CVE Vulnerability Advisory Database

Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.

Showing 1–2 of 2 advisories (Page 1/1)

CVE-2018-183257.5/HIGHEPSS 74.1%CISA KEV

2019-07-03

DotNetNuke (DNN) Remote Code Execution (RCE) Vulnerability via Weak Encryption Algorithm (CVE-2018-18325)

[Affected Scope] DotNetNuke (DNN) Platform versions 9.2 through 9.2.2.

[Impact] Attackers can bypass security controls due to weak encryption of input parameters, leading to .NET deserialization and Remote Code Execution (RCE) via malicious cookies.

[Mitigation] Immediately upgrade the DNN Platform to version 9.3.0 or higher, and ensure secure machineKey configurations are applied.

dotnetnuke weak-encryption deserialization rce CWE-326

Full Advisory & Mitigation

CVE-2017-10004869.8/CRITICALEPSS 94.1%CISA KEV

2018-01-03

Primetek PrimeFaces 5.x Remote Code Execution (RCE) via Weak Encryption Flaw (CVE-2017-1000486)

[Affected Scope] Java web applications utilizing Primetek PrimeFaces framework version 5.x and below

[Impact] Unauthenticated remote attackers can exploit weak encryption keys to inject arbitrary serialized objects, leading to Remote Code Execution (RCE) on the target server

[Mitigation] Upgrade PrimeFaces to a secure version (6.0 or higher) and configure a strong, unique custom secret key in web.xml

primefaces rce weak-encryption cwe-326 des java-deserialization

Full Advisory & Mitigation