2 results (0.001 seconds)

CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2017-12628

https://notcve.org/view.php?id=CVE-2017-12628

The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be used to execute arbitrary commands. As James exposes JMX socket by default only on local-host, this vulnerability can only be used for privilege escalation. Release 3.0.1 upgrades the incriminated library. El servidor JMX embebido en Apache James, también empleado por el cliente de línea de comandos, está expuesto a un problema de deserialización de Java, por lo que puede emplearse para ejecutar comandos arbitrarios. Debido a que James expone el socket JMP por defecto sólo en local-host, esta vulnerabilidad solo puede emplearse para escalar privilegios. • http://www.securityfocus.com/bid/101532 https://www.mail-archive.com/server-user%40james.apache.org/msg15633.html • CWE-502: Deserialization of Untrusted Data •

CVSS: 9.3EPSS: 72%CPEs: 1EXPL: 1

CVE-2015-7611 – Apache James Server 2.3.2 - Insecure User Creation Arbitrary File Write

https://notcve.org/view.php?id=CVE-2015-7611

Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors. Apache James Server 2.3.2, cuando se configura con repositorios de usuario basados en archivos, permite a atacantes ejecutar comandos de sistema arbitrarios a través de vectores no especificados. • https://www.exploit-db.com/exploits/48130 http://packetstormsecurity.com/files/133798/Apache-James-Server-2.3.2-Arbitrary-Command-Execution.html http://packetstormsecurity.com/files/156463/Apache-James-Server-2.3.2-Insecure-User-Creation-Arbitrary-File-Write.html http://www.openwall.com/lists/oss-security/2015/09/30/7 http://www.openwall.com/lists/oss-security/2015/10/01/2 http://www.securityfocus.com/archive/1/536575/100/0/threaded https://blogs.apache.org/james/entry/apache_jame • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •