CVE-2019-0192

CVE-2019-0192 - Apache Solr RCE 5.0.0 à 5.5.5 et 6.0.0 à 6.6.5 Ceci est un PoC précoce de la RCE Apache Solr Extrait de https://issues.apache.org/jira/browse/SOLR-13301: ConfigAPI permet de configurer le serveur JMX de Solr via une requête HTTP POST. En le pointant vers un serveur RMI malveillant...

CVE-2019-12409

CVE-2019-12409 RCE dans Apache Solr ENABLEREMOTEJMXOPTS="true" root@kali:/opt/solr-8.1.1/bin cat solr.in.sh |grep true Définir à true pour activer le connecteur JMX RMI afin de permettre aux applications clientes JMX distantes ENABLEREMOTEJMXOPTS="true" SOLROPTS="$SOLROPTS...

CVE-2023-26269

CVE-2023-26269: Неправильно настроенный JMX в Apache James По умолчанию Apache James открывает службу JMXRMI, которая прослушивает localhost, порт 9999. Из-за того, что JMX неправильно настроен и допускает неаутентифицированный доступ, злоумышленник, имеющий локальный доступ к машине, на которой...

CVE-2018-14324-Exploit

Piratage d'Eclipse GlassFish - CVE-2018-14324 La description de la CVE-2018-14324 n'explique pas pleinement l'impact de cette vulnérabilité. En bref : vous avez accès à Java Management Extensions JMX via des identifiants codés en dur admin:admin. Bien que l'impact soit décrit comme «...

CVE-2026-46495 OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI

OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.1, the JMX RMI connector in opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/RmiConnector.java processes attacker-controlled credential objects before authentication without a restrictive...

EUVD-2026-78579

OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.1, the JMX RMI connector in opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/RmiConnector.java processes attacker-controlled credential objects before authentication without a restrictive...

CVE-2026-46495 OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI

OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.1, the JMX RMI connector in opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/RmiConnector.java processes attacker-controlled credential objects before authentication without a restrictive...

CVE-2026-46495: Deserialization of Untrusted Data

OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.1, the JMX RMI connector in opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/RmiConnector.java processes attacker-controlled credential objects before authentication without a restrictive...

GHSA-43X2-G84Q-FMQX OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI

Summary Description A Deserialization of Untrusted Data CWE-502 issue in OpenDJ's JMX RMI connector allows an unauthenticated remote attacker to deserialize arbitrary Java objects on the server. The vulnerability exists because the platform reads and processes attacker-controlled bytes prior to...

OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI

Summary Description A Deserialization of Untrusted Data CWE-502 issue in OpenDJ's JMX RMI connector allows an unauthenticated remote attacker to deserialize arbitrary Java objects on the server. The vulnerability exists because the platform reads and processes attacker-controlled bytes prior to...

BIT-ACTIVEMQ-2020-13920

Apache ActiveMQ uses LocateRegistry.createRegistry to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to...

EUVD-2018-3287

Malware in sbrugna...

EUVD-2019-17256

Malware in sbrugna...

EUVD-2020-25208

Malware in sbrugna...

EUVD-2022-6906

Malicious code in bioql PyPI...

EUVD-2022-2477

Malicious code in bioql PyPI...

EUVD-2022-1253

Malicious code in bioql PyPI...

CVE-2024-28211

nGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of executing arbitrary code via RMI registry by remote attacker...

CVE-2022-37022

Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 11. Any user wishing to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15. Use of 1.15 on Java 11 will...

CVE-2020-3943

vRealize Operations for Horizon Adapter 6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1 uses a JMX RMI service which is not securely configured. An unauthenticated remote attacker who has network access to vRealize Operations, with the Horizon Adapter running, may be able to execute arbitrary code ...