CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Apache Tomcat JmxRemoteLifecycleListener Deserialization Remote Code Execution Vulnerability Analysis and Mitigation Guide (CVE-2016-8735)
[Affected Scope] Apache Tomcat versions before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12, when JmxRemoteLifecycleListener is enabled
[Impact] Remote attackers with network access to JMX ports can trigger untrusted deserialization without authentication, leading to arbitrary Remote Code Execution (RCE) with system privileges
[Mitigation] Upgrade Apache Tomcat to the latest secure release, or disable JmxRemoteLifecycleListener in server.xml and restrict network access to JMX ports using firewalls
Oracle Java SE and JRockit JMX Remote Code Execution (RCE) Vulnerability Advisory (CVE-2016-3427)
[Affected Scope] Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9
[Impact] Remote attackers can execute arbitrary code without authentication by sending malicious serialized objects to the JMX service port, leading to complete system compromise
[Mitigation] Apply the latest Oracle Java SE security updates, restrict external access to JMX ports, and enforce robust authentication and SSL/TLS
Oracle Java SE and OpenJDK JMX Component Sandbox Bypass Vulnerability (CVE-2013-0431)
[Affected Scope] Oracle Java SE 7 through Update 11, and OpenJDK 7.
[Impact] Remote attackers can bypass the Java security sandbox and execute arbitrary code with elevated privileges.
[Mitigation] Apply the latest Java SE/OpenJDK security updates and disable Java browser plugins immediately.