Vulnerabilidades do Netapp Oncommand Balance

CVE-2017-7525 Crítica · 9.8 CWE-184 06/02/2018

jackson-databind is vulnerable to a deserialization flaw

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

CVE-2017-15095 Crítica · 9.8 CWE-502 06/02/2018

Deserialization of Untrusted Data em Fasterxml Jackson-databind

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

CVE-2017-12617 Alta · 8.1 KEV Urgente · 76 Exploit público CWE-434 03/10/2017

Apache Tomcat Remote Code Execution Vulnerability

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

CVE-2017-12615 Alta · 8.1 KEV Urgente · 78 Exploit público Ransomware CWE-434 19/09/2017

Apache Tomcat on Windows Remote Code Execution Vulnerability

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

CVE-2017-9805 Alta · 8.1 KEV Urgente · 76 Exploit público CWE-502 15/09/2017

Apache Struts Deserialization of Untrusted Data Vulnerability

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

CVE-2016-9841 Crítica · 9.8 23/05/2017

inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified…

inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

CVE-2017-5638 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-755 10/03/2017

Apache Struts Remote Code Execution Vulnerability

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

CVE-2016-10165 Alta · 7.1 CWE-125 03/02/2017

The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to...

The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.

CVE-2016-5195 Alta · 7.0 KEV Alta · 64 Exploit público CWE-362 10/11/2016

Linux Kernel Race Condition Vulnerability

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."

CVE-2016-3427 Crítica · 9.8 KEV Alta · 63 CWE-284 21/04/2016

Oracle Java SE and JRockit Unspecified Vulnerability

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

CVE-2010-1871 Alta · 8.8 KEV Urgente · 76 Exploit público CWE-917 05/08/2010

Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability

JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.