CVE Vulnerability Advisory Database

Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.

Showing 1–2 of 2 advisories (Page 1/1)

CVE-2017-10004869.8/CRITICALEPSS 94.1%CISA KEV

2018-01-03

Primetek PrimeFaces 5.x Remote Code Execution (RCE) via Weak Encryption Flaw (CVE-2017-1000486)

[Affected Scope] Java web applications utilizing Primetek PrimeFaces framework version 5.x and below

[Impact] Unauthenticated remote attackers can exploit weak encryption keys to inject arbitrary serialized objects, leading to Remote Code Execution (RCE) on the target server

[Mitigation] Upgrade PrimeFaces to a secure version (6.0 or higher) and configure a strong, unique custom secret key in web.xml

primefaces rce weak-encryption cwe-326 des java-deserialization

Full Advisory & Mitigation

CVE-2017-113179.8/CRITICALEPSS 84.2%CISA KEV

2017-08-23

Telerik UI for ASP.NET AJAX RadAsyncUpload Weak Encryption Remote Code Execution (RCE) - CVE-2017-11317

[Affected Scope] Progress Telerik UI for ASP.NET AJAX versions before R1 2017 and R2 before R2 2017 SP2

[Impact] Remote attackers can exploit weak encryption to perform unrestricted file uploads or execute arbitrary code on the target server

[Mitigation] Upgrade to the latest patched version of Telerik UI, or configure strong custom encryption keys in web.config

CWE-326 unrestricted-file-upload rce deserialization

Full Advisory & Mitigation