CVE-2015-7912

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

The Ice Faces servlet in ag_server_service.exe in the AggreGate Server Service in Tibbo AggreGate before 5.30.06 allows remote attackers to upload and execute arbitrary Java code via a crafted XML document.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://zerodayinitiative.com/advisories/ZDI-15-571/
https://ics-cert.us-cert.gov/advisories/ICSA-15-323-01Patch, US Government Resource
http://zerodayinitiative.com/advisories/ZDI-15-571/
https://ics-cert.us-cert.gov/advisories/ICSA-15-323-01Patch, US Government Resource

Timeline

Published: Nov 21, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-79137.2ag_server_service.exe in the AggreGate Server Service in Tibbo AggreGate before 5.30.06 allows local users to execute arbitrary Java code wi CVE-2015-79148.1Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 allows remote attackers to bypass authentication by leveraging knowledge of a password hash CVE-2015-79159.8Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 sends cleartext credentials, which allows remote attackers to obtain sensitive information b CVE-2015-79166.5Cross-site scripting (XSS) vulnerability in Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 allows remote authenticated users to inject arbi CVE-2015-79177.2Untrusted search path vulnerability in Open Automation OPC Systems.NET 8.00.0023 and earlier allows local users to gain privileges via a Tro CVE-2015-79186.8Multiple buffer overflows in the F1BookView ActiveX control in F1 Bookview in Schneider Electric ProClima before 6.2 allow remote attackers CVE-2015-791910.0SearchBlox 8.3 before 8.3.1 allows remote attackers to write to the config file, and consequently cause a denial of service (application cra CVE-2015-79219.1The FTP server in Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.CVE-2015-79239.0Westermo WeOS before 4.19.0 uses the same SSL private key across different customers' installations, which makes it easier for man-in-the-mi CVE-2015-79248.8eWON devices with firmware before 10.1s0 do not trigger the discarding of browser session data in response to a log-off action, which makes CVE-2015-79258.0Cross-site request forgery (CSRF) vulnerability on eWON devices with firmware through 10.1s0 allows remote attackers to hijack the authentic CVE-2015-79269.9eWON devices with firmware before 10.1s0 omit RBAC for I/O server information and status requests, which allows remote attackers to obtain s