Published: 15/12/2015 Updated: 07/11/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 670

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote malicious users to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache commons collections
apache commons collections 4.0

Debian Bug report logs - #857343 logback: CVE-2017-5929: serialization vulnerability affecting the SocketServer and ServerSocketReceiver components Package: liblogback-java; Maintainer for liblogback-java is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Source for liblogback-java is src:logback (PTS, buildd ...

A vulnerability in the Java deserialization used by the Apache Commons Collections (ACC) library could allow an unauthenticated, remote attacker to execute arbitrary code The vulnerability is due to insecure deserialization of user-supplied content by the affected software An attacker could exploit this vulnerability by submitting crafted input ...

example-java-maven Example Java (maven) repository containing fake data with vulnerable dependencies There is at least one vulnerable dependency in this repository: CVE-2015-6420: Vulnerability in Java Deserialization (webnvdnistgov/view/vuln/detail?vulnId=CVE-2015-6420) Run OWASP Dependency Check Maven Plugin mvn orgowasp:dependency-check-maven:check

proof-of-concept demonstration of unsafe object deserialization

Jvm Reverse Shell A proof-of-concept demonstration of unsafe Jvm object deserialization (CVE-2015-6420) This repository contains three standalone projects: payload-generator, our program that generates a serial binary payloadser containing the serialized malicious object (reverse shell backend) The file is ready-to-deploy victim, our victim server Vulnerable to CVE-2015-64

An automatic program repair tool for Android applications

apkRepair 这是一款可以对安卓应用程序apk安装包进行Java第三方库漏洞检测并自动修复的工具 Introduction 安卓目前是全球第一大智能手机操作系统，拥有丰富的应用程序。同时这些应用程序也越来越复杂，安卓应用程序发开人员为了简化发开流程往往会使用大量的第三方代码库来丰富应用程�

extraction of bytecode changes related to security patches

JPatch collect CVEs recorded in the sap-project-kb project, this will have patch commits, incl the actual sources that have been changed then look up version ranges, using GHSA API (or if this does not work, snyk or NVD) Open: need to map CVEs to GHSA id for query Possibilities: Clone githubcom/github/advisory-database/ and then get info from JSON entries , look fo

Example Java (maven) repository containing fake data with vulnerable dependencies

example-java-maven Example Java (maven) repository containing fake data with vulnerable dependencies There is at least one vulnerable dependency in this repository: CVE-2015-6420: Vulnerability in Java Deserialization (webnvdnistgov/view/vuln/detail?vulnId=CVE-2015-6420) Run OWASP Dependency Check Maven Plugin mvn orgowasp:dependency-check-maven:check

CWE-502 http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-java-deserialization http://www.securityfocus.com/bid/78872 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722 https://www.tenable.com/security/research/tra-2017-14 https://www.tenable.com/security/research/tra-2017-23 http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html https://www.kb.cert.org/vuls/id/581311 https://lists.apache.org/thread.html/r352e40ca9874d1beb4ad95403792adca7eb295e6bc3bd7b65fabcc21%40%3Ccommits.samza.apache.org%3E https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=857343 https://github.com/Cheatahh/jvm-reverseshell http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-java-deserialization https://www.kb.cert.org/vuls/id/576313

CVE-2015-6420

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect