PowerFolder Server 10.4.321 - Remote Code Execution

Mogwai Security Advisory MSA-2016-01 ---------------------------------------------------------------------- Title: PowerFolder Remote Code Execution Vulnerability Product: PowerFolder Server Affected versions: 10.4.321 Linux/Windows Other version might be also affected Impact: high Remote: yes...

HPE Release Control Apache Commons Collections Arbitrary Code Execution Vulnerability

HPE Release Control is a set of decision support solutions.Apache Commons Collections is a component in Commons Proper of the Apache Commons project that extends or adds to the Java collections framework. An unspecified security vulnerability in ACC for HPE Release Control allows remote attackers...

HPE Network Node Manager Arbitrary Command Execution Vulnerability

HP Network Node Manager i-series NNMi software delivers powerful out-of-the-box features to help your network operations team efficiently manage networks of any size. An arbitrary command execution vulnerability exists in HPE Network Node Manager i NNMi versions 9.20, 9.23, 9.24, 9.25, 10.00,...

HPE P9000 CVAE Arbitrary Command Execution Vulnerability

HP XP P9000 Command View Advanced Edition is a multifunctional device manager for HP XP P9500, XP Disk Array products. A security vulnerability exists in HPE P9000 Command View Advanced Edition Software CVAE and XP7 CVAE, which allows remote attackers to execute arbitrary commands via constructed...

Apache OFBiz Security Bypass Vulnerability

Apache OFBiz also known as Apache Open For Business Project is the United States Apache Apache Software Foundation of a set of enterprise resource planning ERP system. The system provides a set of Java-based Web application components and tools. A security bypass vulnerability exists in Apache...

Remote Code Execution in Spring AMQP

The class org.springframework.core.serializer.DefaultDeserializer does not validate the deserialized object against a whitelist. By supplying a crafted serialized object like Chris Frohoff's Commons Collection gadget, remote code execution can be achieved...

The vulnerability of the IBM Tivoli Common Reporting system, a centralized data collection and analysis tool, allows a intruder to execute arbitrary commands.

The vulnerability of the InvokerTransformer class in the Apache Commons Collections library, used for centralized data collection and analysis in the IBM Tivoli Common Reporting system, is related to improper code generation management. Exploiting this vulnerability allows a malicious actor to...

groovy: remote execution of untrusted code in class MethodClosure

A flaw was discovered in the way applications using Groovy used the standard Java serialization mechanism. A remote attacker could use a specially crafted serialized object that would execute code directly when deserialized. All applications which rely on serialization and do not isolate the code...

DLA-352-1 libcommons-collections3-java - security update

Bulletin has no description...

DEBIAN-CVE-2015-3253

The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object...

Dell NetVault Backup Heap Buffer Overflow Remote Code Execution Vulnerability

NetVault Backup is a cross-platform backup and recovery software solution that protects data and applications in physical and virtual environments. It is scalable and supports multiple server and application platforms across the enterprise. It has a single, intuitive interface that requires minim...

Laravel 'prepareForUnserialize()' function remote PHP object injection vulnerability

Laravel is a set of PHP development framework. A remote PHP object injection vulnerability exists in Laravel that allows remote attackers to submit specially crafted serialized objects, delete and read files, and execute arbitrary local script code...

PHP Core Unserialize Key Name Code Execution - Ver2 (CVE-2015-0231)

A code execution vulnerability has been reported in PHP core. The vulnerability is due to a use after free error when handling serialized objects with identical number key names within the unserialize function. An attacker could exploit this vulnerability by sending crafted serialized data to a w...

PHP Core unserialize process nested data Use After Free - Ver2 (CVE-2014-8142)

A use-after-free vulnerability has been reported in PHP core. The vulnerability is due to a use after free error when handling serialized objects with identical keys within the unserialize function. An attacker could exploit this vulnerability by sending crafted serialized data to a web applicati...

Cisco Web Security Appliance (WSA) Local Arbitrary Python Code Execution Vulnerability

The Cisco Adaptive Security Appliance is an adaptive security appliance that provides modules for security and VPN services. A security vulnerability exists in the Cisco Web Security Appliance WSA that allows a local attacker to execute arbitrary Python code via specially crafted serialized objec...

CVE-2015-0692

Cisco Web Security Appliance WSA devices with software 8.5.0-ise-147 do not properly restrict use of the pickle Python module during certain tunnel-status checks, which allows local users to execute arbitrary Python code and gain privileges via crafted serialized objects, aka Bug ID CSCut39230...

CA Spectrum Elevation of Privilege Vulnerability

CA Spectrum formerly known as CA Spectrum Infrastructure Manage is a set of converged infrastructure management software developed by CA. The software provides fault management, application performance management and failure cause analysis and other functions. A security vulnerability exists in C...

Apple iOS IOSurface Type Obfuscation Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A type confusion vulnerability exists in IOSurface when Apple iOS handles serialized objects, which allows attackers to exploit the vulnerability to execute arbitrary code with system privileges...

X2Engine < 4.2 Multiple Vulnerabilities

According to its version number, the X2Engine application installed on the remote web server is potentially affected by multiple vulnerabilities : - A PHP object injection vulnerability exists which can be used to carry out Server-Side Request Forgery SSRF attacks using specially crafted serializ...

CVE-2014-0865: Improper Input Validation

RICOS in IBM Algo Credit Limits aka ACLM 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics relies on client-side input validation, which allows remote authenticated users to bypass intended dual-control restrictions and modify data via crafted serialized objects, as demonstrated by limi...