XStream 代码问题漏洞

XStream is a simple Java-based library , Java objects serialized to xml and vice versa i.e. : Java objects and xml documents can easily be converted to each other . A code execution vulnerability exists in XStream, which can be exploited by an attacker to manipulate the processed input stream and...

PT-2021-14436

Name of the Vulnerable Software and Affected Versions XStream versions prior to 1.4.16 Description XStream is a Java library used to serialize objects to XML and back again. The vulnerability exists in XStream before version 1.4.16, where an attacker can manipulate the processed input stream and...

Arbitrary Code Execution

xstream is vulnerable to arbitrary code execution. An attacker is able to manipulate the processed input stream to replace or inject objects that result in the execution of arbitrary code loaded from a remote server during unmarshalling of written objects containing type information...

XStream Code Execution Vulnerability (CNVD-2021-28334)

XStream is a simple Java-based library , Java objects serialized to xml and vice versa i.e. : Java objects and xml documents can easily be converted to each other . XStream has a code execution vulnerability that can be exploited by an attacker to manipulate the processed input stream and replace...

XStream Code Execution Vulnerability (CNVD-2021-28335)

XStream is a simple Java-based library , Java objects serialized to xml and vice versa i.e. : Java objects and xml documents can be easily converted to each other . A code execution vulnerability exists in XStream, which can be exploited by an attacker to manipulate the processed input stream and...

Denial Of Service (DoS)

virtualbox is vulnerable to denial of service. An attacker manipulating with an unknown input may lead to a denial of service vulnerability...

Denial Of Service (DoS)

virtualbox is vulnerable to denial of service. An attacker manipulating with an unknown input may lead to a denial of service vulnerability...

CVE-2020-5366

Dell EMC iDRAC9 versions prior to 4.20.20.20 contain a Path Traversal Vulnerability. A remote authenticated malicious user with low privileges could potentially exploit this vulnerability by manipulating input parameters to gain unauthorized read access to the arbitrary files...

DEBIAN-CVE-2020-11017

In FreeRDP less than or equal to 2.0.0, by providing manipulated input a malicious client can create a double free condition and crash the server. This is fixed in version 2.1.0...

CVE-2020-3313

A vulnerability in the web UI of Cisco Firepower Management Center FMC Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of the FMC Software. The vulnerability is due to insufficient validatio...

CVE-2017-7525

A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. Mitigation Mitigation to this problem is to not trigger polymorphic desrializatio...

CVE-2019-8157

A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can manipulate downloadable link and cause an invocation of error handling that acceses user input without sanitization...

Design/Logic Flaw

A denial-of-service issue was discovered in the MQTT library in Arm Mbed OS 2017-11-02. The function readMQTTLenString is called by the function MQTTDeserializepublish to get the length and content of the MQTT topic name. In the function readMQTTLenString, mqttstring-lenstring.len is a part of us...

Denial Of Service (DoS)

Oracle MySQL Server is vulnerable to denial of service DoS attacks. An authenticated user can manipulate with an unknown input, causing the application to crash. The affected component is DML...

Denial Of Service (DoS)

Oracle MySQL Server is vulnerable to denial of service DoS attacks. A remotely authenticated user can manipulate with an unknown input, causing the application to crash...

Denial Of Service (DoS)

Oracle MySQL Server and MariaDB are vulnerable to denial of service DoS attacks. A remotely authenticated user can manipulate with an unknown input, causing the application to crash. The affected component is InnoDB...

Denial Of Service (DoS)

Oracle MySQL Server and MariaDB are vulnerable to denial of service DoS attacks. A remote authenticated user can manipulate with an unknown input, causing the application to crash. The affected component is DML...

Apple IntelHD5000 Graphics Delete Resource Privilege Escalation Vulnerability

Summary A memory corruption vulnerability exists in the IntelHD5000 kernel extension when dealing with graphics resources inside of OSX 10.13.4. A library inserted into the VLC media application can cause an out-of-bounds access inside of the KEXT leading to a use after free and invalid memory...

Code injection

NUUO CMS All versions 3.3 and prior the application allows external input to construct a pathname that is able to be resolved outside the intended directory. This could allow an attacker to impersonate a legitimate user, obtain restricted information, or execute arbitrary code...

Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS

Phar files formerly known as "PHP archives" can act als self extracting archives which leads to the fact that source code is executed when Phar files are invoked. The Phar file format is not limited to be stored with a dedicated file extension - "bundle.phar" would be valid as well as "bundle.txt...