CVE-2015-1778: Improper Authentication

The custom authentication realm used by karaf-tomcat's "opendaylight" realm in Opendaylight before Helium SR3 will authenticate any username and password combination...

PT-2017-6516

Name of the Vulnerable Software and Affected Versions Opendaylight versions prior to Helium SR3 Description The issue concerns the custom authentication realm used by karaf-tomcat's "opendaylight" realm in Opendaylight. This realm will authenticate any username and password combination, indicatin...

Unauthorized Access

karaf-webconsole is vulnerable to unauthorized access. The vulnerability exists when the gogo feature is installed with the webconsole feature, causing the /gogo endpoint to be accessed without authentication...

BlackBerry Good Enterprise Mobility Server Arbitrary Command Execution Vulnerability

The BlackBerry Good Enterprise Mobility Server GEMS is an enterprise mobility server from BlackBerry Canada. A security vulnerability exists in Apache Karaf in BlackBerry GEMS versions 2.1.5.3 through 2.2.22.25. A remote attacker could exploit the vulnerability by executing commands to gain local...

CVE-2016-3129

A remote shell execution vulnerability in the BlackBerry Good Enterprise Mobility Server GEMS implementation of the Apache Karaf command shell in GEMS versions 2.1.5.3 to 2.2.22.25 allows remote attackers to obtain local administrator rights on the GEMS server via commands executed on the Karaf...

Remote code execution

A remote shell execution vulnerability in the BlackBerry Good Enterprise Mobility Server GEMS implementation of the Apache Karaf command shell in GEMS versions 2.1.5.3 to 2.2.22.25 allows remote attackers to obtain local administrator rights on the GEMS server via commands executed on the Karaf...

CVE-2016-3129

A remote shell execution vulnerability in the BlackBerry Good Enterprise Mobility Server GEMS implementation of the Apache Karaf command shell in GEMS versions 2.1.5.3 to 2.2.22.25 allows remote attackers to obtain local administrator rights on the GEMS server via commands executed on the Karaf...

CVE-2016-3129

The CVE-2016-3129 entry describes a remote code execution vulnerability in BlackBerry Good Enterprise Mobility Server (GEMS) via the Apache Karaf command shell. Affected versions are 2.1.5.3 through 2.2.22.25. An attacker can execute commands to gain local administrator rights on the GEMS server....

CVE-2016-3129: Undefined Security Weakness

A remote shell execution vulnerability in the BlackBerry Good Enterprise Mobility Server GEMS implementation of the Apache Karaf command shell in GEMS versions 2.1.5.3 to 2.2.22.25 allows remote attackers to obtain local administrator rights on the GEMS server via commands executed on the Karaf...

PT-2016-5376

Name of the Vulnerable Software and Affected Versions BlackBerry Good Enterprise Mobility Server versions 2.1.5.3 through 2.2.22.25 Description A remote shell execution issue in the Apache Karaf command shell implementation allows remote attackers to obtain local administrator rights on the serve...

LDAP Code Injection

org.apache.karaf.jaas.modules is vulnerable to LDAP code injection. This is caused because the username is not encoded...

Apache Karaf Remote Code Execution Vulnerability

Karaf is an open source project under the Apache , to provide a can be used to deploy a variety of components , applications, OSGi containers . A remote code execution vulnerability exists in Apache Karaf. An attacker exploiting the vulnerability could execute arbitrary code in the context of an...

CVE-2016-8648

It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via JMX operations. An attacker could use this flaw to execute remote code on the server as the user running the Java Virtual Machine if the target MBean contain...

Apache Karaf Default Credentials (SSH)

The remote Apache Karaf is using known default credentials. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Apache Karaf Login Utility

This module attempts to log into Apache Karaf's SSH. If the TRYDEFAULTCRED option is set, then it will also try the default 'karaf' credential. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'net/ssh' require...

Apache Karaf Default Credentials Command Execution

This module exploits a default misconfiguration flaw on Apache Karaf versions 2.x-4.x. The 'karaf' user has a known default password, which can be used to login to the SSH service, and execute operating system commands from remote. Module Options msf use...

CVE-2014-7733

The Karaf Magazin aka com.magzter.karafmagazin application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7733

The Karaf Magazin aka com.magzter.karafmagazin application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Karaf Magazin aka com.magzter.karafmagazin application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7733

The Karaf Magazin aka com.magzter.karafmagazin application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...