PT-2024-14070 · Unknown · Ros2 Foxy Fitzroy

Name of the Vulnerable Software and Affected Versions: ROS2 Foxy Fitzroy versions 2 Description: Insecure deserialization in ROS2 allows attackers to execute arbitrary code via a crafted input. The issue affects ROS2 Foxy Fitzroy with ROS VERSION=2 and ROS PYTHON VERSION=3. Recommendations: For...

Insecure Deserialization

temporai is vulnerable to Insecure Deserialization. The vulnerability is caused due to a missing validation/sanitization while deserializing user provided data in function loadfromfile of the component PKL File Handler within utils/serialization.py. An attacker can exploit this remotely to...

Insecure Deserialization

synthcity is vulnerable to Insecure Deserialization. The vulnerability is caused due to a missing validation/sanitization while deserializing user provided data in the loadfromfile function of the PKL File Handler component within utils/serialization.py...

Apache Airflow Code Execution Vulnerability (CNVD-2024-26531)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A code execution vulnerability exists in Apache Airflow versions prior to 2.8.1,...

Exploit for Incorrect Authorization in Ibm I_Access_Client_Solutions

CVE-2023-45184 IBM i Access Client Solutions jrmp.bin ┌──mk...

GHSA-JGXC-8MWQ-9XQW Clojure classes can be used to craft a serialized object that runs arbitrary code on deserialization

In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects...

Splunk Security Breach

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A...

Gambio Online Webshop unauthenticated PHP Deserialization Vulnerability

A Remote Code Execution vulnerability in Gambio online webshop version 4.9.2.0 and lower allows remote attackers to run arbitrary commands via unauthenticated HTTP POST request. The identified vulnerability within Gambio pertains to an insecure deserialization flaw, which ultimately allows an...

CVE-2023-6528 Slider Revolution < 6.6.19 - Author+ Insecure Deserialization leading to RCE

The Slider Revolution WordPress plugin before 6.6.19 does not prevent users with at least the Author role from unserializing arbitrary content when importing sliders, potentially leading to Remote Code Execution...

HPESBGN04570 rev.1 - HPE Unified OSS Console Assurance Monitoring (UOCAM), Multiple Vulnerabilities

Potential Security Impact: Local: Insecure Deserialization; Remote: Bypass Security Restrictions, Denial of Service DoS, Insecure Deserialization, Input Validation SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Unified OSS Console UOC - Prior to v3.1.0 CVSS Scores: | CVE | CV...

Insecure Deserialization

huggingface transformers is vulnerable to Insecure Deserialization. The vulnerability is due to the ability to load arbitrary pickle files from other repos specified by the indexpath while parsing the remote config.json fille. An attacker can exploit this flaw to execute arbitrary code on the...

Insecure Deserialization

dubbo is vulnerable to Insecure Deserialization. The vulnerability is caused due to lack of validation of untrusted user data. An attacker can modify application data, perform a DoS attack or execute arbitrary code by exploiting this vulnerability...

Slider Revolution < 6.6.19 - Author+ Insecure Deserialization leading to RCE

Description The plugin does not prevent users with at least the Author role from unserializing arbitrary content when importing sliders, potentially leading to Remote Code Execution. PoC 1. Make sure to configure the plugin so Authors can access its settings 2. Create a new slider. 3. Save and...

Insecure Deserialization/Unsafe Attributes Merge

phenx/php-svg-lib is vulnerable to Insecure Deserialization. The vulnerability is caused due to unsafe attributes such as href, xlink:href and id while merging attributes from the tag to the tag when handling a tag that references an tag. This can lead to an unsafe file read that can cause PHAR...

Exploit for Deserialization of Untrusted Data in Apache Activemq

CVE-2023-46604 Exploit for CVE-2023-46604 This tool helps...

The vulnerability of the SerializationTypeConverter class in the Microsoft Exchange Server mail server allows attackers to perform spoofing attacks.

The vulnerability of the SerializationTypeConverter class in Microsoft Exchange Server lies in the deserialization mechanism’s deficiencies, resulting from insufficient protection of service data. Exploiting this vulnerability allows attackers to perform spoofing attacks remotely...

AjaxPro Deserialization Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'AjaxPro Deserialization Remote Code Execution', 'Description' = %q This module leverages an insecure deserialization of data to get remote code...

Suspected Exploitation of Apache ActiveMQ CVE-2023-46604

Tom Elkins, John Fenninger, Evan McCann, Matthew Smith, and Micah Young contributed attacker behavior insights to this blog. Beginning Friday, October 27, Rapid7 Managed Detection and Response MDR identified suspected exploitation of Apache ActiveMQ CVE-2023-46604 in two different customer...

Frigate Code Issue Vulnerability

Frigate is a complete local NVR designed for home assistants with AI object detection by Blake Blackshear Personal Developer. A code issue vulnerability exists in versions prior to Frigate 0.13.0 Beta 3 that stems from the presence of an insecure deserialization vulnerability that could lead to...

Insecure Deserialization

Radisson is vulnerable to Insecure Deserialization. The vulnerability is due to the client deserializing objects without validation. If an attacker can gain control of the redis server, they can include crafted objects that lead to arbitrary code execution. Due to incomplete fix, its recommended...