153 matches found
Apache JMeter RMI Code Execution PoC (CVE-2018-1297)
PenTestIT RSS Feed Recently, I read about a remote code execution RCE vulnerability; CVE-2018-1297, that affects yet another Apache product - JMeter. As you might know, "The Apache JMeter™ application is open source software, a 100% pure Java application designed to load test functional behavior...
HPE iMC 7.3 - RMI Java Deserialization Exploit
Exploit for windows platform in category remote exploits Exploit Title: HPE iMC 7.3 Java RMI Registry Deserialization RCE Vulnerability Exploit Author: Chris Lyne @lynerc Vendor Homepage: www.hpe.com Software Link:...
The vulnerability of the Java RMI interface of the Smart Network Configuration Manager system allows a perpetrator to execute arbitrary code or cause service failures.
The vulnerability of the Java RMI interface of the Smart Network Configuration Manager, a system for automatic management of network configurations, is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary...
BaRMIe - Java RMI Enumeration And Attack Tool
BaRMIe is a tool for enumerating and attacking Java RMI Remote Method Invocation services. RMI services often expose dangerous functionality without adequate security controls, however RMI services tend to pass under the radar during security assessments due to the lack of effective testing tools...
Adobe ColdFusion Deserialization RCE (CVE-2017-11283, CVE-2017-11238)
During my research into the Java Remote Method Invocation RMI protocol, the most common RMI service that I came across was Adobe ColdFusion’s Flex integration service which is used to support integration between Flash applications and ColdFusion components. A quick look at this service led to the...
SmartBear SoapUI 5.3.0 Remote Code Execution Via Deserialization Vulnerability
Exploit for java platform in category remote exploits Title: SmartBear SoapUI - Remote Code Execution via Deserialization Author: Jakub Palaczynski Date: 12. July 2017 Exploit tested on: ================== SoapUI 5.3.0 Also works on older versions. Vulnerability: Remote Code Execution via...
Java RMI Enumeration & Attack Tool: BaRMIe
BaRMIe is a tool for enumerating and attacking Java RMI Remote Method Invocation services. RMI services often expose dangerous functionality without adequate security controls, however RMI services tend to pass under the radar during security assessments due to the lack of effective testing tools...
CVE-2017-10932
All versions prior to V12.17.20 of the ZTE Microwave NR8000 series products - NR8120, NR8120A, NR8120, NR8150, NR8250, NR8000 TR and NR8950 are the applications of C/S architecture using the Java RMI service in which the servers use the Apache Commons Collections ACC library that may result in Ja...
Deserialization of untrusted data
All versions prior to V12.17.20 of the ZTE Microwave NR8000 series products - NR8120, NR8120A, NR8120, NR8150, NR8250, NR8000 TR and NR8950 are the applications of C/S architecture using the Java RMI service in which the servers use the Apache Commons Collections ACC library that may result in Ja...
CVE-2017-10932: Deserialization of Untrusted Data
All versions prior to V12.17.20 of the ZTE Microwave NR8000 series products - NR8120, NR8120A, NR8120, NR8150, NR8250, NR8000 TR and NR8950 are the applications of C/S architecture using the Java RMI service in which the servers use the Apache Commons Collections ACC library that may result in Ja...
CVE-2017-10932
All versions prior to V12.17.20 of the ZTE Microwave NR8000 series products - NR8120, NR8120A, NR8120, NR8150, NR8250, NR8000 TR and NR8950 are the applications of C/S architecture using the Java RMI service in which the servers use the Apache Commons Collections ACC library that may result in Ja...
OpenJDK: incorrect handling of references in DGC (RMI, 8163958)
It was discovered that the DCG implementation in the RMI component of OpenJDK failed to correctly handle references. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of RMI registry or a Java RMI application...
ManageEngine Applications Manager < 13200 Multiple Vulnerabilities
ManageEngine Applications Manager is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
CVE-2017-2767
EMC Network Configuration Manager NCM 9.3.x, EMC Network Configuration Manager NCM 9.4.0.x, EMC Network Configuration Manager NCM 9.4.1.x, EMC Network Configuration Manager NCM 9.4.2.x contains a Java RMI Remote Code Execution vulnerability that could potentially be exploited by malicious users t...
Remote code execution
EMC Network Configuration Manager NCM 9.3.x, EMC Network Configuration Manager NCM 9.4.0.x, EMC Network Configuration Manager NCM 9.4.1.x, EMC Network Configuration Manager NCM 9.4.2.x contains a Java RMI Remote Code Execution vulnerability that could potentially be exploited by malicious users t...
CVE-2017-2767
EMC Network Configuration Manager (NCM) versions 9.3.x, 9.4.0.x, 9.4.1.x, and 9.4.2.x are associated with a Java RMI remote code execution vulnerability. The connected CNVD/NVD records describe a remote code execution flaw that could allow a malicious attacker to take control of an affected syste...
CVE-2017-2767
EMC Network Configuration Manager NCM 9.3.x, EMC Network Configuration Manager NCM 9.4.0.x, EMC Network Configuration Manager NCM 9.4.1.x, EMC Network Configuration Manager NCM 9.4.2.x contains a Java RMI Remote Code Execution vulnerability that could potentially be exploited by malicious users t...
CVE-2017-2767: Improper Authentication
EMC Network Configuration Manager NCM 9.3.x, EMC Network Configuration Manager NCM 9.4.0.x, EMC Network Configuration Manager NCM 9.4.1.x, EMC Network Configuration Manager NCM 9.4.2.x contains a Java RMI Remote Code Execution vulnerability that could potentially be exploited by malicious users t...
CVE-2017-3241
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: RMI. Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Difficult to exploit vulnerability allows unauthenticated attacker with...
Java RMI Server Insecure Default Configuration RCE Vulnerability - Active Check
Multiple Java products that implement the RMI Server contain a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code remote code execution/RCE on a targeted system with elevated privileges. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions mig...