[0day-rubbish] Lightstreamer Server 7.4.8 Unauthenticated JMX jvmtiAgentLoad native code execution (8.1)

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-09-27 04:12 UTC
Importiert: 2026-09-27 05:30 UTC
Quelle-ID: full_disc
uid_hash: c5450aa6c8839ebc313c869732ddc67b5dd36205491133ab58a835474fa54c7d

Full Disclosure

Posted by disclosure via Fulldisclosure on Sep 26 0day Rubbish Research Team is publicly disclosing a vulnerability in

Lightstreamer Server 7.4.8 build 3506 (with JMS Extender 2.1.0).

Type: unauthenticated JMX inspection console allowing an anonymous caller to

invoke any MBean operation, reaching jvmtiAgentLoad on

com.sun.management:type=DiagnosticCommand to load and run a native agent

library inside the broker JVM (CWE-306, CWE-345, CWE-20, CWE-250, CWE-1188)

Scoring. This finding is...

No data

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss