CVE-2018-1335

Related Files

Red Hat Security Advisory 2019-3140-01

Posted Oct 17, 2019

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2019-3140-01 - Red Hat JBoss Data Virtualization is a lean data integration solution that provides easy, real-time, and unified data access across disparate sources to multiple applications and users. JBoss Data Virtualization makes data spread across physically distinct systems - such as multiple databases, XML files, and even Hadoop systems - appear as a set of tables in a local database. This release of Red Hat JBoss Data Virtualization 6.4.8 serves as a replacement for Red Hat JBoss Data Virtualization 6.4.7, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include code execution, deserialization, information leakage, and path sanitization vulnerabilities.

tags | advisory, local, vulnerability, code execution

systems | linux, redhat

advisories | CVE-2016-5397, CVE-2018-11307, CVE-2018-11798, CVE-2018-12022, CVE-2018-12023, CVE-2018-1335, CVE-2018-14718, CVE-2018-14719, CVE-2018-19360, CVE-2018-19361, CVE-2018-19362, CVE-2018-8088, CVE-2019-0201

SHA-256 | cb03b8a3107017eb58904d224acf26d8a49abf7981da23786dece9f70750672b

Download | Favorite | View

Apache Tika 1.17 Header Command Injection

Posted Aug 2, 2019

Authored by h00die, David Yesland, Tim Allison | Site metasploit.com

This Metasploit module exploits a command injection vulnerability in Apache Tika versions 1.15 through 1.17 on Windows. A file with the image/jp2 content-type is used to bypass magic byte checking. When OCR is specified in the request, parameters can be passed to change the parameters passed at command line to allow for arbitrary JScript to execute. A JScript stub is passed to execute arbitrary code. This module was verified against version 1.15 through 1.17 on Windows 2012. While the CVE and finding show more versions vulnerable, during testing it was determined only versions greater than 1.14 were exploitable due to jp2 support being added.

tags | exploit, arbitrary

systems | windows

advisories | CVE-2018-1335

SHA-256 | 1d10dcd077954ec22984a947fb2e56ca4e13c135682dadd44362021acac47063

Download | Favorite | View

Apache Tika Server Command Injection

Posted Mar 13, 2019

Authored by David Yesland

Apache Tika Server versions prior to 1.18 suffer from a command injection vulnerability.

tags | exploit

advisories | CVE-2018-1335

SHA-256 | 3e510c9ef27c350819032001fc731ccd140c0a63546f55368644de170fc5fdb0

Download | Favorite | View