Filtered by vendor Pippo
Subscribe
Search
Total
4 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-18240 | 1 Pippo | 1 Pippo | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not use XStream's available protection mechanisms to restrict unmarshalling. | |||||
| CVE-2018-18628 | 1 Pippo | 1 Pippo | 2019-01-28 | 10.0 HIGH | 9.8 CRITICAL |
| An issue was discovered in Pippo 1.11.0. The function SerializationSessionDataTranscoder.decode() calls ObjectInputStream.readObject() to deserialize a SessionData object without checking the object types. An attacker can create a malicious object, base64 encode it, and place it in the PIPPO_SESSION field of a cookie. Sending this cookie may lead to remote code execution. | |||||
| CVE-2017-18349 | 2 Alibaba, Pippo | 2 Fastjson, Pippo | 2019-01-28 | 10.0 HIGH | 9.8 CRITICAL |
| parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java. | |||||
| CVE-2018-20059 | 1 Pippo | 1 Pippo | 2019-01-03 | 7.5 HIGH | 9.8 CRITICAL |
| jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE. | |||||