CVE Intelligence
Home / CVEs

CVE Database

Published vulnerabilities with severity, known exploitation and official sources.

Severity
Clear

1.506 result(s)

Export this search: RSS · CSV · STIX
CVE-2017-9805 High · 8.1 KEV Urgent · 76 Public exploit CWE-502 Sep 15, 2017
Apache Struts Deserialization of Untrusted Data Vulnerability
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
CVE-2017-3066 Critical · 9.8 KEV Urgent · 87 Public exploit CWE-502 Apr 27, 2017
Adobe ColdFusion Deserialization Vulnerability
Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.
CVE-2017-5645 Critical · 9.8 Public exploit CWE-502 Apr 17, 2017
Deserialization of Untrusted Data in Apache Software Foundation Log4j
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
CVE-2015-7450 Critical · 9.8 KEV Urgent · 93 Public exploit CWE-502 Jan 2, 2016
IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.
Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.
CVE-2015-6420 Critical · 9.8 CWE-502 Dec 15, 2015
Deserialization of Untrusted Data in Apache Software Foundation Commons Collections
Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
CVE-2015-4852 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-502 Nov 18, 2015
Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.