CVE-2021-37579

The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there's an exception that the attacker can use to skip the security check when enabled and reaching a deserialization operation with native jav...

PT-2021-21719

Name of the Vulnerable Software and Affected Versions Apache Dubbo versions prior to 2.7.13 Apache Dubbo versions prior to 3.0.2 Description The issue concerns a pre-authentication unsafe Java deserialization in Apache Dubbo. This allows an attacker to bypass security checks and perform a...

CVE-2021-36981

In the server in SerNet verinice before 1.22.2, insecure Java deserialization allows remote authenticated attackers to execute arbitrary code...

CVE-2021-36981

In the server in SerNet verinice before 1.22.2, insecure Java deserialization allows remote authenticated attackers to execute arbitrary code...

Deserialization of untrusted data

In the server in SerNet verinice before 1.22.2, insecure Java deserialization allows remote authenticated attackers to execute arbitrary code...

CVE-2021-36981

In the server in SerNet verinice before 1.22.2, insecure Java deserialization allows remote authenticated attackers to execute arbitrary code...

CVE-2021-36981

CVE-2021-36981 : In SerNet verinice servers before 1.22.2, insecure Java deserialization allows remote authenticated attackers to achieve arbitrary code execution. Affected: SerNet verinice server prior to version 1.22.2. Root cause: insecure Java deserialization in the server component. Impact: ...

SerNet verinice 代码问题漏洞

SerNet verinice is a Java application from SerNet Germany. A tool for managing information security. SerNet verinice suffers from a code issue vulnerability that stems from insecure Java deserialization in SerNet verinice servers prior to version 1.22.2 that allows an authenticated, remote attack...

CVE-2021-36981: Deserialization of Untrusted Data

In the server in SerNet verinice before 1.22.2, insecure Java deserialization allows remote authenticated attackers to execute arbitrary code...

PT-2021-21418 · Sernet · Sernet Verinice

Name of the Vulnerable Software and Affected Versions: SerNet verinice versions prior to 1.22.2 Description: The issue allows remote authenticated attackers to execute arbitrary code due to insecure Java deserialization. Recommendations: For versions prior to 1.22.2, update to version 1.22.2 or...

CVE-2021-36981

In the server in SerNet verinice before 1.22.2, insecure Java deserialization allows remote authenticated attackers to execute arbitrary code...

Neo4j 3.4.18 - RMI based Remote Code Execution (RCE)

Exploit Title: Neo4j 3.4.18 - RMI based Remote Code Execution RCE Date: 7/30/21 Exploit Author: Christopher Ellis, Nick Gonella, Workday Inc. Vendor Homepage: neo4j.com Software Link: https://neo4j.com/download-thanks/?edition=community&release=3.4.18&flavour=unix Version: 3.4.18 Tested on:...

Neo4j 3.4.18 Remote Code Execution

Exploit Title: Neo4j 3.4.18 - RMI based Remote Code Execution RCE Date: 7/30/21 Exploit Author: Christopher Ellis, Nick Gonella, Workday Inc. Vendor Homepage: neo4j.com Software Link: https://neo4j.com/download-thanks/?edition=community&release=3.4.18&flavour=unix Version: 3.4.18 Tested on:...

PT-2021-4021

Name of the Vulnerable Software and Affected Versions Apache jUDDI versions prior to 3.3.10 Description The issue is related to the use of Java's Remote Method Invocation RMI in Apache jUDDI, which provides an alternate transport for accessing UDDI services. RMI uses the default Java serializatio...

CVE-2021-35464

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/ request to the server. The vulnerabilit...

CVE-2021-35464

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/ request to the server. The vulnerabilit...

CVE-2021-35464

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/ request to the server. The vulnerabilit...

CVE-2021-35464

CVE-2021-35464 affects ForgeRock OpenAM/Access Management: Java deserialization in the JATO framework allows pre-auth remote code execution on ForgeRock AM Core Server when running versions prior to 7.0. An attacker can trigger RCE by sending a crafted HTTP request to endpoints like /ccversion/Ve...

Pre-auth RCE in ForgeRock Access Manager (CVE-2021-35464)

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/ request to the server. The vulnerabilit...

CVE-2021-35464: Deserialization of Untrusted Data

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/ request to the server. The vulnerabilit...