Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2016-5003

xmlrpc: Deserialization of untrusted Java object through <ex:serializable> tag

The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element.

CVSS 3.0 · 9.8 Critical EPSS 14.9% KEV · Not listed
Vendors
Apache Redhat
Products
Ws-xmlrpc Enterprise Linux Jboss Fuse and 1 more
CVE-2016-5004

xmlrpc: DoS through decompression-bomb attack when Content-Encoding=gzip

The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service (resource consumption) by decompressing a large file containing zeroes.

CVSS 3.0 · 6.5 Medium EPSS 7.7% KEV · Not listed
Vendors
Apache
Products
Ws-xmlrpc