Arbitrary Code Execution

Apache Phoenix-hive is vulnerable to arbitrary code execution attacks. The attacks can be triggered because it directly uses ObjectInputStream which deserializes the classes without validation and leads to code execution...

CVE-2017-12628

CVE-2017-12628 : The JMX server embedded in Apache James is vulnerable to a Java deserialization issue in its JMX handling, enabling arbitrary command execution. The description notes this is limited to local escalation since JMX is bound to localhost by default, with the vendor upgrade to a fixe...

CVE-2017-10271 - Oracle WebLogic Server AsyncResponseService Deserialization Vulnerability

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: WLS Security. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to...

SmartBear SoapUI 5.3.0 Remote Code Execution Via Deserialization Vulnerability

Exploit for java platform in category remote exploits Title: SmartBear SoapUI - Remote Code Execution via Deserialization Author: Jakub Palaczynski Date: 12. July 2017 Exploit tested on: ================== SoapUI 5.3.0 Also works on older versions. Vulnerability: Remote Code Execution via...

Deserialization of untrusted data

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code vi...

CVE-2017-10932

All versions prior to V12.17.20 of the ZTE Microwave NR8000 series products - NR8120, NR8120A, NR8120, NR8150, NR8250, NR8000 TR and NR8950 are the applications of C/S architecture using the Java RMI service in which the servers use the Apache Commons Collections ACC library that may result in Ja...

CVE-2017-10932

All versions prior to V12.17.20 of the ZTE Microwave NR8000 series products - NR8120, NR8120A, NR8120, NR8150, NR8250, NR8000 TR and NR8950 are the applications of C/S architecture using the Java RMI service in which the servers use the Apache Commons Collections ACC library that may result in Ja...

RHEL 6 : Red Hat JBoss Enterprise Application Platform (RHSA-2017:2809)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2809 advisory. Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This release of Red...

CVE-2017-10932

All versions prior to V12.17.20 of the ZTE Microwave NR8000 series products - NR8120, NR8120A, NR8120, NR8150, NR8250, NR8000 TR and NR8950 are the applications of C/S architecture using the Java RMI service in which the servers use the Apache Commons Collections ACC library that may result in Ja...

log4j: Socket receiver deserialization vulnerability

It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the...

Elixir Plug Arbitrary Code Execution Vulnerability

Elixir Plug is a library for developing web applications based on Erlang VM. An arbitrary code execution vulnerability exists in the deserialization function of Plug.Session in Elixir Plug. A remote attacker can exploit this vulnerability to execute arbitrary code...

Remote Code Execution (RCE)

spring-amqp is vulnerable to remote code execution RCE attacks. A malicious user can pass a org.springframework.amqp.core.Message object containing arbitrary code that is executed when deserialized by the application...

Apache Spark Deserialization Program Code Execution Vulnerability

Apache Spark is a large-scale data processing engine that supports acyclic data streams and in-memory computing from the Apache Software Foundation. A security vulnerability exists in Apache Spark versions 1.6.0 through 2.1.1, which stems from the program's failure to securely deserialize data. A...

Exploit for Deserialization of Untrusted Data in Apache Struts

Struts2 Vulnerability - CVE-2017-9805 Des...

jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper

A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 5

An update is now available for Red Hat JBoss Enterprise Application Platform 6.4 for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...

log4j: Socket receiver deserialization vulnerability

It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the...

jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper

A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper...

jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper

A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper...

OpenJDK: unbounded memory allocation in CodeSource deserialization (Serialization, 8174113)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: Serialization. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker...