Adobe ColdFusion Deserialization Vulnerability (CNVD-2024-25608)

Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. Adobe ColdFusion has a deserialization vulnerability that arises from unsafe deserialization of...

PT-2023-3690 · Adobe · Coldfusion

Name of the Vulnerable Software and Affected Versions: Adobe ColdFusion versions 2018u17 and earlier Adobe ColdFusion versions 2021u7 and earlier Adobe ColdFusion versions 2023u1 and earlier Description: The issue is related to a Deserialization of Untrusted Data vulnerability in Adobe ColdFusion...

Adobe ColdFusion 代码问题漏洞

Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. Adobe ColdFusion has a deserialization vulnerability that arises from unsafe deserialization of...

CVE-2023-36825 Orchid Deserialization of Untrusted Data vulnerability leads to Remote Code Execution

Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dashboards. A vulnerability present starting in version 14.0.0-alpha4 and prior to version 14.5.0 is related to the deserialization of untrusted data from the state query parameter,...

Netwrix Auditor Insecure Object Deserialization Vulnerability

Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\SYSTEM user. Successful exploitation requires that the attacker is able to reach port 9004/TCP,...

CVE-2023-33008 Apache Johnzon: Prevent inefficient internal conversion from BigDecimal at large scale

Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon. A malicious attacker can craft up some JSON input that uses large numbers numbers such as 1e20000000 that Apache Johnzon will deserialize into BigDecimal and maybe use numbers too large which may result ...

CVE-2023-28323

A deserialization of untrusted data exists in EPM 2022 Su3 and all prior versions that allows an unauthenticated user to elevate rights. This exploit could potentially be used in conjunction with other OS Operating System vulnerabilities to escalate privileges on the machine or be used as a...

CVE-2023-31222

CVE-2023-31222 affects Medtronic Paceart Optima, specifically versions 1.11 and earlier, where Deserialization of untrusted data via the Microsoft Messaging Queuing Service in Paceart Messaging Service can allow an unauthenticated, network-accessing attacker to impact a Paceart Optima cardiac dev...

Remote Code Execution (RCE)

xxl-rpc-core is vulnerable to Remote Code Execution. The vulnerability exists because the server and client will invoke the pre-configured serialization processor for deserialization in the decode function of NettyDecoder.java without input validation, leading to remote code execution...

jackson-databind: use of deeply nested arrays

A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer.deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices...

Solon 代码问题漏洞

Solon is a new ecological application development framework for Java for noear individual developers in China. A code issue vulnerability exists in versions prior to Solon 2.3.3 that stems from allowing deserialization of untrusted data...

GHSA-RX62-5CW6-X29Q Whaleal IceFrog is vulnerable to deserialization

Whaleal IceFrog v1.1.8 component Aviator Template Engine is vulnerable to deserialization of untrusted data. The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid...

Whaleal IceFrog is vulnerable to deserialization

Whaleal IceFrog v1.1.8 component Aviator Template Engine is vulnerable to deserialization of untrusted data. The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid...

whaleal IceFrog 代码问题漏洞

whaleal IceFrog is a small but comprehensive Java tool library from whaleal. A code issue vulnerability exists in whaleal IceFrog version 1.1.8, which stems from a problem with the component Aviator Template Engine that causes deserialization...

PT-2023-24173 · Unknown · Whaleal Icefrog +1

Name of the Vulnerable Software and Affected Versions: whaleal IceFrog version 1.1.8 Description: A problematic vulnerability has been found in the Aviator Template Engine component, leading to deserialization of untrusted data. The manipulation with this issue may be used since the exploit has...

CVE-2023-3001

A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentially leading to remote code execution when an attacker gets the user to open a malicious file...

CVE-2023-3001

A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentially leading to remote code execution when an attacker gets the user to open a malicious file...

PT-2023-23737 · Zhong Bang · Zhong Bang Crmeb

Name of the Vulnerable Software and Affected Versions: Zhong Bang CRMEB versions up to 4.6.0 Description: A vulnerability was found in the function put image of the file api/controller/v1/PublicController.php. The manipulation leads to deserialization. The attack can be launched remotely. The...

The vulnerability of the Apache Dubbo RPC framework, related to deficiencies in the deserialization mechanism, allows attackers to execute arbitrary code.

The vulnerability of the Apache Dubbo RPC framework is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

GHSA-65WH-G8X8-GM2H Apache NiFi vulnerable to Deserialization of Untrusted Data

The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location...