Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: Pippo Clear all filters
TI-2018-13168 CVE-2018-18628 · GHSA-7fm6-2qw4-g3x3

An issue was discovered in Pippo 1.11.0.

Priority MEDIUM 50

An issue was discovered in Pippo 1.11.0.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.05482 Published 2018-10-23 Fixed in 1.12.0 CWE-502
TI-2017-13524 CVE-2017-18349 · GHSA-xjrr-xv9m-4pw5

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and…

Priority HIGH 69

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI i…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.38843 Published 2018-10-23 Fixed in 1.2.31, 1.12.0 CWE-20
TI-2018-12890 CVE-2018-18240 · GHSA-h892-x453-86wc

Pippo through 1.11.0 allows remote code execution via a command to…

Priority MEDIUM 48

Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not use XStream's available protection mechanisms to restrict unmarshalling.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03653 Published 2018-10-11 Fixed in 1.12.0 CWE-502