v.26.4.2314

OOB Vulnerabilities

This page lists 137 vulnerabilities in this category.

Vulnerability Name

CVE

CWE

Severity

Code Evaluation (Perl)

CWE-94

Critical

Code Evaluation (Ruby)

CWE-94

Critical

Apache Struts2 remote code execution vulnerability

CVE-2016-0785

CWE-78

Critical

Apache Struts2 Remote Command Execution (S2-053)

CVE-2017-12611

CWE-94

Critical

GhostScript RCE (Remote Code Execution)

CVE-2016-3714

CWE-78

Critical

Apache Log4j socket receiver deserialization vulnerability

CVE-2017-5645

CWE-502

Critical

Code Evaluation (Python)

CWE-95

Critical

ActiveMQ OpenWire RCE (CVE-2023-46604)

CVE-2023-46604

CWE-502

Critical

TorchServe Management API SSRF (CVE-2023-43654)

CVE-2023-43654

CWE-918

Critical

WS_FTP AHT Deserialization RCE (CVE-2023-40044)

CVE-2023-40044

CWE-502

Critical

ColdFusion WDDX Deserialization RCE (CVE-2023-29300/CVE-2023-38203/CVE-2023-38204)

CVE-2023-38204

CWE-502

Critical

Adobe Commerce/Magento "CosmicSting" XXE (CVE-2024-34102)

CVE-2024-34102

CWE-611

Critical

IBM ODM JNDI injection (CVE-2024-22319)

CVE-2024-22319

CWE-943

Critical

RCE in Ivanti Connect Secure and Policy Secure (CVE-2024-21887)

CVE-2024-21887

CWE-77

Critical

Ivanti Sentry Authentication Bypass (CVE-2023-38035)

CVE-2023-38035

CWE-863

Critical

Apache OFBiz SSRF (CVE-2024-45507)

CVE-2024-45507

CWE-918

Critical

PaloAlto Networks Expedition RCE (CVE-2024-9463)

CVE-2024-9465

CWE-918

Critical

Oracle E-Business Suite SSRF (CVE-2025-61882)

CVE-2025-61882

CWE-918

Critical

Cross-site Scripting via Remote File Inclusion

CWE-79

High

Edge Side Include injection

CWE-918

High

Email Header Injection

CWE-20

High

ImageMagick remote code execution

CVE-2016-3714

CWE-78

High

Oracle Reports rwservlet vulnerabilities

CVE-2012-3153

CWE-20

High

XSLT injection

CWE-91

High

Zend Framework local file disclosure via XXE injection

CVE-2015-5161

CWE-611

High

Ext JS arbitrary file read

CWE-22

High

XML external entity injection

CWE-611

High

XML External Entity Injection via external file

CWE-611

High

XML external entity injection via File Upload

CWE-611

High

XML external entity injection (variant)

CWE-611

High

Apache Struts2 Remote Command Execution (S2-052)

CVE-2017-9805

CWE-94

High

Apache Shiro Deserialization RCE

CVE-2016-4437

CWE-78

High

Atlassian OAuth Plugin IconUriServlet SSRF

CVE-2017-9506

CWE-918

High

Auxiliary systems SSRF

CWE-918

High

Flex BlazeDS AMF Deserialization RCE

CVE-2017-5641

CWE-502

High

ColdFusion AMF Deserialization RCE

CVE-2017-3066

CWE-502

High

ColdFusion JNDI injection RCE

CVE-2018-15957

CWE-502

High

JBoss InvokerTransformer Remote Code Execution

CVE-2015-7501

CWE-502

High

Jboss Application Server HTTPServerILServlet.java remote code execution

CVE-2017-7504

CWE-502

High

JavaMelody XML External Entity (XXE) vulnerability

CVE-2018-15531

CWE-611

High

Deserialization of Untrusted Data (Java JSON Deserialization) Fastjson

CWE-502

High

Deserialization of Untrusted Data (Java JSON Deserialization) Genson

CWE-502

High

Deserialization of Untrusted Data (Java JSON Deserialization) Jackson

CVE-2017-7525

CWE-502

High

Deserialization of Untrusted Data (Java JSON Deserialization) JsonIO

CWE-502

High

Deserialization of Untrusted Data (Java Object Deserialization)

CWE-502

High

Liferay TunnelServlet Deserialization Remote Code Execution

CWE-502

High

Paperclip gem SSRF (Server side request forgery)

CVE-2017-0889

CWE-918

High

Reverse proxy misrouting

CWE-918

High

Data Binding Expression Vulnerability in Spring Web Flow

CVE-2017-4971

CWE-78

High

IBM WebSphere RCE Java Deserialization Vulnerability

CVE-2015-7450

CWE-502

High

Oracle Weblogic WLS-WSAT Component Deserialization RCE

CVE-2017-10271

CWE-94

High

Adobe Experience Manager Misconfiguration

CVE-2016-0957

CWE-1188

High

Xdebug remote code execution via xdebug.remote_connect_back

CWE-200

High

RCE with Spring Data Commons

CVE-2018-1273

CWE-94

High

Oracle WebLogic Remote Code Execution via T3

CVE-2018-3245

CWE-502

High

Argument Injection

CWE-88

High

Jira Unauthorized SSRF via REST API

CVE-2019-8451

CWE-918

High

ColdFusion FlashGateway Deserialization RCE CVE-2019-7091

CVE-2019-7091

CWE-502

High

Oracle Business Intelligence Convert XXE CVE-2019-2767

CVE-2019-2767

CWE-611

High

Oracle Business Intelligence ReportTemplateService XXE CVE-2019-2616

CVE-2019-2616

CWE-611

High

Oracle Business Intelligence ReportTemplateService XXE (CVE-2021-2400)

CVE-2021-2400

CWE-611

High

OpenCms Solr XML External Entity (XXE) vulnerability

CWE-611

High

SAP Hybris Deserialization RCE

CVE-2019-0344

CWE-502

High

Apache REST RCE CVE-2018-11770

CVE-2018-11770

CWE-94

High

Oracle Weblogic T3 XXE (CVE-2019-2647)

CVE-2019-2647

CWE-611

High

Oracle Weblogic T3 XXE (CVE-2019-2888)

CVE-2019-2888

CWE-611

High

Oracle Weblogic Async Component Deserialization RCE CVE-2019-2725

CVE-2019-2725

CWE-94

High

Apache Solr Deserialization of untrusted data via jmx.serviceUrl

CVE-2019-0192

CWE-502

High

Remote code execution in bootstrap-sass 3.2.0.3

CVE-2019-10842

CWE-95

High

uWSGI Unauthorized Access Vulnerability

CWE-78

High

DNN (DotNetNuke) CMS Cookie Deserialization RCE CVE-2017-9822

CVE-2017-9822

CWE-502

High

Deserialization of Untrusted Data (.NET BinaryFormatter Object Deserialization)

CWE-502

High

Kentico CMS Deserialization RCE

CVE-2019-10068

CWE-502

High

Oracle Business Intelligence AMF Deserialization RCE CVE-2020-2950

CVE-2020-2950

CWE-502

High

Oracle E-Business Suite Deserialization RCE

CWE-502

High