CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Apache Shiro RememberMe Default Cipher Key Remote Code Execution Vulnerability (CVE-2016-4437)
[Affected Scope] All Java applications utilizing Apache Shiro versions prior to 1.2.5
[Impact] Remote attackers can leverage the hardcoded default AES encryption key to send malicious serialized objects, leading to arbitrary code execution (RCE) or access control bypass
[Mitigation] Immediately upgrade Apache Shiro to version 1.2.5 or higher, and explicitly configure a unique, secure random cipher key for the RememberMe service
Oracle Java SE and JRockit JMX Remote Code Execution (RCE) Vulnerability Advisory (CVE-2016-3427)
[Affected Scope] Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9
[Impact] Remote attackers can execute arbitrary code without authentication by sending malicious serialized objects to the JMX service port, leading to complete system compromise
[Mitigation] Apply the latest Oracle Java SE security updates, restrict external access to JMX ports, and enforce robust authentication and SSL/TLS
IBM Products Apache Commons Collections Deserialization Remote Code Execution (RCE) (CVE-2015-7450)
[Affected Scope] IBM WebSphere Application Server and associated business, analytics, and mobile solutions utilizing vulnerable Apache Commons Collections library versions
[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with system privileges by sending crafted serialized Java objects to exposed interfaces
[Mitigation] Apply official IBM security patches (Interim Fixes) immediately, or implement JVM-level deserialization filters to block the InvokerTransformer class
Oracle WebLogic Server T3 Protocol Deserialization Remote Code Execution (RCE) Vulnerability (CVE-2015-4852) Analysis and Mitigation Guide
[Affected Scope] Oracle WebLogic Server versions 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0
[Impact] Unauthenticated remote attackers can execute arbitrary system commands via a crafted serialized Java object sent over the T3 protocol to TCP port 7001
[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict external access to the T3 protocol using WebLogic Connection Filters
HP ProCurve Manager and IDM Remote Code Execution Vulnerability (CVE-2013-4810)
[Affected Scope] HP ProCurve Manager (PCM) 3.20/4.0, PCM+ 3.20/4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management.
[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending a specially crafted marshalled object.
[Mitigation] Restrict external access to the vulnerable EJBInvokerServlet and JMXInvokerServlet endpoints and apply official security patches.