Archive
27 February 2019
Vulnerabilities first published on this day (UTC), newest first.
1 result · Clear filters · Feed
-
Critical 9.8
Incomplete List of Disallowed Inputs in SOFA-Hessian
SOFA-Hessian through 4.0.2 allows remote attackers to execute arbitrary commands via a crafted serialized Hessian object because blacklisting of com.caucho.naming.QName and com.sun.org.apache.xpath.internal.objects.XString is mishandled, related to Resin Gadg…