BIT-TYPO3-2020-15098

In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic...

BIT-ARTIFACTORY-2022-0573

JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation and Remote Code Execution when a specially crafted request is sent by a low privileged authenticated user due to insufficient validation of a...

Insecure Deserialization

Dataease is vulnerable to Insecure Deserialization. The vulnerability is due not considering URL encoding while blacklisting certain user-controllable jdbc parameters in the JDBC connection url while calling methods getExtraParams and URLDecoder.decodegetExtraParams within Mysql.java. An attacker...

Apache James 代码问题漏洞

Apache James is the United States Apache Apache Foundation of a completely written in Java open source Smtp and Pop3 mail transfer agent and Nntp news server . Apache James suffers from an elevation of privilege vulnerability caused by insecure deserialization in JMX endpoints. An attacker can...

Insecure Deserialization

autoprognosis is vulnerable to Insecure Deserialization. The vulnerability is due to loading untrusted data from loadmodelfromfile function within the Release Note Handler component, resulting in Command Injection...

Insecure Deserialization

org.apache.camel:camel-cassandraql is vulnerable to Insecure Deserialization. The vulnerability is due to insufficient validation of serialized objects, which can be exploited by attackers to execute arbitrary code...

Insecure Deserialisation

org.apache.camel:camel-sql is vulnerable to Insecure Deserialisation. The vulnerability is due to insufficient validation of serialized objects, which can be exploited by attackers to execute arbitrary code...

BuddyForms Plugin for WordPress < 2.7.8 Insecure Deserialization

The WordPress BuddyForms Plugin installed on the remote host is affected by an unauthenticated insecure deserialization in the function buddyformsuploadimagefromurl which allowed for the deserialization of untrusted input via the url parameter. Note that the scanner has not tested for these issue...

Lead Generated Plugin for WordPress < 1.25 Insecure Deserialization

The WordPress Lead Generated Plugin installed on the remote host is affected by an unauthenticated insecure deserialization. The tvelabels parameter of the tveapiformsubmit action is passed to the PHP unserialize function without being sanitized or verified, and as a result could lead to PHP obje...

Insecure Deserialization

Torrentpier is vulnerable to Insecure Deserialization. The vulnerability is due to a lack of proper validation during deserialization. This allows an attacker to execute arbitrary commands on the server...

Deserialization of Untrusted Data in Torrentpier

Torrentpier version 2.4.1 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to insecure deserialization...

CVE-2024-1651

Torrentpier version 2.4.1 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to insecure deserialization...

CVE-2024-1651 Torrentpier 2.4.1 - RCE

Torrentpier version 2.4.1 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to insecure deserialization...

CVE-2024-1651 Torrentpier 2.4.1 - RCE

Torrentpier version 2.4.1 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to insecure deserialization...

CVE-2024-1651

CVE-2024-1651 affects Torrentpier 2.4.1. The root cause is insecure deserialization, allowing arbitrary commands to be executed on the server (Remote Code Execution). Multiple connected sources provide a concrete exploit presence via PoC code on GitHub, and descriptions confirm the vulnerability ...

CVE-2024-1651 Torrentpier 2.4.1 - RCE

Torrentpier version 2.4.1 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to insecure deserialization...

PT-2024-18199 · Unknown · Torrentpier

Name of the Vulnerable Software and Affected Versions: Torrentpier version 2.4.1 Description: The issue allows executing arbitrary commands on the server due to the application being vulnerable to insecure deserialization. Recommendations: For Torrentpier version 2.4.1, as a temporary workaround,...

Insecure Deserialisation

clearml is vulnerable to Insecure Deserialisation. The vulnerability is due to Deserialisation of untrusted data. An attacker can upload a malicious pickle file via the project API to run arbitrary code on an end user's system...

Deserialization of untrusted data

Insecure deserialization in ROS2 Foxy Fitzroy ROSVERSION=2 and ROSPYTHONVERSION=3 allows attackers to execute arbitrary code via a crafted input...

CVE-2023-51204

CVE-2023-51204 was withdrawn (CNA) and is not an active vulnerability entry. Connected sources describe a separate vulnerability in ROS2 Foxy Fitzroy: insecure deserialization in ROS2 Foxy Fitzroy (ROS 2, ROS_VERSION=2; ROS_PYTHON_VERSION=3) that could allow arbitrary code execution via crafted i...