192 matches found
orb
Orb — Strumento di Tunneling di Cartelle Zero-Trust Orb è un'utilità sicura, incentrata sul terminale, che ti permette di condividere una cartella locale su Internet utilizzando la crittografia end-to-end. Nessun account, nessun cloud storage, nessun port forwarding richiesto. Dimostrazione...
openjdk-orb: unauthed class loading via IIOP in EAP
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...
openjdk-orb: unauthed class loading via IIOP in EAP
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...
CVE-2026-15560
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...
EUVD-2026-55984
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...
CVE-2026-15560 Openjdk-orb: unauthed class loading via iiop in eap
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...
CVE-2026-15560
The CVE-2026-15560 tracks a vulnerability in the openjdk-orb JDKBridge when EAP runs with -secmgr. The issue arises during object unmarshalling where attacker-supplied CDR codebase URLs are honoured, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL ...
CVE-2026-15560 Openjdk-orb: unauthed class loading via iiop in eap
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...
CVE-2026-15560
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...
CVE-2026-15560
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...
PT-2026-70091
Name of the Vulnerable Software and Affected Versions JBoss Enterprise Application Platform affected versions not specified Description When the software runs with the -secmgr flag, the JDKBridge component of openjdk-orb processes attacker-supplied CDR Common Data Representation codebase URLs...
java-1.8.0-ibm: Arbitrary class loading and instantiation via malicious IIOP server
A flaw was found in the ORB Object Request Broker component of IBM SDK, Java Technology Edition. A malicious IIOP Internet Inter-ORB Protocol server could exploit this vulnerability to force the loading and creation of unauthorized software components. This could lead to the execution of arbitrar...
CVE-2026-8400
A flaw was found in the ORB Object Request Broker component of IBM SDK, Java Technology Edition. A malicious IIOP Internet Inter-ORB Protocol server could exploit this vulnerability to force the loading and creation of unauthorized software components. This could lead to the execution of arbitrar...
Linux Distros Unpatched Vulnerability : CVE-2026-8400
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Jav...
CVE-2026-8400
CVE-2026-8400 affects IBM WebSphere Application Server 8.5, 9.0, and WebSphere Application Server Liberty Continuous Delivery. The issue is in the ORB component of IBM SDK, Java Technology Edition, where a malicious IIOP server could cause loading and instantiation of arbitrary classes, enabling ...
CVE-2026-8400
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes...
CVE-2026-8400 Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the July 2026 CPU
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes...
MAL-2026-11976 Malicious code in native-frontend-orb (npm)
npm/native-frontend-orb is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished...
Malicious code in frontend-orb (npm)
npm/frontend-orb is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by the...