Arbitrary Code Execution

dozer is vulnerable to arbitrary code execution attacks. It incorrectly uses a reflection-based approach to type conversion which allows attackers to execute code through serialized objects...

Type confusion

Dozer improperly uses a reflection-based approach to type conversion, which might allow remote attackers to execute arbitrary code via a crafted serialized object...

CVE-2014-9515

Dozer improperly uses a reflection-based approach to type conversion, which might allow remote attackers to execute arbitrary code via a crafted serialized object...

CVE-2014-9515

Dozer improperly uses a reflection-based approach to type conversion, which might allow remote attackers to execute arbitrary code via a crafted serialized object...

CVE-2014-9515

Dozer improperly uses a reflection-based approach to type conversion, which might allow remote attackers to execute arbitrary code via a crafted serialized object...

CVE-2014-9515

Dozer improperly uses a reflection-based approach to type conversion, which might allow remote attackers to execute arbitrary code via a crafted serialized object...

PT-2017-6361 · Apache · Dozer

Name of the Vulnerable Software and Affected Versions: Dozer affected versions not specified Description: The issue is related to Dozer's improper use of a reflection-based approach to type conversion. This might allow remote attackers to execute arbitrary code via a crafted serialized object...

Apache Groovy MethodClosure Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apache Groovy. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on implementation. The specific flaw exists within the handling of...

The vulnerability of the Apache Commons Collections library, related to the restoration of unreliable data in memory, allows attackers to execute arbitrary commands.

The vulnerability of the Apache Commons Collections library is related to the rehydration of unreliable data in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands using a specially crafted serialized Java object...

CVE-2017-15708

In Apache Synapse, by default no authentication is required for Java Remote Method Invocation RMI. So Apache Synapse 3.0.1 or all previous releases 3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1 allows remote code execution attacks that can be performed by injecting specially crafted serialized objects...

CVE-2017-15708

In Apache Synapse, by default no authentication is required for Java Remote Method Invocation RMI. So Apache Synapse 3.0.1 or all previous releases 3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1 allows remote code execution attacks that can be performed by injecting specially crafted serialized objects...

PT-2017-14153

Name of the Vulnerable Software and Affected Versions Apache Synapse versions 1.1.1 through 3.0.1 Description The issue allows remote code execution attacks by injecting specially crafted serialized objects due to the lack of authentication for Java Remote Method Invocation RMI in Apache Synapse...

Apache Synapse Remote Code Execution Vulnerability

Apache Synapse is a simple, high-quality open source alternative that provides a way to implement SOA by exposing existing applications without having to rewrite any code. A remote code execution vulnerability exists in Apache Synapse, which is caused by the serializability of classes in the Apac...

CVE-2017-15708: Improper Neutralization of Special Elements in Output Used by a Downstream Component

In Apache Synapse, by default no authentication is required for Java Remote Method Invocation RMI. So Apache Synapse 3.0.1 or all previous releases 3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1 allows remote code execution attacks that can be performed by injecting specially crafted serialized objects...

VulnCheck KEV: CVE-2017-12149

The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data...

The vulnerability in the PHPMemcachedAdmin web interface exists due to errors in the mechanism for recovering serialized data. This allows attackers to escalate their privileges and execute arbitrary PHP code.

The vulnerability of the PHPMemcachedAdmin web interface exists due to errors in the mechanism for restoring serialized data. Exploiting this vulnerability allows a malicious actor to elevate their privileges to the level of an administrator and execute arbitrary PHP code...

Cacti PHP Object Injection Vulnerability

Cacti is a set of open source network traffic monitoring and analysis tools from the Cacti team. The tool through snmpget to get the data , using RRDtool drawing graphs to analyze , and provide data and user management features . A security vulnerability exists in versions of Cacti prior to 1.0.0...

client: unchecked deserialization in marshaller util

The hotrod java client in infinispan automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks...

UBUNTU-CVE-2014-4000

Cacti before 1.0.0 allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object, related to calling unserializestripslashes...

CVE-2014-4000

Cacti before 1.0.0 allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object, related to calling unserializestripslashes...