Nomisec Exploits

21,202 exploits tracked across all sources.

Sort: Activity Stars
CVE-2018-1114 NOMISEC MEDIUM
Undertow - File Handler Leak
It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust. This leads to a file handler leak.
by dawetmaster
CVSS 6.5
CVE-2018-1114 NOMISEC MEDIUM
Undertow - File Handler Leak
It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust. This leads to a file handler leak.
by andikahilmy
CVSS 6.5
CVE-2020-14195 NOMISEC HIGH
Fasterxml Jackson-databind < 2.9.10.5 - Insecure Deserialization
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).
by dawetmaster
CVSS 8.1
CVE-2020-14195 NOMISEC HIGH
Fasterxml Jackson-databind < 2.9.10.5 - Insecure Deserialization
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).
by andikahilmy
CVSS 8.1
CVE-2019-14893 NOMISEC CRITICAL
Fasterxml Jackson-databind < 2.8.11.5 - Information Disclosure
A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.
by dawetmaster
CVSS 9.8
CVE-2019-14893 NOMISEC CRITICAL
Fasterxml Jackson-databind < 2.8.11.5 - Information Disclosure
A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.
by andikahilmy
CVSS 9.8
CVE-2018-14719 NOMISEC CRITICAL
FasterXML Jackson <2.9.7 - RCE
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
by dawetmaster
CVSS 9.8
CVE-2018-14719 NOMISEC CRITICAL
FasterXML Jackson <2.9.7 - RCE
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
by andikahilmy
CVSS 9.8
CVE-2020-7692 NOMISEC HIGH
Google Oauth Client Library For Java - Incorrect Authorization
PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.
by dawetmaster
CVSS 7.4
CVE-2020-7692 NOMISEC HIGH
Google Oauth Client Library For Java - Incorrect Authorization
PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.
by andikahilmy
CVSS 7.4
CVE-2020-26217 NOMISEC HIGH
Xstream < 1.4.14 - OS Command Injection
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
by dawetmaster
CVSS 8.0
CVE-2020-26217 NOMISEC HIGH
Xstream < 1.4.14 - OS Command Injection
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
by andikahilmy
CVSS 8.0
CVE-2020-36186 NOMISEC HIGH
Fasterxml Jackson-databind < 2.6.7.5 - Insecure Deserialization
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.
by dawetmaster
CVSS 8.1
CVE-2020-36186 NOMISEC HIGH
Fasterxml Jackson-databind < 2.6.7.5 - Insecure Deserialization
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.
by andikahilmy
CVSS 8.1
CVE-2020-35490 NOMISEC HIGH
Fasterxml Jackson-databind < 2.9.10.8 - Insecure Deserialization
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.
by dawetmaster
CVSS 8.1
CVE-2020-35490 NOMISEC HIGH
Fasterxml Jackson-databind < 2.9.10.8 - Insecure Deserialization
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.
by andikahilmy
CVSS 8.1
CVE-2020-1695 NOMISEC HIGH
Redhat Resteasy < 3.12.0 - Improper Input Validation
A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed.
by dawetmaster
CVSS 7.5
CVE-2020-1695 NOMISEC HIGH
Redhat Resteasy < 3.12.0 - Improper Input Validation
A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed.
by andikahilmy
CVSS 7.5
CVE-2017-7957 NOMISEC HIGH
Redhat Fuse < 1.4.9 - Improper Input Validation
XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/>") call.
by dawetmaster
CVSS 7.5
CVE-2017-7957 NOMISEC HIGH
Redhat Fuse < 1.4.9 - Improper Input Validation
XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/>") call.
by andikahilmy
CVSS 7.5
CVE-2017-2649 NOMISEC HIGH
Jenkins Active Directory < 2.2 - Improper Certificate Validation
It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active Directory server, thereby enabling Man-in-the-Middle attacks.
by dawetmaster
CVSS 8.1
CVE-2017-2649 NOMISEC HIGH
Jenkins Active Directory < 2.2 - Improper Certificate Validation
It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active Directory server, thereby enabling Man-in-the-Middle attacks.
by andikahilmy
CVSS 8.1
CVE-2018-12023 NOMISEC HIGH
FasterXML jackson-databind <2.7.9.4-2.8.11.2-2.9.6 - Code Injection
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
by dawetmaster
CVSS 7.5
CVE-2018-12023 NOMISEC HIGH
FasterXML jackson-databind <2.7.9.4-2.8.11.2-2.9.6 - Code Injection
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
by andikahilmy
CVSS 7.5
CVE-2018-1000125 NOMISEC CRITICAL
inversoft prime-jwt <1.3.0 - Info Disclosure
inversoft prime-jwt version prior to version 1.3.0 or prior to commit 0d94dcef0133d699f21d217e922564adbb83a227 contains an input validation vulnerability in JWTDecoder.decode that can result in a JWT that is decoded and thus implicitly validated even if it lacks a valid signature. This attack appear to be exploitable via an attacker crafting a token with a valid header and body and then requests it to be validated. This vulnerability appears to have been fixed in 1.3.0 and later or after commit 0d94dcef0133d699f21d217e922564adbb83a227.
by dawetmaster
CVSS 9.8