Fedora 25 : batik (2017-43b46cd2da)

Security fix for CVE-2017-5662 ---- Add missing requires on xmlgraphics-commons Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

ManageEngine Applications Manager Apache Commons Collections Insecure Deserialization (CVE-2016-9498)

An insecure deserialization vulnerability exists in ManageEngine Applications Manager. This vulnerability is due to the inclusion of the vulnerable version of Apache Commons Collections library in the classpath combined with insecure deserialization. A remote, unauthenticated attacker can exploit...

Cisco Prime LAN Management Solution Java Object Deserialization RCE (CSCux34647)

The Cisco Prime Lan Management Solution LMS running on the remote web server is affected by a remote code execution vulnerability due to unsafe deserialize calls of unauthenticated Java objects to the Apache Commons Collections ACC library. An unauthenticated, remote attacker can exploit this, by...

H3C / HPE Intelligent Management Center RMI Java Object Deserialization RCE

The H3C or HPE Intelligent Management Center iMC web server running on the remote host is affected by a remote code execution vulnerability due to unsafe deserialization of Java objects to the Apache Commons BeanUtils library via the euplat RMI registry. An unauthenticated, remote attacker can...

Code injection

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite subcomponent: Web Access Apache Commons BeanUtils. Supported versions that are affected are 8.3, 8.4, 15.1, 15.2, 16.1 and 16.2. Easily "exploitable" vulnerability allows low...

CVE-2017-3503

CVE-2017-3503 is a vulnerability in the Oracle Primavera P6 Enterprise Project Portfolio Management (P6 EPPM) Web Access component (Apache Commons BeanUtils). Affected versions: 8.3, 8.4, 15.1, 15.2, 16.1, and 16.2. The description indicates an easily exploitable issue where a low-privileged atta...

CVE-2017-3503

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite subcomponent: Web Access Apache Commons BeanUtils. Supported versions that are affected are 8.3, 8.4, 15.1, 15.2, 16.1 and 16.2. Easily "exploitable" vulnerability allows low...

CVE-2017-3503

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite subcomponent: Web Access Apache Commons BeanUtils. Supported versions that are affected are 8.3, 8.4, 15.1, 15.2, 16.1 and 16.2. Easily "exploitable" vulnerability allows low...

Oracle Primavera Products Remote Vulnerability

Oracle Primavera Products Suite is a suite of project portfolio management solutions from Oracle Corporation.Primavera P6 Enterprise Project Portfolio Management P6 EPPM is one of the components used for project planning, management and execution. Primavera P6 Enterprise Project Portfolio...

VMware vRealize Operations RCE Vulnerability (VMSA-2015-0009)

VMware vRealize Operations is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

MySQL Enterprise Monitor 3.1.x < 3.1.7.8023 / 3.2.x < 3.2.7.1204 / 3.3.x < 3.3.3.1199 Multiple Vulnerabilities (April 2017 CPU)

According to its self-reported version, the MySQL Enterprise Monitor application running on the remote host is 3.1.x prior to 3.1.7.8023, 3.2.x prior to 3.2.7.1204, or 3.3.x prior to 3.3.3.1199. It is, therefore, affected by multiple vulnerabilities : - A denial of service vulnerability exists in...

XStream has a deserialization vulnerability

XStream is a Java object and XML conversion tool . A deserialization vulnerability exists in XStream V1.4.9 when used with commons-beanutils V1.9.3. The vulnerability allows attackers to execute arbitrary code or arbitrary commands...

jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name

It was found that Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service FPS merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...

Important: Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R2 security and bug fix update

An update is now available for Red Hat JBoss Fuse and Red Hat JBoss A-MQ. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

IBM WebSphere Remote Code Execution Java Deserialization Exploit

This Metasploit module exploits a vulnerability in IBM's WebSphere Application Server. An unsafe deserialization call of unauthenticated Java objects exists to the Apache Commons Collections ACC library, which allows remote arbitrary code execution. Authentication is not required in order to...

IBM WebSphere - RCE Java Deserialization (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule "IBM WebSphere RCE Java Deserialization Vulnerability", 'Description' = %q This module exploits a vulnerability in IBM's WebSphe...

IBM WebSphere Remote Code Execution Java Deserialization

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule "IBM WebSphere RCE Java Deserialization Vulnerability", 'Description' = %q This module exploits a vulnerability in IBM's WebSphe...

IBM WebSphere RCE Java Deserialization Vulnerability

This module exploits a vulnerability in IBM's WebSphere Application Server. An unsafe deserialization call of unauthenticated Java objects exists to the Apache Commons Collections ACC library, which allows remote arbitrary code execution. Authentication is not required in order to exploit this...

RHEL 7 : Red Hat JBoss Web Server 3.1.0 (RHSA-2017:0456)

An update is now available for Red Hat JBoss Web Server 3 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

tomcat: Usage of vulnerable FileUpload package can result in denial of service

A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer 4096 bytes used to read the uploaded file if the boundary was the typical tens of bytes long...