Alibaba
Monthly
Remote code execution in Alibaba fastjson versions 1.2.68 through 1.2.83 allows remote, unauthenticated attackers to run arbitrary code by submitting crafted JSON to any endpoint that deserializes untrusted input. The vendor advisory emphasizes that exploitation works under fastjson's stock default configuration - AutoType does not need to be enabled and no external classpath gadget is required - which removes the mitigations most defenders historically relied on. No public exploit identified at time of analysis, but the CVSS 9.0 rating and scope change (S:C) mark this as a high-priority deserialization flaw.
The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nacos is a platform designed for dynamic service discovery and configuration and service management. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Nacos is a platform designed for dynamic service discovery and configuration and service management. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Nacos 1.1.4 is affected by: Incorrect Access Control. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The alibaba (aka com.alibaba.wireless) application 4.1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.
Remote code execution in Alibaba fastjson versions 1.2.68 through 1.2.83 allows remote, unauthenticated attackers to run arbitrary code by submitting crafted JSON to any endpoint that deserializes untrusted input. The vendor advisory emphasizes that exploitation works under fastjson's stock default configuration - AutoType does not need to be enabled and no external classpath gadget is required - which removes the mitigations most defenders historically relied on. No public exploit identified at time of analysis, but the CVSS 9.0 rating and scope change (S:C) mark this as a high-priority deserialization flaw.
The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nacos is a platform designed for dynamic service discovery and configuration and service management. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Nacos is a platform designed for dynamic service discovery and configuration and service management. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Nacos 1.1.4 is affected by: Incorrect Access Control. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The alibaba (aka com.alibaba.wireless) application 4.1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.