io.andromeda:lyricist (>=0.2.3, <=0.2.4), io.andromeda:lyricist-demo (0.2.3) potentially affected by CVE-2017-18349 via ro.pippo:pippo-fastjson (0.9.1)

ro.pippo:pippo-fastjson MAVEN version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on ro.pippo:pippo-fastjson and may be impacted: - io.andromeda:lyricist =0.2.3, =0.2.4 - io.andromeda:lyricist-demo 0.2.3 Source cves: CVE-2017-18349 Source...

cc.kebei:onion-easy-orm (3.0.0), cc.kebei:onion-easy-orm-core (3.0.0) +1972 more potentially affected by CVE-2017-18349 via com.alibaba:fastjson (>=1.1.15, <=1.2.30)

com.alibaba:fastjson MAVEN version =1.1.15, =1.1.6, =1.0.0, =1.0, =1.0.0, =1.0.0, =6.1.7, =6.2.08, =6.1.0, =6.1.7, =6.1.0, =6.2.09 and more Source cves: CVE-2017-18349 Source advisory: OSV:GHSA-XJRR-XV9M-4PW5...

ro.pippo:pippo-demo-basic (0.4.0), ro.pippo:pippo-demo-controller (0.4.0) +2 more potentially affected by CVE-2017-18349 via ro.pippo:pippo-fastjson (0.4.0)

ro.pippo:pippo-fastjson MAVEN version 0.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on ro.pippo:pippo-fastjson and may be impacted: - ro.pippo:pippo-demo-basic 0.4.0 - ro.pippo:pippo-demo-controller 0.4.0 - ro.pippo:pippo-demo-crud 0.4.0 -...

ro.pippo:pippo-demo-basic (0.5.0), ro.pippo:pippo-demo-controller (0.5.0) +2 more potentially affected by CVE-2017-18349 via ro.pippo:pippo-fastjson (0.5.0)

ro.pippo:pippo-fastjson MAVEN version 0.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on ro.pippo:pippo-fastjson and may be impacted: - ro.pippo:pippo-demo-basic 0.5.0 - ro.pippo:pippo-demo-controller 0.5.0 - ro.pippo:pippo-demo-crud 0.5.0 -...

ro.pippo:pippo-demo-ajax (0.6.0), ro.pippo:pippo-demo-basic (0.6.0) +3 more potentially affected by CVE-2017-18349 via ro.pippo:pippo-fastjson (0.6.0)

ro.pippo:pippo-fastjson MAVEN version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on ro.pippo:pippo-fastjson and may be impacted: - ro.pippo:pippo-demo-ajax 0.6.0 - ro.pippo:pippo-demo-basic 0.6.0 - ro.pippo:pippo-demo-controller 0.6.0 -...

ro.pippo:pippo-demo-basic (0.4.2), ro.pippo:pippo-demo-controller (0.4.2) +2 more potentially affected by CVE-2017-18349 via ro.pippo:pippo-fastjson (0.4.2)

ro.pippo:pippo-fastjson MAVEN version 0.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on ro.pippo:pippo-fastjson and may be impacted: - ro.pippo:pippo-demo-basic 0.4.2 - ro.pippo:pippo-demo-controller 0.4.2 - ro.pippo:pippo-demo-crud 0.4.2 -...

Pippo FastjsonEngine Fastjson Arbitrary Code Execution Vulnerability

Pippo is a Java-based Web framework . FastjsonEngine is one of the JSON processing engine . Fastjson is one of the Java-based JSON parser/generator . Pippo 1.11.0 version of FastjsonEngine used by Fastjson 1.2.25 before the version of parseObject has a security vulnerability. A remote attacker ca...

CVE-2017-18349

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is...

Cross site request forgery (csrf)

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is...

CVE-2017-18349

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is...

CVE-2017-18349

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is...

CVE-2017-18349

The CVE-2017-18349 entry describes Fastjson before 1.2.25 enabling remote code execution when used by Pippo 1.11.0 via a crafted JSON payload. The Nuclei template confirms the vulnerability is an insecure deserialization in FastjsonEngine where a crafted rmi:// URI in dataSourceName of an HTTP PO...

CVE-2017-18349

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is...

cc.kebei:onion-easy-orm (3.0.0), cc.kebei:onion-easy-orm-core (3.0.0) +1972 more potentially affected by CVE-2017-18349 via com.alibaba:fastjson (>=1.1.15, <=1.2.30)

com.alibaba:fastjson MAVEN version =1.1.15, =1.1.6, =1.0.0, =1.0, =1.0.0, =1.0.0, =6.1.7, =6.2.08, =6.1.0, =6.1.7, =6.1.0, =6.2.09 and more Source cves: CVE-2017-18349 Source advisory: MEND:CVE-2017-18349...

io.andromeda:fragments (>=0.0.10, <=0.0.18), io.andromeda:lyricist (>=0.2.3, <=0.2.4) +6 more potentially affected by CVE-2017-18349 via ro.pippo:pippo-fastjson (>=0.4.0, <=1.1.0)

ro.pippo:pippo-fastjson MAVEN version =0.4.0, =0.0.10, =0.2.3, =0.6.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.6.1 Source cves: CVE-2017-18349 Source advisory: MEND:CVE-2017-18349...

Improper Input Validation

Fastjson allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java...

PT-2018-6845

Name of the Vulnerable Software and Affected Versions: Fastjson versions prior to 1.2.25 Pippo version 1.11.0 Description: The issue allows remote attackers to execute arbitrary code via a crafted JSON request. This can be achieved by sending a crafted rmi:// URI in the dataSourceName field of HT...

vulhub

This is a Docker Compose file for a vulnerability environment. It is a collection of services and their configurations that can be used to test and demonstrate various vulnerabilities. The file is written in YAML format and defines the services, their ports, and their dependencies. The services...

In-depth understanding of the JAVA deserialization vulnerability-vulnerability warning-the black bar safety net

1.Java serialization and deserialization Java serialization refers to the Java object is converted to byte sequence of the process easy to save in memory, a file, a database, the ObjectOutputStream class's writeObjectmethod can be implemented serialized. Java deserialization refers to the sequenc...

fastjson remote code execution vulnerability technical analysis and protection solution-vulnerability warning-the black bar safety net

! 2017-year 3 December 15, fastjson official released a security Bulletin indicating fastjson in 1. 2. 24 and the prior version there is a remote code execution high-risk security vulnerabilities. An attacker can use this vulnerability to remotely execute malicious code to invade the server...