CVE-2026-66256

UNSUPPORTED WHEN ASSIGNED Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. As this project is retired...

EUVD-2026-57918

UNSUPPORTED WHEN ASSIGNED Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. As this project is retired...

CVE-2026-66256

A deserialization of untrusted data vulnerability exists in Apache Shindig (all versions), specifically within the OpenSocial REST API via XStream deserialization . Attackers with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server....

CVE-2026-66256 Apache Shindig Common, Apache Shindig Social-Api: Remote Code Execution via XStream deserialization (OpenSocial REST API)

UNSUPPORTED WHEN ASSIGNED Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. As this project is retired...

CVE-2026-66256 Apache Shindig Common, Apache Shindig Social-Api: Remote Code Execution via XStream deserialization (OpenSocial REST API)

UNSUPPORTED WHEN ASSIGNED Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. As this project is retired...

CVE-2026-66256

UNSUPPORTED WHEN ASSIGNED Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. As this project is retired...

PT-2026-71612

UNSUPPORTED WHEN ASSIGNED Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. As this project is retired...

CVE-2026-66256: Deserialization of Untrusted Data

UNSUPPORTED WHEN ASSIGNED Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. As this project is retired...

WSO2 <5.8.0 - Server Side Request Forgery Detection

WSO2 prior to version 5.8.0 is susceptible to a server-side request forgery vulnerability. This vulnerability can be exploited by misusing the UI gadgets loading capability of the shindig web application. An attacker can alter a specific URL in the request causing the server to initiate a GET...

CVE-2009-4514

Cross-site scripting XSS vulnerability in the OpenSocial Shindig-Integrator module 5.x and 6.x before 6.x-2.1, a module for Drupal, allows remote authenticated users, with "create application" privileges, to inject arbitrary web script or HTML via unspecified vectors...

EUVD-2008-4578

Malware in sbrugna...

EUVD-2009-4480

Malware in sbrugna...

EUVD-2008-4576

Malware in sbrugna...

CVE-2013-4295

The gadget renderer in Apache Shindig 2.5.0 for PHP allows remote attackers to obtain sensitive information via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

GHSA-6JVW-RPW4-GJ4X Apache Shindig PHP Sensitive Information Disclosure

The gadget renderer in Apache Shindig 2.5.0 for PHP allows remote attackers to obtain sensitive information via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

Apache Shindig PHP Sensitive Information Disclosure

The gadget renderer in Apache Shindig 2.5.0 for PHP allows remote attackers to obtain sensitive information via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

com.google.code.maven-play-plugin.com.sienaproject.siena:siena (1.0.0-b6-20111107), ma.glasnost.orika:orika-tests (>=1.4.0, <=1.5.2) +5 more potentially affected by CVE-2022-23221 via com.h2database:h2 (1.3.154)

com.h2database:h2 MAVEN version 1.3.154 is affected by a known vulnerability. The following packages have a transitive dependency on com.h2database:h2 and may be impacted: - com.google.code.maven-play-plugin.com.sienaproject.siena:siena 1.0.0-b6-20111107 - ma.glasnost.orika:orika-tests =1.4.0,...

Billion Laugh Attack in https://sites.google.com

tl;dr https://sites.google.com suffered from a Billion Laugh Attack vulnerability that made the containerized environment to crash with a single invocation. Introduction Few months ago I applied for a talk at a security conference titled So you wanna be a Bug Bounty Hunter but it was rejected :...

PT-2018-11405 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.4 and earlier Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability. Successful exploitation could lead to sensitive information disclosure. The SSRF vulnerability can be...

Remote DoS Exploit on Confluence

Nir Goldshlager have discovered a vulnerability on atlassian-gadgets when parsing XMLs. Basically anyone can craft a URL containing a parameter with some XML that will make the instance run out of memory when trying to parse it. Details on the attack can be found on...