CVE-2020-24648

CVE-2020-24648 affects Hewlett Packard Enterprise Intelligent Management Center (iMC) before version 7.3 (E0705P07). The issue arises from deserialization of the AccessMgrServlet className with untrusted data, enabling remote code execution. Multiple connected documents corroborate the root cause...

OPENSUSE-SU-2020:1677-1 Security update for rubygem-activesupport-5_1

This update for rubygem-activesupport-51 fixes the following issues: - CVE-2020-8165: Fixed deserialization of untrusted data in MemCacheStore potentially resulting in remote code execution bsc1172186 This update was imported from the SUSE:SLE-15:Update update project...

The vulnerability of the oadd.org.apache.xalan.lib.sql.JNDIConnectionPool component in the Jackson-databind library of the FasterXML project allows a hacker to execute arbitrary code.

The vulnerability of the oadd.org.apache.xalan.lib.sql.JNDIConnectionPool component in the Jackson-databind library of the FasterXML project is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the weblogic/oracle-aqjms component of the Jackson-databind library in the FasterXML project allows a attacker to execute arbitrary code.

The vulnerability of the weblogic/oracle-aqjms component of the Jackson-databind library in the FasterXML project is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2020-26867

ARC Informatique PcVue prior to version 12.0.17 is vulnerable due to the deserialization of untrusted data, which may allow an attacker to remotely execute arbitrary code on the web and mobile back-end server...

PT-2020-4303

Name of the Vulnerable Software and Affected Versions: ARC Informatique PcVue versions prior to 12.0.17 Description: The issue is related to the deserialization of untrusted data, which may allow an attacker to remotely execute arbitrary code on the web and mobile back-end server. This is due to...

IBM QRadar Untrusted Data Deserialization Vulnerability

IBM QRadar SIEM is an IBM USA solution that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user activity, and more. An untrustworthy...

Exploit for Use of Hard-coded Cryptographic Key in Apache Aurora

Awesome-shiro CVE-2016-4437 Shiro=1.2.4反序列化，爆破模块和key、代码执行、反弹shell的工具 ---- 漏洞原因 因为shiro对cookie里的rememberme字段进行了反序列化，所以如果知道了shiro的编码方式，然后将恶意命令用它的编码方式进行编码并放在http头的cookie里，在shiro对提交的cookie的rememberme字段进行反序列化时，也就执行了插入的命令，最终造成了命令执行 shiro默认使用了CookieRememberMeManager，其处理cookie的流程是：...

Exploit for Deserialization of Untrusted Data in Oracle Weblogic_Server

CVE-2018-2628 WebLogic反序列化漏洞复现 weblogic getshell python CVE-2018-2628-Getshell.py ip port shell1.jsp C:\Users\CTF\Desktoppython CVE-2018-2628-Getshell.py 10.10.20.166 7001 jason1.jsp / \ \ / / | | \ / / |/ \ | \ / /| \ / \ | | \ \ / /| | | | | || | | / / | | | | \ / / | |/ /| | | || | usage:...

Exploit for Deserialization of Untrusted Data in Oracle Weblogic_Server

CVE-2018-2628 CVE-2018-2628漏洞工具包 根据Github上整理出的漏洞利用工具包含： 1.CVE-2018-2628漏洞检测工具 //漏洞存在检测的POC 2.weblogicpoc.py //漏洞利用的POC 3.ysoserial-0.1-cve-2018-2628-all.jar //借鉴的漏洞利用工具https://github.com/tdy218/ysoserial-cve-2018-2628/releases 具体的漏洞复现过程请移步简书：https://www.jianshu.com/p/6649118ba7b6...

Exploit for Missing Authentication for Critical Function in Oracle Weblogic_Server

This is a PoC exploit for CVE-2017-10271, a vulnerability in Oracle WebLogic's wls-wsat component that allows for deserialization of untrusted data, leading to remote code execution. The exploit is written in Python and uses the requests library to send a malicious XML payload to the vulnerable...

Exploit for Deserialization of Untrusted Data in Redhat Jboss_Enterprise_Application_Platform

This is a PoC exploit for CVE-2017-12149, a remote code execution vulnerability in JBoss. The exploit is written in Python and uses the requests library to send a crafted request to the target JBoss server. The exploit payload is encoded in hexadecimal and is injected into the request as a crafte...

The vulnerability of the software system for managing enterprise assets in IBM Maximo Asset Management lies in the lack of a deserialization mechanism, allowing attackers to execute arbitrary code.

The vulnerability of the software system for managing enterprise assets in IBM Maximo Asset Management is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Microsoft SQL Server Reporting Services 2016 ViewState deserialization vulnerability

Added: 09/25/2020 CVE: CVE-2020-0618 Background Microsoft SQL Server Reporting Services is a set of tools and services for creating, deploying, and managing mobile and paginated reports. Problem A deserialization vulnerability in Microsoft SQL Server Reporting Services 2016 allows a remote,...

CVE-2020-7528

A CWE-502 Deserialization of Untrusted Data vulnerability exists in SCADAPack 7x Remote Connect V3.6.3.574 and prior which could allow arbitrary code execution when an attacker builds a custom .PRJ file containing a malicious serialized buffer...

CVE-2020-7532

A CWE-502 Deserialization of Untrusted Data vulnerability exists in SCADAPack x70 Security Administrator V1.2.0 and prior which could allow arbitrary code execution when an attacker builds a custom .SDB file containing a malicious serialized buffer...

Unsafe deserialization in Yii 2

Impact Remote code execution in case application calls unserialize on user input containing specially crafted string. Patches 2.0.38 Workarounds Add the following to BatchQueryResult.php: php public function sleep throw new \BadMethodCallException'Cannot serialize '.CLASS; public function wakeup...

USN-4496-1: Apache XML-RPC vulnerability

It was discovered that Apache XML-RPC aka ws-xmlrpc does not properly deserialize untrusted data. An attacker could possibly use this issue to execute arbitrary code. CVE-2019-17570...

USN-4496-1 Apache XML-RPC vulnerability

It was discovered that Apache XML-RPC aka ws-xmlrpc does not properly deserialize untrusted data. An attacker could possibly use this issue to execute arbitrary code. CVE-2019-17570...

Hyland OnBase XML Deserialization Library Insecure Use Vulnerability

Hyland OnBase is an enterprise information platform for managing your content, processes and cases. Hyland OnBase is vulnerable to an unsafe use of the XML deserialization library. No detailed vulnerability details are provided at this time...