivity JDBC Connection pooling library. This vulnerability allows an attacker to achieve arbitrary code execution by providing maliciously crafted Java-serialized objects or javax.naming.Reference instances. By manipulating the userOverridesAsString...
Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.19 Update
An update is now available for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability scoring System CVSS base score, which gives a detailed severity rating, ...
c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects
A flaw was found in c3p0, a Java Database Connectivity JDBC Connection pooling library. This vulnerability allows an attacker to achieve arbitrary code execution by providing maliciously crafted Java-serialized objects or javax.naming.Reference instances. By manipulating the userOverridesAsString...
RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.1.16 (RHSA-2026:73976)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73976 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release ...
RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.3.19 Update (Important) (RHSA-2026:73644)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73644 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release ...
Astra Linux ā Vulnerability in c3p0
C3P0 versions less than 0.9.5.4 may be exploited by a ābillion laughs attackā when loading XML configuration, due to the lack of protections against recursive entity expansion during the loading of configuration files...
CLSA-2026-1789372028 TuxCare security update for com.mchange:c3p0 (2 CVEs)
TuxCare rebuilt com.mchange:c3p0 to address 2 CVEs. Fixed in 0.9.5.3-tuxcare.1...
CLSA-2026-1789372000 TuxCare security update for com.mchange:c3p0 (1 CVE)
TuxCare rebuilt com.mchange:c3p0 to address 1 CVE. Fixed in 0.9.2.1-tuxcare.1...
CLSA-2026-1789371869 TuxCare security update for com.mchange:c3p0 (2 CVEs)
TuxCare rebuilt com.mchange:c3p0 to address 2 CVEs. Fixed in 0.9.5.2-tuxcare.1...
CLSA-2026-1788527318 TuxCare security update for com.mchange:c3p0 (1 CVE)
TuxCare rebuilt com.mchange:c3p0 to address 1 CVE. Fixed in 0.9.5.4-tuxcare.3...
PT-2026-91385
TuxCare rebuilt com.mchange:c3p0 to address 1 CVE. Fixed in 0.9.5.4-tuxcare.3...
Security Bulletin: IBM QRadar SIEM contains components with known vulnerabilities
Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON...
CLSA-2026-1787905903 TuxCare security update for com.mchange:c3p0 (1 CVE)
TuxCare rebuilt com.mchange:c3p0 to address 1 CVE. Fixed in 0.9.5.4-tuxcare.1...
USN-8642-1: c3p0 vulnerabilities
It was discovered that c3p0 was vulnerable to remote code execution via maliciously crafted serialized objects and JNDI references. An attacker could use this to execute arbitrary code, bypass security restrictions, or cause a denial of service...
USN-8642-1 c3p0 vulnerabilities
It was discovered that c3p0 was vulnerable to remote code execution via maliciously crafted serialized objects and JNDI references. An attacker could use this to execute arbitrary code, bypass security restrictions, or cause a denial of service...
PT-2026-80726
Name of the Vulnerable Software and Affected Versions c3p0 affected versions not specified Description The software is susceptible to remote code execution through the use of maliciously crafted serialized objects and JNDI Java Naming and Directory Interface references. JNDI is a Java API that...