Apache serialization mechanism does not have a list of classes allowed for serialization/deserialization

In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one...

com.ecfront:ezf-message (>=3.0.0-beta1 <=3.0.0-beta3), com.github.dexecutor:dexecutor-ignite (>=0.0.1 <=1.0.1) +91 more potentially affected by CVE-2016-6805 via org.apache.ignite:ignite-core (>=1.0.0-RC1 <=1.8.0)

org.apache.ignite:ignite-core MAVEN version =1.0.0-RC1, =3.0.0-beta1, =0.0.1, =1.0, =1.1.0-RELEASE, =1.0.0-RELEASE, =1.0.0-RELEASE, =0.0.5, =0.0.5, =0.0.5, =0.0.5, =0.0.5, =0.0.5, =0.0.10 and more Source cves: CVE-2016-6805 Source advisory: OSV:GHSA-8QFC-CVJP-MGPQ...

GHSA-8QFC-CVJP-MGPQ Moderate severity vulnerability that affects org.apache.ignite:ignite-core

Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents...

Moderate severity vulnerability that affects org.apache.ignite:ignite-core

Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents...

com.ecfront.dew:cluster-spi-ignite (>=1.0.0 <=1.1.4), com.ecfront:ezf-message (>=3.0.0-beta1 <=3.0.0-beta3) +103 more potentially affected by CVE-2017-7686 via org.apache.ignite:ignite-core (>=1.0.0-RC1 <=2.0.0)

org.apache.ignite:ignite-core MAVEN version =1.0.0-RC1, =1.0.0, =3.0.0-beta1, =0.0.1, =1.0, =1.1.0-RELEASE, =1.0.0-RELEASE, =1.0.0-RELEASE, =0.0.5, =0.0.5, =0.0.5, =0.0.8 and more Source cves: CVE-2017-7686 Source advisory: OSV:GHSA-8P83-68CW-943F...

GHSA-8P83-68CW-943F Apache Ignite communicates to an external PHP server where sensitive information is sent

Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixes and performance improvements. To do that the component communicates to an external PHP server http://ignite.run where it needs to send...

Apache Ignite communicates to an external PHP server where sensitive information is sent

Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixes and performance improvements. To do that the component communicates to an external PHP server http://ignite.run where it needs to send...

Ignite 2018 highlights: password-less sign-in, confidential computing, new threat protection, and more

What a week it was in Orlando! Ignite is always a biggie, and this one was no exception. For all of us here at Microsoft who get to work on security, spending time with customers to learn how you are using our security products today and to share new innovations to come is a highlight. At this...

Get deeper into security at Microsoft Ignite 2018

This year at Microsoft Ignite, we will be making some exciting announcementsfrom new capabilities for identity management and information protection to powerful artificial intelligence AI innovations that can help you stay ahead of an often overwhelming surge in threats and security alerts. Join ...

Critical: Red Hat Security Advisory: Red Hat FIS 2.0 on Fuse 6.3.0 R7 security and bug fix update

An update is now available for Red Hat Fuse Integration Services. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

ignite: Possible Execution of Arbitrary Code Within Deserialization Endpoints

In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one...

Apache Ignite Arbitrary Code Execution Vulnerability (CNVD-2018-15540)

Apache Ignite is the United States Apache Apache Software Foundation's set of high-performance, integrated and distributed for large-scale data set processing in-memory computing and transaction management platform. An arbitrary code execution vulnerability exists in Apache Ignite 2.5 and earlier...

Remote Code Execution (RCE)

ignite-core is vulnerable to remote code execution RCE attacks. The library does not restrict the types of classes that can be serialized or deserialized, allowing a malicious user to pass a serialized class to the GridClientJdkMarshaller endpoint to inject and execute arbitrary code...

CVE-2018-8018

In Apache Ignite before 2.4.8 and 2.5.x before 2.5.3, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be...

CVE-2018-8018

In Apache Ignite before 2.4.8 and 2.5.x before 2.5.3, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be...

Deserialization of untrusted data

In Apache Ignite before 2.4.8 and 2.5.x before 2.5.3, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be...

CVE-2018-8018

Impacted component: Apache Ignite. Affected versions include before 2.4.8 and 2.5.x before 2.5.3, where the serialization mechanism does not maintain a whitelist of allowed classes. Root cause: grids deserializing untrusted data via GridClientJdkMarshaller without a restricted class list, enablin...

CVE-2018-8018

In Apache Ignite before 2.4.8 and 2.5.x before 2.5.3, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be...

CVE-2018-11688

Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site,...

CVE-2018-11688

Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site,...