Jasperreports Web Studio
Monthly
Remote code execution in Jaspersoft's JasperReports Library and Server (Community and Professional editions up to 7.0.6 / 10.0.0) arises from unsafe deserialization of untrusted Java objects (CWE-502), letting an authenticated attacker run arbitrary code on the host. The flaw carries full 'total' technical impact per SSVC, and its network-reachable, low-complexity vector makes it a strong patch priority despite requiring some privileges; no public exploit identified at time of analysis, and EPSS is modest at 0.40% (61st percentile).
A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Remote code execution in Jaspersoft's JasperReports Library and Server (Community and Professional editions up to 7.0.6 / 10.0.0) arises from unsafe deserialization of untrusted Java objects (CWE-502), letting an authenticated attacker run arbitrary code on the host. The flaw carries full 'total' technical impact per SSVC, and its network-reachable, low-complexity vector makes it a strong patch priority despite requiring some privileges; no public exploit identified at time of analysis, and EPSS is modest at 0.40% (61st percentile).
A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.