groovy security update

1.8.9-8 - Fix Information disclosure vulnerability - Resolves: CVE-2016-6814...

Jenkins < 1.650 - Java Deserialization Exploit

Exploit for java platform in category remote exploits import random import string from decimal import Decimal import requests from requests.exceptions import RequestException Exploit Title: Jenkins CVE-2016-0792 Deserialization Remote Exploit Google Dork: intitle: "Dashboard Jenkins" + "Manage...

Jenkins Java Deserialization

import random import string from decimal import Decimal import requests from requests.exceptions import RequestException Exploit Title: Jenkins CVE-2016-0792 Deserialization Remote Exploit Google Dork: intitle: "Dashboard Jenkins" + "Manage Jenkins" Date: 30-07-2017 Exploit Author: Janusz...

Jenkins < 1.650 - Java Deserialization

import random import string from decimal import Decimal import requests from requests.exceptions import RequestException Exploit Title: Jenkins CVE-2016-0792 Deserialization Remote Exploit Google Dork: intitle: "Dashboard Jenkins" + "Manage Jenkins" Date: 30-07-2017 Exploit Author: Janusz Piechów...

Jenkins 1.650 - Java Deserialization

Jenkins 1.650 - Java Deserialization import random import string from decimal import Decimal import requests from requests.exceptions import RequestException Exploit Title: Jenkins CVE-2016-0792 Deserialization Remote Exploit Google Dork: intitle: "Dashboard Jenkins" + "Manage Jenkins" Date:...

CloudBees Jenkins Pipeline: Groovy Plugin Remote Code Execution Vulnerability

CloudBees Jenkins Pipeline: Groovy Plugin is a U.S. CloudBees company's Java-based development of continuous integration tools in the process of building plug-ins . A remote code execution vulnerability exists in CloudBees Jenkins Pipeline: Groovy Plugin versions 2.36 and earlier. A remote attack...

Remote Code Execution (RCE)

OrientDB Core is vulnerable to remote code execution RCE attacks. Permissions are not enforced on a user executing a statement to the ORole structure containing a where, fetchplan or order by statement. By executing a groovy function where the groovy wrapper doesn't have a sandbox, any system...

Oracle Database Server 'OJVM' Component Unspecified Vulnerability

Oracle Database Server is prone to multiple unspecified security vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

OrientDB - Code Execution

Vulnerability Summary The following advisory reports a vulnerability in OrientDB which allows users of the product to cause it to execute code. OrientDB is a Distributed Graph Database engine with the flexibility of a Document Database all in one product. The first and best scalable,...

Groovy: Remote code execution via deserialization

It was found that a flaw in Apache groovy library allows remote code execution wherever deserialization occurs in the application. It is possible for an attacker to craft a special serialized object that will execute code directly when deserialized. All applications which rely on serialization an...

Important: Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R2 security and bug fix update

An update is now available for Red Hat JBoss Fuse and Red Hat JBoss A-MQ. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

elasticsearch: remote code execution via Groovy sandbox bypass

It was reported that Elasticsearch versions 1.3.0-1.3.7 and 1.4.0-1.4.2 have vulnerabilities in the Groovy scripting engine. The vulnerability allows an attacker to construct Groovy scripts that escape the sandbox and execute shell commands as the user running the Elasticsearch Java VM...

Joomla Groovy Gallery 1.0.0 Component - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component Groovy Gallery v1.0.0 - SQL Injection Google Dork: inurl:index.php?option=comgroovygallery Date: 17.02.2017 Vendor Homepage: http://addonstreet.com/ Software Buy:...

Joomla! Component Groovy Gallery 1.0.0 - SQL Injection

Exploit Title: Joomla! Component Groovy Gallery v1.0.0 - SQL Injection Google Dork: inurl:index.php?option=comgroovygallery Date: 17.02.2017 Vendor Homepage: http://addonstreet.com/ Software Buy: https://extensions.joomla.org/extensions/extension/photos-a-images/galleries/groovy-gallery/ Demo:...

Joomla! Component Groovy Gallery 1.0.0 - SQL Injection

Joomla! Component Groovy Gallery 1.0.0 - SQL Injection Exploit Title: Joomla! Component Groovy Gallery v1.0.0 - SQL Injection Google Dork: inurl:index.php?option=comgroovygallery Date: 17.02.2017 Vendor Homepage: http://addonstreet.com/ Software Buy:...

Joomla Groovy Gallery 1.0.0 SQL Injection

Exploit Title: Joomla! Component Groovy Gallery v1.0.0 - SQL Injection Google Dork: inurl:index.php?option=comgroovygallery Date: 17.02.2017 Vendor Homepage: http://addonstreet.com/ Software Buy: https://extensions.joomla.org/extensions/extension/photos-a-images/galleries/groovy-gallery/ Demo:...

Moderate: Red Hat Security Advisory: Red Hat JBoss Data Virtualization security and bug fix update

An update is now available for Red Hat JBoss Data Virtualization. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

Groovy: Remote code execution via deserialization

It was found that a flaw in Apache groovy library allows remote code execution wherever deserialization occurs in the application. It is possible for an attacker to craft a special serialized object that will execute code directly when deserialized. All applications which rely on serialization an...

CVE-2016-3102

The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugin that performs 1 direct field access or 2 get/set array operations...

CVE-2016-3102

The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugin that performs 1 direct field access or 2 get/set array operations...