CVE-2017-3208

CVE-2017-3208 affects WebORB for Java (Midnight Coders), where the Java AMF3 deserializers can process XML embedded in AMF3 messages and allow XML External Entity (XXE) references. The issue arises from deserialization behavior using or allowing untrusted data, potentially enabling exposure of se...

CVE-2017-3207

CVE-2017-3207 affects WebORB for Java by Midnight Coders (v5.1.1.0). The AMF3 deserializers derive class instances from java.io.Externalizable instead of the recommended flash.utils.IExternalizable, enabling a remote attacker able to spoof/control an RMI server to send serialized Java objects tha...

CVE-2017-3207 WebORB for Java by Midnight Coders, version 5.1.1.0, Action Message Format (AMF3) Java implementation is vulnerable to insecure deserialization

The Java implementations of AMF3 deserializers in WebORB for Java by Midnight Coders, version 5.1.1.0, derive class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an R...

WebORB for Java Remote Code Execution Vulnerability

Midnight Coders WebORB for Java is a cross-platform Midnight Coders, Inc. integration server for desktop, browser and mobile clients and the corresponding Java POJO and other components and Web services to provide a common connection to data and media. A remote code execution vulnerability exists...

AMF3 Java implementations deserialization Vulnerability

Details reference: https://codewhitesec.blogspot.kr/2017/04/amf.html Some Java implementations of AMF3 deserializers derive class instances from java. io. Externalizable rather than the AMF3 specification's recommendation of a flash. utils. IExternalizable. A remote attacker with the ability to...

AMF3 Java implementations Improper Restriction of XML External Entity Reference ('XXE')

A detailed analysis of the reference: https://codewhitesec.blogspot.kr/2017/04/amf.html Some Java implementations of AMF3 deserializers allow the external entity references XXEs from XML documents embedded within AMF3 messages. If the XML parsing is handled incorrectly it could potentially expose...

Action Message Format (AMF3) Java implementations are vulnerable to insecure deserialization and XML external entities references

Overview Several Java implementations of AMF3 are vulnerable to insecure deserialization and XML external entities references. Description Several Java implementations of Action Message Format AMF3 are vulnerable to one or more of the following implementation errors:CWE-502: Deserialization of...

midnight-blue.com XSS vulnerability

Open Bug Bounty ID: OBB-177640 Description| Value ---|--- Affected Website:| midnight-blue.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

Gentoo Security Advisory GLSA 201402-18

Gentoo Linux Local Security Checks GLSA 201402-18 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

GLSA-201402-18 : GNU Midnight Commander: User-assisted execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-201402-18 GNU Midnight Commander: User-assisted execution of arbitrary code GNU Midnight Commander does not properly sanitize environment variables. Impact : A remote attacker could entice a user to open a specially crafted archiv...

GNU Midnight Commander: User-assisted execution of arbitrary code

Background GNU Midnight Commander is a text based file manager. Description GNU Midnight Commander does not properly sanitize environment variables. Impact A remote attacker could entice a user to open a specially crafted archive file using GNU Midnight Commander, possibly resulting in execution ...

[SECURITY] Fedora 19 Update: gpm-1.20.6-33.fc19

Gpm provides mouse support to text-based Linux applications like the Emacs editor and the Midnight Commander file management system. Gpm also provides console cut-and-paste operations using the mouse and includes a program to allow pop-up menus to appear at the click of a mouse button...

Fedora Update for mc FEDORA-2012-19349

Check for the Version of mc OpenVAS Vulnerability Test Fedora Update for mc FEDORA-2012-19349 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms of th...

[SECURITY] Fedora 17 Update: mc-4.8.6-2.fc17

Midnight Commander is a visual shell much like a file manager, only with many more features. It is a text mode application, but it also includes mouse support. Midnight Commander's best features are its ability to FTP, view tar and zip files, and to poke into RPMs for specific files...

[SECURITY] Fedora 18 Update: mc-4.8.6-2.fc18

Midnight Commander is a visual shell much like a file manager, only with many more features. It is a text mode application, but it also includes mouse support. Midnight Commander's best features are its ability to FTP, view tar and zip files, and to poke into RPMs for specific files...

Fedora 18 : mc-4.8.6-2.fc18 (2012-19335)

sanitize of MCEXTSELECTED variable when viewing multiple files, CVE-2012-4463 862814 https://www.midnight-commander.org/ticket/2913 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically...

CVE-2012-4463

Midnight Commander mc 4.8.5 does not properly handle the 1 MCEXTSELECTED or 2 MCEXTONLYTAGGED environment variables when multiple files are selected, which allows user-assisted remote attackers to execute arbitrary commands via a crafted file name...

CVE-2012-4463

Midnight Commander mc 4.8.5 does not properly handle the 1 MCEXTSELECTED or 2 MCEXTONLYTAGGED environment variables when multiple files are selected, which allows user-assisted remote attackers to execute arbitrary commands via a crafted file name...

DEBIAN-CVE-2012-4463

Midnight Commander mc 4.8.5 does not properly handle the 1 MCEXTSELECTED or 2 MCEXTONLYTAGGED environment variables when multiple files are selected, which allows user-assisted remote attackers to execute arbitrary commands via a crafted file name...

Design/Logic Flaw

Midnight Commander mc 4.8.5 does not properly handle the 1 MCEXTSELECTED or 2 MCEXTONLYTAGGED environment variables when multiple files are selected, which allows user-assisted remote attackers to execute arbitrary commands via a crafted file name...