CVE-2020-13942byVulHub

CVE-2020-13942byVulHub Apache Unomi 表达式语言注入 RCE CVE-2020-13942 描述 该漏洞允许在运行 Apache Unomi 1.5.1 版本的系统上，通过利用 MVEL 表达式语言注入来执行任意命令。 项目页面 GitHub - Vulhub - Unomi CVE-2020-13942 环境配置 Docker Compose 文件 docker-compose.yml root@kitploit: version: '2' services: web: image: vulhub/unomi:1.5.1 ports: -...

unomi_exploit

Haftungsausschluss Die hier bereitgestellten Methoden zur Schwachstellenerkennung, Dateien und andere Inhalte sind ausschließlich für Sicherheitsexperten bestimmt, die über eine rechtliche Genehmigung verfügen, und dienen dazu, die Sicherheit von autorisierten Servern zu testen. Sicherheitsexpert...

Unomi-CVE-2020-13942

CVE-2020-13942 Script per esecuzione di codice remoto Apache Unomi Introduzione alla vulnerabilità Apache Unomi è una piattaforma dati open source in Java, un server Java progettato per gestire i dati di clienti, potenziali clienti e visitatori, e aiutare a personalizzare l'esperienza del cliente...

CVE-2020-13942

CVE-2020-13942 CVE-2020-13942 POC by Eugene Rojavski भेद्यता के बारे में मूल ब्लॉग पोस्ट: https://www.checkmarx.com/blog/apache-unomi-cve-2020-13942-rce-vulnerabilities-discovered/ दो RCE वेक्टर हैं: MVEL इंजेक्शन के माध्यम से और OGNL इंजेक्शन के माध्यम से। दोनों वेक्टर अलग-अलग कोड को लक्षित करते...

CVE-2020-14883

CVE-2020-14883 Esecuzione di codice remota RCE autenticata su Oracle WebLogic Server Vulnerabilità nel prodotto Oracle WebLogic Server di Oracle Fusion Middleware componente: Console. Le versioni supportate interessate sono 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 e 14.1.1.0.0. La...

ElasticSearch v1.1.1/1.2 RCE

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to search. Be aware this only violates the vendor's intended security policy if the user does not run...

apche_unomi_rce

CVE-2020-13942 भेद्यता के बारे में मूल ब्लॉग पोस्ट: https://www.checkmarx.com/blog/apache-unomi-cve-2020-13942-rce-vulnerabilities-discovered/ यहाँ दो RCE वेक्टर हैं: MVEL इंजेक्शन के माध्यम से और OGNL इंजेक्शन के माध्यम से। दोनों वेक्टर अलग-अलग कोड को लक्षित करते हैं, हालाँकि पेलोड अपेक्षाकृत सम...

CVE-2021-2302

CVE-2021-2302 Autor: quynhle Cadeia de gadgets root@kitploit: javax.management.BadAttributeValueExpException.readObject oracle.security.jps.az.internal.common.principals.toString oracle.security.jps.az.internal.common.principals.getResolvedPrincipal . . . con.newInstance...

EUVD-2013-6273

Malware in sbrugna...

Important: Red Hat Security Advisory: Red Hat Build of Apache Camel 4.4.1 for Spring Boot security update.

Red Hat build of Apache Camel 4.4.1 for Spring Boot release and security update is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

mvel: TimeOut error when calling ParseTools.subCompileExpression() function

DISPUTED A vulnerability was found in the ParseTools.subCompileExpression method in the Mvel package. This vulnerability manifests as a TimeOut error, and may allow an attacker to leverage the TimeOut error to disrupt the normal functioning of the system or application, potentially leading to...

Remote Code Execution

org.jeasy, easy-rules-mvel is vulnerable to Remote Code Execution RCE. The vulnerability is due to the execution of class files with the same name as the Zer file from methods then and when while loading Zer files into an application. An attacker can write a class file with same name as a Zer fil...

GHSA-FGWC-3J6W-CH22 easy-rules-mvel vulnerable to remote code execution

easy-rules-mvel v4.1.0 was discovered to contain a remote code execution RCE vulnerability via the component mVELRule...

easy-rules-mvel vulnerable to remote code execution

easy-rules-mvel v4.1.0 was discovered to contain a remote code execution RCE vulnerability via the component mVELRule...

CVE-2023-50571

easy-rules-mvel v4.1.0 was discovered to contain a remote code execution RCE vulnerability via the component MVELRule...

CVE-2023-50571

easy-rules-mvel v4.1.0 was discovered to contain a remote code execution RCE vulnerability via the component MVELRule...

Remote code execution

easy-rules-mvel v4.1.0 was discovered to contain a remote code execution RCE vulnerability via the component MVELRule...

SUSE CVE-2023-51079

A long execution time can occur in the ParseTools.subCompileExpression method in MVEL 2.5.0.Final because of many Java class lookups. NOTE: the vendor disputes this because "the only thing that you could expect is that the parser will take a crazy amount of time to complete its task."...

PT-2023-31594 · Unknown · Easy-Rules-Mvel

Name of the Vulnerable Software and Affected Versions: easy-rules-mvel version 4.1.0 Description: The issue is related to a remote code execution RCE vulnerability via the component MVELRule. This allows for potential exploitation, but specific details about the estimated number of affected devic...

Easy Rules Security Vulnerability

Easy Rules is a Java rules engine from Jeasy open source. A security vulnerability exists in Easy Rules version v4.1.0, which originates from the ability to execute remote code via the component MVELRule...