CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
IBM Products Apache Commons Collections Deserialization Remote Code Execution (RCE) (CVE-2015-7450)
[Affected Scope] IBM WebSphere Application Server and associated business, analytics, and mobile solutions utilizing vulnerable Apache Commons Collections library versions
[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with system privileges by sending crafted serialized Java objects to exposed interfaces
[Mitigation] Apply official IBM security patches (Interim Fixes) immediately, or implement JVM-level deserialization filters to block the InvokerTransformer class
Oracle WebLogic Server T3 Protocol Deserialization Remote Code Execution (RCE) Vulnerability (CVE-2015-4852) Analysis and Mitigation Guide
[Affected Scope] Oracle WebLogic Server versions 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0
[Impact] Unauthenticated remote attackers can execute arbitrary system commands via a crafted serialized Java object sent over the T3 protocol to TCP port 7001
[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict external access to the T3 protocol using WebLogic Connection Filters