289 matches found
CVE-2021-36162 Unprotected yaml deserialization cause RCE
Apache Dubbo supports various rules to support configuration override or traffic routing called routing in Dubbo. These rules are loaded into the configuration center eg: Zookeeper, Nacos, ... and retrieved by the customers when making a request in order to find the right endpoint. When parsing...
CVE-2021-36162
Apache Dubbo (routing/configuration rules loaded from config centers like Zookeeper or Nacos) is affected by CVE-2021-36162 through unsafe YAML deserialization using SnakeYAML, which can enable arbitrary constructor invocation and remote code execution when consumers retrieve tampered rules. The ...
Apache Dubbo 代码问题漏洞
Apache Dubbo is the United States Apache Apache Foundation of a lightweight Java-based RPC Remote Procedure Call framework. It provides interface-based remote calling, fault tolerance and load balancing, and automated service registration and discovery. A security vulnerability exists in Apache...
Apache Dubbo 代码问题漏洞
Apache Dubbo is the United States Apache Apache Foundation of a lightweight Java-based RPC Remote Procedure Call framework. It provides interface-based remote calling, fault tolerance and load balancing, and automated service registration and discovery. A security vulnerability exists in Apache...
Apache dubbo suffers from a deserialization vulnerability (CNVD-2021-49587)
Apache Dubbo is the United States Apache Apache Foundation of a lightweight Java-based RPC Remote Procedure Call framework. Apache dubbo has a deserialization vulnerability that can be exploited by attackers to achieve command execution, server-side request forgery and other attacks...
Apache Dubbo suffers from a deserialization vulnerability
Apache Dubbo is Apache's a lightweight Java-based RPC Remote Procedure Call framework. Apache Dubbo has a deserialization vulnerability that can be exploited by an attacker to gain control of the server...
PT-2021-19956 · Apache · Apache Dubbo
Name of the Vulnerable Software and Affected Versions: Apache Dubbo versions prior to 2.6.10 and 2.7.10 Description: Apache Dubbo is a Java-based, open-source RPC framework. The issue concerns pre-auth remote code execution via arbitrary bean manipulation in the Telnet handler. The Dubbo main...
Command execution vulnerability in dubbo 2.7.12 (CNVD-2021-44687)
dubbo is a high-performance service framework. A command execution vulnerability exists in dubbo 2.7.12, which can be exploited by an attacker to gain control of the server...
Command execution vulnerability in dubbo 2.7.12 (CNVD-2021-44688)
dubbo is a high-performance service framework. A command execution vulnerability exists in dubbo 2.7.12, which can be exploited by an attacker to gain control of the server...
Command execution vulnerability in dubbo 2.7.12 (CNVD-2021-44689)
dubbo is a high-performance service framework. A command execution vulnerability exists in dubbo 2.7.12, which can be exploited by an attacker to gain control of the server...
Command Execution Vulnerability in dubbo 2.7.12
dubbo is a high-performance service framework. A command execution vulnerability exists in dubbo 2.7.12, which can be exploited by an attacker to gain control of the server...
Command execution vulnerability in dubbo 2.7.12 (CNVD-2021-44686)
dubbo is a high-performance service framework. A command execution vulnerability exists in dubbo 2.7.12, which can be exploited by an attacker to gain control of the server...
Exploit for Deserialization of Untrusted Data in Apache Dubbo
The 0xDABB of Doom - CVE-2021-25641-Proof-of-Concept Apache/Al...
Unspecified Vulnerability in Apache Dubbo
Apache Dubbo is the United States Apache Apache Foundation of a lightweight Java-based RPC Remote Procedure Call framework. The product provides interface-based remote calling , fault tolerance and load balancing and automatic service registration and discovery. A security vulnerability previousl...
Unspecified Vulnerability in Apache Dubbo (CNVD-2021-41082)
Apache Dubbo is the United States Apache Apache Foundation of a lightweight Java-based RPC Remote Procedure Call framework. The product provides interface-based remote calling , fault tolerance and load balancing and automatic service registration and discovery. A security vulnerability exists in...
Apache Dubbo Deserialization Vulnerability (CNVD-2021-41088)
Apache Dubbo is the United States Apache Apache Foundation of a lightweight Java-based RPC Remote Procedure Call framework. The product provides interface-based remote calling , fault tolerance and load balancing and automatic service registration and discovery. A deserialization vulnerability...
Remote Code Execution (RCE)
dubbo is vulnerable to remote code execution. An attacker may exploit the vulnerability by injecting a command other than the possible values, controlling the RPC attachment to set it to nativejava and force the java deserialization of the byte array located out of the limit of argument...
Remote Code Execution
apache dubbo is vulnerable to remote code execution. Unsafe deserialization allows an attacker to execute arbitrary code through arbitrary constructors by submitting malicious YAML rules...
Open Redirection
Apache dubbo-common is vulnerable open redirection. The function parseURL method causes a bypass of white host check, leading to an open redirect or SSRF vulnerability...
