5597 matches found
CVE-2023-27068
Deserialization of Untrusted Data in Sitecore Experience Platform through 10.2 allows remote attackers to run arbitrary code via ValidationResult.aspx...
Sitecore Experience Platform 代码问题漏洞
Sitecore Experience Platform XP is a suite of customer digital experience platforms from Sitecore, Denmark. A security vulnerability exists in Sitecore Experience Platform version 10.2 and earlier, which stems from a deserialization vulnerability in the presence of untrustworthy data, allowing...
PT-2023-20930 · Sitecore · Sitecore Experience Platform
Name of the Vulnerable Software and Affected Versions: Sitecore Experience Platform versions prior to 10.2 Description: The issue allows remote attackers to run arbitrary code. This is due to the deserialization of untrusted data. The exploitation occurs via ValidationResult.aspx. Recommendations...
CVE-2023-31058 Apache InLong: JDBC URL bypassing by adding blanks
Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers would bypass the 'autoDeserialize' option filtering by adding blanks. Users are advised to upgrade to Apache InLong's 1.7.0 or...
The vulnerability of the ExtensionMethods.Clone() function in the application programming complex of the CODESYS Development System allows a perpetrator to execute arbitrary commands.
The vulnerability of the ExtensionMethods.Clone function in the application programming complex of the CODESYS Development System is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker to execute arbitrary commands using a specially created...
PT-2023-8729 · Apache · Apache Inlong
Name of the Vulnerable Software and Affected Versions: Apache InLong versions 1.4.0 through 1.6.0 Description: The issue is related to the deserialization of untrusted data, which allows attackers to bypass the autoDeserialize option filtering by adding blanks. This can potentially lead to the...
CVE-2023-2180
The KIWIZ Invoices Certification & PDF System WordPress plugin through 2.1.3 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/downlaod arbitrary files, as well as perform PHAR unserialization assuming they can upload a file on the server...
Security Bulletin: Deserialization vulnerability affect IBM Business Automation Workflow BPM Event Emitters - CVE-2022-1471
Summary A vulnerable copy of snakeyaml is packaged with BPMEventEmitters and CaseEventEmitters in IBM Business Automation Workflow. Vulnerability Details CVEID:CVE-2022-1471 DESCRIPTION: SnakeYaml could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an...
CVE-2023-20878
VMware Aria Operations contains a deserialization vulnerability. A malicious actor with administrative privileges can execute arbitrary commands and disrupt the system...
CVE-2023-20878
CVE-2023-20878 affects VMware Aria Operations (formerly vRealize Operations). The connected sources describe a deserialization vulnerability that allows a malicious actor with administrative privileges to execute arbitrary commands and disrupt the system. Exploitation details in the VMSA-2023-000...
VMware Aria Operations 代码问题漏洞
VMware Aria Operations is a unified, artificial intelligence-driven, self-driving IT operations management platform for private, hybrid and multi-cloud environments from VMware. VMware Aria Operations has a security vulnerability that originated when the system contained a deserialization...
CVE-2023-20878
VMware Aria Operations contains a deserialization vulnerability. A malicious actor with administrative privileges can execute arbitrary commands and disrupt the system...
CVE-2023-30899
A vulnerability has been identified in Siveillance Video 2020 R2 All versions V20.2 HotfixRev14, Siveillance Video 2020 R3 All versions V20.3 HotfixRev12, Siveillance Video 2021 R1 All versions V21.1 HotfixRev12, Siveillance Video 2021 R2 All versions V21.2 HotfixRev8, Siveillance Video 2022 R1 A...
CVE-2023-30898
A vulnerability has been identified in Siveillance Video 2020 R2 All versions V20.2 HotfixRev14, Siveillance Video 2020 R3 All versions V20.3 HotfixRev12, Siveillance Video 2021 R1 All versions V21.1 HotfixRev12, Siveillance Video 2021 R2 All versions V21.2 HotfixRev8, Siveillance Video 2022 R1 A...
Siemens Siveillance Video Mobile Server 代码问题漏洞
Siveillance Video formerly known as Siveillance VMS is an IP video management software designed for deployments ranging from small and simple to large and highly secure. A code execution vulnerability exists in Siemens Siveillance Video due to the event server component of the affected applicatio...
PT-2023-2732 · Unknown · Siveillance Video
Name of the Vulnerable Software and Affected Versions: Siveillance Video 2020 R2 versions prior to V20.2 HotfixRev14 Siveillance Video 2020 R3 versions prior to V20.3 HotfixRev12 Siveillance Video 2021 R1 versions prior to V21.1 HotfixRev12 Siveillance Video 2021 R2 versions prior to V21.2...
WordPress plugin Advanced Custom Fields (ACF) Free and Pro 代码问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in the...
CISA Adds Three Known Exploited Vulnerabilities to Catalog
CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-1389 TP-Link Archer AX-21 Command Injection Vulnerability CVE-2021-45046 Apache Log4j2 Deserialization of Untrusted Data Vulnerability CVE-2023-21839 Oracle...
Apache Log4j2 Deserialization of Untrusted Data Vulnerability
Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations...