CVE-2022-23463 SpEL Injection in Nepxion Discovery

Nepxion Discovery is a solution for Spring Cloud. Discover is vulnerable to SpEL Injection in discovery-commons. DiscoveryExpressionResolver’s eval method is evaluating expression with a StandardEvaluationContext, allowing the expression to reach and interact with Java classes such as...

GHSA-V6FQ-Q792-J46J Improper Input Validation in Apache Unomi

Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process...

Improper Input Validation in Apache Unomi

Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process...

Crafter CMS Code Execution Vulnerability

Crafter CMS is an open source content management system CMS for digital experience applications.A code execution vulnerability exists in Crafter CMS, which stems from a web-based system or product that does not properly authenticate incoming data. An authenticated attacker could modify the main...

Crafter CMS 安全漏洞

Crafter CMS is an open source content management system CMS for digital experience applications.A code execution vulnerability exists in Crafter CMS, which stems from a web-based system or product that does not properly authenticate incoming data. An authenticated attacker could modify the main...

Open-xchange OX App Suite Code Injection Vulnerability

Open-xchange OX App Suite is a Web cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A code injection vulnerability exists in Open-xchange OX App Suite, which can be exploited by attacker...

CVE-2021-33493

The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format...

CVE-2021-33493

The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format...

CVE-2021-33493

The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format...

CVE-2021-33493

The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format...

CVE-2021-33493: Improper Control of Generation of Code

The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format...

VulnCheck KEV: CVE-2020-11975

Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process...

CVE-2020-11975

Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process...

Design/Logic Flaw

Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process...

Server-Side Template Injection

pebble is vulnerable to server-side template injection. The fix for an older vulnerability that validates for getClass can be bypassed to inject arbitrary code through the template using Java classes that have TYPE static field containing values that is an instance of java.lang.Class. For example...

Critical severity vulnerability that affects generator-jhipster

Account takeover and privilege escalation is possible in applications generated by generator-jhipster before 6.3.0. This is due to a vulnerability in the generated java classes: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator PRNG Generated applications must be manually...

GHSA-MWP6-J9WF-968C Critical severity vulnerability that affects generator-jhipster

Account takeover and privilege escalation is possible in applications generated by generator-jhipster before 6.3.0. This is due to a vulnerability in the generated java classes: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator PRNG Generated applications must be manually...

The vulnerability of the OpenEdge software platform, related to deficiencies in access control, allows a hacker to execute malicious Java classes.

The vulnerability of the OpenEdge software platform is related to deficiencies in access control when using the standard configuration. Exploiting this vulnerability allows a malicious actor to upload and execute malicious Java classes through specially crafted URL addresses using port 20931...

Progress Software OpenEdge Design Vulnerability

Progress Software OpenEdge is a suite of e-commerce platforms from Progress Software, USA. A security vulnerability exists in Progress Software OpenEdge versions 10.2x and 11.x, which is caused by an insecure default setting. The vulnerability can be exploited by remote attackers to load and remo...

Default configuration

Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows unauthenticated remote attackers to specify arbitrary URLs from which to load and execute malicious Java classes via port 20931...