Design/Logic Flaw

The Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex derive class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may b...

Design/Logic Flaw

The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0 derives class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an...

PT-2018-7252

Name of the Vulnerable Software and Affected Versions: Pivotal/Spring Spring-flex affected versions not specified Description: The issue concerns the Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex, which derive class instances from java.io.Externalizable instead of...

PT-2018-7254

Name of the Vulnerable Software and Affected Versions: WebORB for Java version 5.1.1.0 Description: The issue concerns the Java implementations of AMF3 deserializers in WebORB for Java, which derive class instances from java.io.Externalizable instead of following the AMF3 specification's...