1828 matches found
The State of Web Application Vulnerabilities in 2017
As a web application firewall provider, part of our job at Imperva is constantly monitoring new security vulnerabilities. To do this, we use internal software that collects information from various data sources such as vulnerability databases, newsletters, forums, social media and more, integrate...
HPE Intelligent Management Center WebDMServlet Insecure Deserialization (CVE-2017-12558)
An insecure deserialization vulnerability exists in HPE Intelligent Management Center. The vulnerability is due to deserialization of untrusted data by the WebDMServlet while having vulnerable classes in the code path. A remote, unauthenticated attacker can exploit this vulnerability by sending a...
CVE-2017-8045
In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could be crafted to exploit this and enable a remote code execution attack...
CVE-2017-8045
In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could be crafted to exploit this and enable a remote code execution attack...
Adobe ColdFusion DataServicesCFProxy Insecure Deserialization (CVE-2017-11283)
An insecure deserialization vulnerability exists in the Flex integration service of Adobe ColdFusion. The vulnerability is due to the lack of input validation by the DataServicesCFProxy. A successful attack could lead to a remote code execution...
Adobe ColdFusion RMI Registry Insecure Deserialization (CVE-2017-11284)
An insecure deserialization vulnerability exists in the Flex integration service of Adobe ColdFusion. The vulnerability is due to the lack of input validation on objects in the RMI Registry before deserializing them. A remote, unauthenticated attacker can exploit this vulnerability by sending...
HPE Operations Orchestration central-remoting Insecure Deserialization (CVE-2017-8994)
An insecure deserialization vulnerability in HPE Operations Orchestration. The vulnerability is due to the deserialization of untrusted data in central-remoting servlets. A remote, unauthenticated attacker can exploit this vulnerability by sending crafted serialized data to the target application...
Apache Struts REST Plugin XStream Deserialization Remote Code Execution (CVE-2017-9805)
A remote code execution vulnerability exists in Apache Struts. This vulnerability is due to the an insecure deserialization. A remote attacker could exploit this vulnerability by sending a crafted request to the target server. Successful exploitation will allow an attacker to execute arbitrary co...
Apache Struts 2 framework REST plugin insecurely deserializes untrusted XML data
Overview Apache Struts 2 framework, versions 2.5 to 2.5.12, with REST plugin insecurely deserializes untrusted XML data. A remote, unauthenticated attacker can leverage this vulnerability to execute arbitrary code in the context of the Struts application. Description CWE-502: Deserialization of...
Exploit for Deserialization of Untrusted Data in Apache Log4J
CVE-2017-5645...
HPE Intelligent Management Center RMI Registry Insecure Deserialization (CVE-2017-5792)
An insecure deserialization vulnerability has been reported in HPE Intelligent Management Center. The vulnerability is due to deserialization of untrusted data by RMI Registry while having vulnerable classes in the code path. A remote, unauthenticated attacker can exploit this vulnerability by...
HPE Intelligent Management Center accessMgrServlet Insecure Deserialization (CVE-2017-5790)
An insecure deserialization vulnerability has been reported in HPE Intelligent Management Center. The vulnerability is due to deserialization of untrusted data by the accessMgrServlet while having vulnerable classes in the code path. A remote, unauthenticated attacker can exploit this vulnerabili...
JDK: insecure deserialization in CORBA, incorrect CVE-2013-5456 fix
The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 6.0.16.25, 6 R1 before SR8 FP25 6.1.8.25, 7 before SR9 FP40 7.0.9.40, 7 R1 before SR3 FP40 7.1.3.40, and 8 before SR3 8.0.3.0 does not properly deserialize classes in an AccessController...
ManageEngine Applications Manager Apache Commons Collections Insecure Deserialization (CVE-2016-9498)
An insecure deserialization vulnerability exists in ManageEngine Applications Manager. This vulnerability is due to the inclusion of the vulnerable version of Apache Commons Collections library in the classpath combined with insecure deserialization. A remote, unauthenticated attacker can exploit...
Action Message Format (AMF3) Java implementations are vulnerable to insecure deserialization and XML external entities references
Overview Several Java implementations of AMF3 are vulnerable to insecure deserialization and XML external entities references. Description Several Java implementations of Action Message Format AMF3 are vulnerable to one or more of the following implementation errors:CWE-502: Deserialization of...
Oracle WebLogic Server UnicastRef Insecure Deserialization (CVE-2017-3248)
An insecure deserialization vulnerability has been reported in Oracle WebLogic Server. This vulnerability is due to deseralization of untrusted data while having the UnicastRef class in the code path. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted...
HPE Operations Orchestration Insecure Deserialization (CVE-2016-8519)
An insecure deserialization vulnerability has been reported in HPE Operations Orchestration. The vulnerability is due to the deserialization of untrusted data in several servlets used for backwards compatibility with older API versions. A remote, unauthenticated attacker can exploit this...
Red5 Server Apache Commons Collections Insecure Deserialization
An insecure deserialization vulnerability has been reported in Red5 web server that is part of Apache OpenMeetings application. This vulnerability is due to the inclusion of the vulnerable version of Apache Commons Collections library in the classpath combined with insecure deserialization...
HPE Network Automation RPCServlet Insecure Deserialization (CVE-2016-8511)
An insecure deserialization vulnerability has been reported in the RPCServlet of HPE Network Automation. The vulnerability is due to the deserialization of untrusted data. A remote attacker can exploit this vulnerability sending a request with crafted serialized data to the exposed RPCServlet...
