CVE-2016-6497

main/java/org/apache/directory/groovyldap/LDAP.java in the Groovy LDAP API in Apache allows attackers to conduct LDAP entry poisoning attacks by leveraging setting returnObjFlag to true for all search methods...

CVE-2016-6497

main/java/org/apache/directory/groovyldap/LDAP.java in the Groovy LDAP API in Apache allows attackers to conduct LDAP entry poisoning attacks by leveraging setting returnObjFlag to true for all search methods...

CVE-2016-6497

The CVE-2016-6497 issue affects Apache Groovy LDAP API (Groovy LDAP), specifically main/java/org/apache/directory/groovyldap/LDAP.java. The vulnerability stems from enabling returnObjFlag to true for all search methods, which attackers could abuse to perform LDAP entry poisoning attacks. The prov...

Apache Groovy Remote Code Execution Vulnerability

Apache Groovy is a JVM-based agile development language from the Apache Apache Software Foundation, which combines many of the powerful features of Python, Ruby and Smalltalk. A remote code execution vulnerability exists in Apache Groovy versions prior to 2.4.8. An attacker could exploit this...

Remote Execution Through Object Deserialization

Apache Groovy is vulnerable to remote execution.The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.7 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object. Note this is similar to CVE-2015-3253 but this...

CVE-2016-6814

It was found that a flaw in Apache groovy library allows remote code execution wherever deserialization occurs in the application. It is possible for an attacker to craft a special serialized object that will execute code directly when deserialized. All applications which rely on serialization an...

FreeBSD : groovy -- remote execution of untrusted code/DoS vulnerability (4af92a40-db33-11e6-ae1b-002590263bf5)

The Apache Groovy project reports : When an application with Groovy on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it is possible for an attacker to bake a special serialized object that will execute code directly when...

Apache Groovy CVE-2016-6814 Remote Code Execution Vulnerability

Description Apache Groovy is prone to a remote code-execution vulnerability. An attacker can exploit this issue to execute arbitrary code within the context of the user running the affected application. Failed exploit attempts will result in a denial-of-service condition. Apache Groovy 2.4.4...

Exploit for CVE-2015-1427

Elasticsearch 1.4.0 1.4.2 Remote Code Execution Elastics...

Pornhub: Unsecured DB instance

The researcher identified vulnerable OrientDB server instances on our infrastructure. The DB servers were found to be vulnerable to script based remote code execution leading to privilege escalation. Two servers running OrientDB were identified, with default login/password combinations. Upon...

GLSA-201610-01 : Groovy: Arbitrary code execution

The remote host is affected by the vulnerability described in GLSA-201610-01 Groovy: Arbitrary code execution Groovys MethodClosure class, in runtime/MethodClosure.java, is vulnerable to a crafted serialized object. Impact : Remote attackers could potentially execute arbitrary code, or cause Deni...

Groovy: Arbitrary code execution

Background A multi-faceted language for the Java platform Description Groovy’s MethodClosure class, in runtime/MethodClosure.java, is vulnerable to a crafted serialized object. Impact Remote attackers could potentially execute arbitrary code, or cause Denial of Service condition Workaround A...

groovy -- remote execution of untrusted code/DoS vulnerability

The Apache Groovy project reports: When an application with Groovy on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it is possible for an attacker to bake a special serialized object that will execute code directly when...

jenkins: Remote code execution through remote API (SECURITY-247)

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando...

Grails console CSRF vulnerability

Grails is a set of open source framework for rapid Web application development , it is based on the Groovy programming language , and built on top of Spring, Hibernate and other open source frameworks , is a highly productive one-stop framework . Grails has a security vulnerability , an attack ca...

groovy: remote execution of untrusted code in class MethodClosure

A flaw was discovered in the way applications using Groovy used the standard Java serialization mechanism. A remote attacker could use a specially crafted serialized object that would execute code directly when deserialized. All applications which rely on serialization and do not isolate the code...

Critical: Red Hat Security Advisory: Red Hat JBoss SOA Platform security update

An update is now available for Red Hat JBoss SOA Platform 5.3.1. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

Jenkins CI Server XStream Insecure Deserialization (CVE-2016-0792)

An insecure deserialization vulnerability has been reported in Jenkins CI Server. This vulnerability is due to the inclusion of the Groovy library in the classpath combined with the insecure deserialization employing the XStream library. A remote, unauthenticated attacker can exploit this...

jenkins: Remote code execution through remote API (SECURITY-247)

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando...

CVE-2016-0792

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando...