CVE-2020-9296: Improper Neutralization of Special Elements used in an Expression Language Statement

Netflix Titus uses Java Bean Validation JSR 380 custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being passe...

Exploit for Expression Language Injection in Vmware Vcloud_Director

CVE-2020-3956 PoC exploit for VMware Cloud Dir...

HPE IMC ForwardRedirect Expression Language Injection

An Expression Language injection vulnerability exists in HPE Intelligent Management Center. This vulnerability is due to insufficient handling of the actionbean request parameter provided to the forwardredirect.xhtml endpoint...

HPE Intelligent Management Remote Rode Execution (CVE-2019-5386)

An Expression Language injection vulnerability exists in HPE Intelligent Management Center. This vulnerability is due to insufficient handling of the beanName request parameter by the class...

Nexus Repository Manager - Java EL Injection RCE (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Nexus Repository Manager Java EL Injection RCE', 'Description' = %q This module exploits a Java Expression Language EL injection in Nexus...

Nexus Repository Manager 3.21.1-01 Remote Code Execution Exploit

This Metasploit module exploits a Java Expression Language EL injection in Nexus Repository Manager versions up to and including 3.21.1 to execute code as the Nexus user. Tested against 3.21.1-01. This module requires Metasploit: https://metasploit.com/download Current source:...

Exploit for Expression Language Injection in Sonatype Nexus

CVE-2020-10199-10204 http://1984-0day.com python3 poc.py...

HPE Intelligent Management Center Remote Code Execution (CVE-2019-5386)

An Expression Language injection vulnerability exists in HPE Intelligent Management Center. This vulnerability is due to insufficient handling of the beanName request parameter by the ViewBatchTaskResultDetailBean class. A remote, authenticated attacker can exploit this vulnerability by sending a...

HPE Intelligent Management Center Remote Code Execution (CVE-2019-11943)

An expression language injection vulnerability exists in HPE Intelligent Management Center. This vulnerability is due to insufficient handling of the beanName request parameter by the SoapConfigBean class. Successful exploitation results in the execution of arbitrary code under the security conte...

HPE Intelligent Management Center Remote Code Execution (CVE-2019-5370)

An expression language injection vulnerability exists in HPE Intelligent Management Center. This vulnerability is due to insufficient handling of the beanName request parameter by the IctTableExportToCSVBean class...

PT-2020-19421

Name of the Vulnerable Software and Affected Versions HPE Intelligent Management Center versions prior to 7.3 E0705P07 Description A remote code execution vulnerability was discovered due to an expression language injection issue in the reportTaskSelect functionality. This allows for potential...

PT-2020-19420

Name of the Vulnerable Software and Affected Versions HPE Intelligent Management Center iMC versions prior to 7.3 E0705P07 Description A remote code execution vulnerability was discovered due to an expression language injection issue in the iccselectdeviceseries component. This allows for potenti...

PT-2020-19412

Name of the Vulnerable Software and Affected Versions HPE Intelligent Management Center versions prior to 7.3 E0705P07 Description A remote code execution vulnerability was discovered due to an expression language injection issue in the faulttrapgroupselect functionality. Recommendations For...

PT-2020-19449

Name of the Vulnerable Software and Affected Versions HPE Intelligent Management Center versions prior to 7.3 E0705P07 Description A remote code execution vulnerability was discovered due to an expression language injection issue. This allows for potential code execution. Recommendations For...

PT-2020-19428

Name of the Vulnerable Software and Affected Versions HPE Intelligent Management Center versions prior to 7.3 E0705P07 Description A remote code execution vulnerability was discovered due to an expression language injection in the selectusergroup functionality. This issue may allow for unauthoriz...

PT-2020-19434

Name of the Vulnerable Software and Affected Versions HPE Intelligent Management Center versions prior to 7.3 E0705P07 Description A remote code execution issue was discovered, related to an expression language injection in the soapConfigContent. This could potentially allow for unauthorized code...

PT-2020-19437

Name of the Vulnerable Software and Affected Versions HPE Intelligent Management Center versions prior to 7.3 E0705P07 Description A remote code execution vulnerability was discovered due to an expression language injection in the wmiconfigcontent of HPE Intelligent Management Center. This issue...

PT-2020-19407

Name of the Vulnerable Software and Affected Versions HPE Intelligent Management Center iMC versions prior to 7.3 E0705P07 Description A chooseperfview expression language injection remote code execution issue was discovered. This allows for remote code execution. Recommendations For versions pri...

PT-2020-19426

Name of the Vulnerable Software and Affected Versions HPE Intelligent Management Center versions prior to 7.3 E0705P07 Description A remote code execution vulnerability was discovered due to an expression language injection issue. This allows for potential remote code execution. Recommendations F...

PT-2020-19427

Name of the Vulnerable Software and Affected Versions HPE Intelligent Management Center versions prior to 7.3 E0705P07 Description A remote code execution vulnerability due to expression language injection in the quickTemplateSelect was discovered. This issue allows for remote code execution...