17041 matches found
(Pwn2Own) Kepware KEPServerEX Stack-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of text encoding conversions. The issue results from the lack of proper...
(Pwn2Own) Kepware KEPServerEX Heap-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of text encoding conversions. The issue results from the lack of proper...
GHSA-3R7J-8MQH-6QHX Jadx-gui vulnerable to swing HTML Denial of Service (DoS) attack
Impact Using jadx-gui to open a special zip file with entry containing HTML sequence like will cause interface to get stuck and throw exceptions like: java.lang.RuntimeException: Can't build aframeset, BranchElementframeset 1,3 :no ROWS or COLS defined. at...
Exploit for Code Injection in Apache Commons_Text
CVE-2022-42889 PoC Test Application This is a vulnerable appli...
Exploit for Code Injection in Apache Commons_Text
cve-2022-42889-intercept It should be noted that versions...
Text2Shell: Vulnerability like Log4Shell in Apache Common Texts
Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary A new vulnerability in Apache Commons Text has been named text2shell. The vulnerability allows unauthenticated attackers to remotely execute code on servers running affected applications. Due to t...
CVE-2022-42889. Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults.
Security Advisory ID : BSA-2022-2096 Component : Apache Commons Text Revision : 1.1 Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "$prefix:name", where "prefix" is used to locate an...
The vulnerability of the “Text Editor” module of the Beaver Builder plugin in the WordPress content management system allows attackers to perform cross-site scripting attacks.
The vulnerability of the “Text Editor” module of the Beaver Builder plugin for WordPress content management systems exists due to the lack of protective measures for website page structures. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...
Exploit for Code Injection in Apache Commons_Text
CVE-2022-42889 Test application This repository contains a si...
GHSA-35RX-7PC8-6963 API keys stored in plain text by Jenkins Katalon Plugin
Jenkins Katalon Plugin 1.0.32 and earlier stores API keys unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These API keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Katalon Plugin 1.0.33 no...
API keys stored in plain text by Jenkins Katalon Plugin
Jenkins Katalon Plugin 1.0.32 and earlier stores API keys unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These API keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Katalon Plugin 1.0.33 no...
Why Log4Text is not another Log4Shell
The Apache Software Foundation has acknowledged a vulnerability in Apache Commons Text, a library focused on algorithms for string manipulation. The vulnerability has been assigned CVE-2022- 42889, but security researchers have dubbed it Log4Text. The name provides an immediate association with...
Exploit for Code Injection in Apache Commons_Text
CVE-2022-42889-text4shell 🔥🔥🔥 Apache commons text - CVE-2022-...
Denial of Service (DoS)
Overview Affected versions of this package are vulnerable to Denial of Service DoS via the FTS3 extension, due to 32-bit signed integer overflow. In order to exploit this vulnerability, the attacker must have full SQL access and must be able to construct a corrupt database with over 2GB of FTS3...
Exploit for Out-of-bounds Read in Bentley Microstation
CVE-2022-42899 Apache Common Text starting from version 1.5 to...
API keys stored in plain text by Katalon
Katalon 1.0.32 and earlier stores API keys unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These API keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Katalon 1.0.33 no longer stores the API...
Apache Commons Text 1.5.x < 1.10.0 Remote Code Execution (CVE-2022-42889)
The version of Apache Commons Text on the remote host is 1.5.x 1.10.0. It is, therefore, affected by a remote code execution vulnerability due to unsafe script evaluation in the StringSubstitutor default interpolator. Note that Nessus has not tested for these issues but has instead relied only on...
Exploit for Code Injection in Apache Commons_Text
CVE-2022-42889-POC A simple demo application that shows how to...
Apache Commons Text vulnerability CVE-2022-42889
Updated Oct. 19, 2022 CVE-2022-42889 was recently added to the NVD catalog, with a critical score of 9.8. This vulnerability allows remote code execution RCE in Apache Commons Text. It affects version numbers 1.5-1.9, and an upgrade to Apache Commons Text 1.10.0 disables the problem by default...