CVE-2016-3690

It was discovered that the LegacyInvokerServlet is exposed on all network interfaces and deserializes objects sent to it. An attacker could use this flaw to cause remote code execution in the JVM running it. Mitigation The PooledInvokerServlet is no longer required and can be removed by following...