266 matches found
CVE-2016-0767
PostgreSQL PL/Java before 1.5.0 allows remote authenticated users with USAGE permission on the public schema to alter the public schema classpath...
CVE-2016-0767
PostgreSQL PL/Java before 1.5.0 allows remote authenticated users with USAGE permission on the public schema to alter the public schema classpath...
Path traversal
PostgreSQL PL/Java before 1.5.0 allows remote authenticated users with USAGE permission on the public schema to alter the public schema classpath...
Code injection
Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that exists in the classpath, such as test code or administration code. The issue exists because the ilog.views.faces.IlvFacesController servlet in jviews-framework-all.jar does not...
CloudBees Jenkins Pipeline: Classpath Steps Plugin Security Bypass Vulnerability
CloudBees Jenkins is the United States CloudBees company's set of Java-based development of continuous integration tools . A security vulnerability in the CloudBees Jenkins Pipeline: Classpath Steps plugin allows remote attackers to submit a special request to bypass security restrictions and...
IBM Development Package for Apache Spark Denial of Service Vulnerability
IBM Development Package for Apache Spark is a software development kit. A denial of service vulnerability exists in IBM Development Package for Apache Spark, which can be exploited to launch a denial of service attack. In addition, the Apache Development Package for Apache Spark is vulnerable to ...
CVE-2016-0360
IBM Websphere MQ JMS 7.0.1, 7.1, 7.5, 8.0, and 9.0 client provides classes that deserialize objects from untrusted sources which could allow a malicious user to execute arbitrary Java code by adding vulnerable classes to the classpath. IBM Reference : 1983457...
CVE-2016-0360
CVE-2016-0360 concerns IBM WebSphere MQ JMS client deserializing objects from untrusted sources, enabling arbitrary Java code execution via vulnerable classes on the classpath. It affects WebSphere Application Server and related IBM products (e.g., MQ JMS JCA resource adapter). Remediation: apply...
Spark 2.5 Arbitrary File Read Vulnerability
Exploit for php platform in category web applications Spark sparkjava.com is a mildly hyped Java micro web framework that also provides functionality to serve static files. Unfortunately, there's no protection against directory traversal attacks and I haven't been able to contact anyone related t...
Sparkjava Framework arbitrary file read vulnerability
Classpath Vuln Exploit the classpath based vulnerability with something like: curl "http:///....\spark\Spark.class" The number of ..\ you need in the path depends on where in the classpath the static file location is configured to be. If you don't have the right amount then you don't get anything...
Spark 2.5 Arbitrary File Read
Hey folks, Spark sparkjava.com is a mildly hyped Java micro web framework that also provides functionality to serve static files. Unfortunately, there's no protection against directory traversal attacks and I haven't been able to contact anyone related to the project after trying 4 people over 2...
bsh2: remote code execution via deserialization
A deserialization flaw allowing remote code execution was found in the BeanShell library. If BeanShell was on the classpath, it could permit code execution if another part of the application deserialized objects involving a specially constructed chain of classes. A remote attacker could use this...
CVE-2016-4974
Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS AMQP 1.0 before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary code by leveraging a...
bsh2: remote code execution via deserialization
A deserialization flaw allowing remote code execution was found in the BeanShell library. If BeanShell was on the classpath, it could permit code execution if another part of the application deserialized objects involving a specially constructed chain of classes. A remote attacker could use this...
bsh2: remote code execution via deserialization
A deserialization flaw allowing remote code execution was found in the BeanShell library. If BeanShell was on the classpath, it could permit code execution if another part of the application deserialized objects involving a specially constructed chain of classes. A remote attacker could use this...
Updated apache-commons-collections packages fix CVE-2015-8103
Updated apache-commons-collections packages fix security vulnerability: Due to an issue with serialization, Java applications can be vulnerable to malicious remote code execution when the apache-commons-collections library is on the classpath CVE-2015-8103...
DEBIAN-CVE-2016-2510
BeanShell bsh before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler...
bsh2: remote code execution via deserialization
A deserialization flaw allowing remote code execution was found in the BeanShell library. If BeanShell was on the classpath, it could permit code execution if another part of the application deserialized objects involving a specially constructed chain of classes. A remote attacker could use this...
bsh2: remote code execution via deserialization
A deserialization flaw allowing remote code execution was found in the BeanShell library. If BeanShell was on the classpath, it could permit code execution if another part of the application deserialized objects involving a specially constructed chain of classes. A remote attacker could use this...
Fedora 23 : jenkins-1.625.3-3.fc23 / jenkins-remoting-2.53.3-1.fc23 (2016-641c8b4eb2)
Fixes CVE-2016-0788, CVE-2016-0789, CVE-2016-0790, CVE-2016-0791, CVE-2016-0792, and possible NoClassDefFoundError: org/codehaus/stax2/XMLInputFactory2 exception bug. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenab...