CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2015-8965
https://notcve.org/view.php?id=CVE-2015-8965
Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that exists in the classpath, such as test code or administration code. The issue exists because the ilog.views.faces.IlvFacesController servlet in jviews-framework-all.jar does not require explicit configuration of servlets that can be called. Rogue Wave JViews en versiones anteriores 8.8 parche 21 y 8.9 en versiones anteriores parche 1 permite a atacantes remotos ejecutar código Java arbitrario que existe en el classpath, como código de prueba o código de administración. El problema existe porque el servlet ilog.views.faces.IlvFacesController en jviews-framework-all.jar no requiere la configuración explícita de los servlets que se pueden llamar. • https://rwkbp.makekb.com/?View=entry&EntryID=2521 https://www.oracle.com/security-alerts/cpujan2021.html https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2017-5611 – WordPress Core < 4.7.2 - Authenticated SQL Injection
https://notcve.org/view.php?id=CVE-2017-5611
SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attackers to execute arbitrary SQL commands by leveraging the presence of an affected plugin or theme that mishandles a crafted post type name. Vulnerabilidad de inyección SQL en wp-includes/class-wp-query.php en WP_Query en WordPress en versiones anteriores a 4.7.2 permite a atacantes remotos ejecutar comandos SQL arbitrarios aprovechando la presencia de un plugin o tema afectado que no maneja correctamente un nombre de tipo de publicación manipulado. • http://www.debian.org/security/2017/dsa-3779 http://www.openwall.com/lists/oss-security/2017/01/28/5 http://www.securityfocus.com/bid/95816 http://www.securitytracker.com/id/1037731 https://codex.wordpress.org/Version_4.7.2 https://github.com/WordPress/WordPress/commit/85384297a60900004e27e417eac56d24267054cb https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release https://wpvulndb.com/vulnerabilities/8730 https://www.oracle.com/security-alerts/cpujan2021.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •