K78825687: Python and Jython vulnerability CVE-2014-7185

Security Advisory Description Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain sensitive information from process memory via a large size and offset in a "buffer" function. CVE-2014-7185 Impact An attacker that is able to control arguments in...

K53192206: Python and Jython vulnerability CVE-2013-1752

Security Advisory Description REJECT Various versions of Python do not properly restrict readline calls, which allows remote attackers to cause a denial of service memory consumption via a long string, related to 1 httplib - fixed in 2.7.4, 2.6.9, and 3.3.3; 2 ftplib - fixed in 2.7.6, 2.6.9, 3.3....

SUSE CVE-2013-2027

Jython 2.2.1 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restrictions via unspecified vectors...

SUSE CVE-2016-4000

Jython before 2.7.1rc1 allows attackers to execute arbitrary code via a crafted serialized PyFunction object...

Pega Platform 8.7.3 Remote Code Execution Vulnerability

Pega Platform versions 8.1.0 through 8.7.3 suffer from a remote code execution vulnerability. If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly configured, then it may be possible to uplo...

Pega Platform 8.7.3 Remote Code Execution

Exploit Title: Pega Platform 8.1.0 and higher Remote Code Execution Google Dork: N/A Date: 20 Oct 2022 Exploit Author: Marcin Wolak using MOGWAI LABS JMX Exploitation Toolkit Vendor Homepage: www.pega.com Software Link: Not Available Version: 8.1.0 on-premise and higher, up to 8.7.3 Tested on: Re...

at.ac.ait.lablink.clients:csvclient (>=0.0.1 <=0.0.2), at.ac.ait.lablink.clients:dpbridge (>=0.0.1 <=0.0.3) +302 more potentially affected by CVE-2013-2027 via org.python:jython-standalone (>=2.5.2 <=2.7.2)

org.python:jython-standalone MAVEN version =2.5.2, =0.0.1, =0.0.1, =0.0.1, =0.0.2, =0.0.2, =0.0.1, =0.0.1, =0.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.0.0, =1.0.0, =1.3.0, =2.1.2 and more Source cves: CVE-2013-2027 Source advisory: OSV:GHSA-9347-9W64-Q5WP...

GHSA-9347-9W64-Q5WP Jython Improper Access Restrictions vulnerability

Jython before 2.7.2b3 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restrictions via unspecified vectors...

Jython Improper Access Restrictions vulnerability

Jython before 2.7.2b3 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restrictions via unspecified vectors...

Deserialization of Untrusted Data in Jython

Jython before 2.7.1b3 allows attackers to execute arbitrary code via a crafted serialized PyFunction object...

GHSA-6R7R-JJ8H-PQ6V Deserialization of Untrusted Data in Jython

Jython before 2.7.1b3 allows attackers to execute arbitrary code via a crafted serialized PyFunction object...

cc.autoapi.pucong:auto-flow-core-flow (>=2.0.0 <=2.0.9), cc.autoapi.pucong:auto-flow-persistence (>=2.0.0 <=2.0.9) +178 more potentially affected by CVE-2016-4000 via org.python:jython-standalone (>=2.5.2 <=2.7.0)

org.python:jython-standalone MAVEN version =2.5.2, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.0.0, =1.0.0, =1.3.0, =1.0, =1.0-M1, =1.0-M3, =0.2.13, =0.2.13, =1.0.0, =1.1.0 and more Source cves: CVE-2016-4000 Source advisory: OSV:GHSA-6R7R-JJ8H-PQ6V...

cn.hutool:hutool-script (=5.2.5), cn.structured:structure-function-context (=1.0.2) +211 more potentially affected by CVE-2016-4000 via org.python:jython (>=2.2 <=2.7.0)

org.python:jython MAVEN version =2.2, =1.0.1, =1.0.1, =7.12.0, =1.0.110-RELEASE, =1.0.111-RELEASE, =1.0.111-RELEASE, =1.1.0-RELEASE, =1.0.111-RELEASE, =1.0.111-RELEASE, =1.1.24-RELEASE - com.ahome-it:ahome-tooling-server-vaadin-core =1.0.112-RELEASE - com.alibaba.graphscope:grape-demo =0.18.1 -...

Mageia: Security Advisory (MGASA-2015-0096)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Haptyc - Test Generation Framework

Haptyc is a python library which was built to add payload position support and Sniper/Clusterbomb/Batteringram/Pitchfork attack types into Turbo Intruder. While Haptyc accomplishes these goals fairly well it also introduces a simpler way to express test sequences in general. While this library wa...

GitHub Security Lab: [Java] CWE-094: Jython code injection

This bug was reported directly to GitHub Security Lab...

AuthMatrix - A Burp Suite Extension That Provides A Simple Way To Test Authorization

AuthMatrix is an extension to Burp Suite that provides a simple way to test authorization in web applications and web services. With AuthMatrix, testers focus on thoroughly defining tables of users, roles, and requests for their specific target application upfront. These tables are structured in ...

Burp Exporter - A Burp Suite Extension To Copy A Request To The Clipboard As Multiple Programming Languages Functions

Exporter is a Burp Suite extension to copy a request to the clipboard as multiple programming languages functions. You can export as: cURL Wget Python Request Perl LWP PHP HTTPRequest2 Go Native NodeJS Request jQuery AJAX PowerShell Requirements Jython = 2.7.1 Burp Suite import In Burp Suite, und...

Oracle Application Testing Suite Multiple Vulnerabilities (Jan 2020 CPU)

The version of Oracle Application Testing Suite installed on the remote host is affected by multiple vulnerabilities : - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager component: Oracle Flow Builder Jython. Supported versions that are affected are...

Asset Discover - Burp Suite Extension To Discover Assets From HTTP Response

Burp Suite extension to discover assets from HTTP response using passive scanning. Refer our blog Asset Discovery using Burp Suite for more details. The extension is now part of the BApp store and can be installed directly from the Burp Suite...