Code injection

HPE Operations Orchestration 10.x before 10.51 and Operations Orchestration content before 1.7.0 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library...

CVE-2016-1997

HPE Operations Orchestration 10.x before 10.51 and Operations Orchestration content before 1.7.0 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library...

CVE-2016-1997

HPE Operations Orchestration 10.x before 10.51 and Operations Orchestration content before 1.7.0 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library...

CVE-2016-1998

HPE Service Manager SM 9.3x before 9.35 P4 and 9.4x before 9.41.P2 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library...

CVE-2016-1997

HPE Operations Orchestration 10.x before 10.51 and Operations Orchestration content before 1.7.0 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library...

CVE-2016-1997

CVE-2016-1997 affects HPE Operations Orchestration 10.x before 10.51 and related content before 1.7.0, due to unsafe deserialization of crafted Java objects via the Apache Commons Collections library. This leads to remote code execution by an unauthenticated attacker. Affected component is the Or...

CVE-2016-1998

CVE-2016-1998 affects HPE Service Manager (SM) 9.3x before 9.35 P4 and 9.4x before 9.41.P2. The vulnerability arises from deserializing a crafted Java object, related to the Apache Commons Collections library, allowing remote attackers to execute arbitrary commands. Exposure is via network (remot...

Jenkins < 1.642.2 / 1.650 and Jenkins Enterprise < 1.609.16.1 / 1.625.16.1 / 1.642.2.1 Multiple Vulnerabilities

The remote web server hosts a version of Jenkins that is prior to 1.650, or a version of Jenkins LTS prior to 1.642.2; or else a version of Jenkins Enterprise that is 1.642.x.y prior to 1.642.2.1, 1.625.x.y prior to 1.625.16.1, or 1.609.x.y prior to 1.609.16.1. It is, therefore, affected by the...

Jenkins < 1.642.2 / 1.650 Java Object Deserialization RCE

The remote web server hosts a version of Jenkins or Jenkins Enterprise that is prior to 1.642.2 or 1.650. It is, therefore, affected by a Java deserialization vulnerability. An unauthenticated, remote attacker can exploit this, by deserializing specific java.rmi and sun.rmi objects, to start a JR...

Java RMI services remote command execution exploit-vulnerability warning-the black bar safety net

Java RMI service is a remote method call Remote Method Invocation in. It is a mechanism that is able to make in a java virtual machine on the object calling another Java virtual machine object. In Java Web, many places will use RMI to communicate with each other to call. For example, many large...

Lexmark Markvision Enterprise Java Object Deserialization RCE

The remote Lexmark Markvision Enterprise server is affected by a remote code execution vulnerability due to unsafe deserialize calls of unauthenticated Java objects to the Apache Commons Collections ACC library. An unauthenticated, remote attacker can exploit this, by sending a specially crafted...

CVE-2016-1986

HP Continuous Delivery Automation CDA 1.30 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library...

CVE-2016-1986

HP Continuous Delivery Automation CDA 1.30 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library...

Design/Logic Flaw

HP Continuous Delivery Automation CDA 1.30 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library...

CVE-2016-1986

HP Continuous Delivery Automation CDA 1.30 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library...

CVE-2016-1986

CVE-2016-1986 affects HP Continuous Delivery Automation (CDA) 1.30. A deserialization vulnerability allows remote attackers to execute arbitrary commands via a crafted Java object, related to the Apache Commons Collections library. The NVD entry reports a high/critical impact (CVSS2: 7.5 HIGH; CV...

McAfee ePolicy Orchestrator Java Object Deserialization RCE

The McAfee ePolicy Orchestrator ePO installed on the remote Windows host is affected by a remote code execution vulnerability due to unsafe deserialize calls of unauthenticated Java objects to the Apache Commons Collections ACC library. An unauthenticated, remote attacker can exploit this to...

Critical: Red Hat Security Advisory: Red Hat JBoss Operations Network 3.3.5 update

Red Hat JBoss Operations Network 3.3 update 5, which fixes two security issues and several bugs, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Critical security impact. A Common Vulnerability Scoring System CVSS base score, which gives...

apache-commons-collections: InvokerTransformer code execution during deserialisation

It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections...

HP Operations Manager for Windows 8.x and 9.0 Java Object Deserialization RCE

The version of HP Operations Manager installed on the remote host has the Sam Admin Adapter installed. This package is no longer supported by HP and is affected by a remote code execution vulnerability due to unsafe deserialize calls of unauthenticated Java objects to the Apache Commons Collectio...