PT-2024-3249 · Progress · Progress Telerik Reporting

Name of the Vulnerable Software and Affected Versions: Progress Telerik Reporting versions prior to 2024 Q1 18.0.24.130 Description: The issue is related to an insecure deserialization vulnerability in the ObjectReader class of Progress Telerik Reporting, which can be exploited by a remote threat...

Progress Software Telerik Report Server Code Issue Vulnerability

Progress Software Telerik Report Server is an enterprise-class report management and distribution solution from Progress Software. A security vulnerability exists in Progress Software Telerik Report Server 2024 Q1 10.0.24.130 and prior versions that originated from a vulnerability that allows an...

Progress Software Telerik Report Server Code Issue Vulnerability

Progress Software Telerik Report Server is an enterprise-class report management and distribution solution from Progress Software. A security vulnerability exists in Progress Software Telerik Report Server 2024 Q1 10.0.24.130 and prior versions that originated from a vulnerability that allows an...

Progress Software Telerik Report Server Code Issue Vulnerability

Progress Software Telerik Report Server is an enterprise-class report management and distribution solution from Progress Software. A security vulnerability exists in Progress Software Telerik Report Server 2024 Q1 10.0.24.130 and prior versions that originated from a vulnerability that allows an...

Apache James elevation of privilege vulnerability (CNVD-2024-26542)

Apache James is the United States Apache Apache Foundation of a completely written in Java open source Smtp and Pop3 mail transfer agent and Nntp news server . Apache James suffers from an elevation of privilege vulnerability caused by insecure deserialization in JMX endpoints. An attacker can...

Insecure Deserialization

nGrinder is vulnerable to Insecure Deserialization. The vulnerability is caused due to a lack of proper input filtering during Java object deserialization within Connector.java. Specifically, unauthenticated users could submit serialized Java objects, leading to the potential execution of arbitra...

nGrinder Security Vulnerabilities

nGrinder is a stress testing platform that enables you to perform script creation, test execution, monitoring and results report generator simultaneously. A security vulnerability exists in nGrinder versions prior to 3.5.9, which stems from a vulnerability that could allow a remote attacker to...

BIT-TYPO3-2020-11066

In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, calling unserialize on malicious user-submitted content can lead to modification of dynamically-determined object attributes and result in triggering deletion of an arbitrary...

BIT-TYPO3-2020-11067

In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings in $BEUSER-uc are vulnerable to insecure deserialization. In combination with vulnerabilities of third party components, this can lead to remote code execution. A valid backend user...

BIT-TYPO3-2020-15098

In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic...

BIT-ARTIFACTORY-2022-0573

JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation and Remote Code Execution when a specially crafted request is sent by a low privileged authenticated user due to insufficient validation of a...

Insecure Deserialization

Dataease is vulnerable to Insecure Deserialization. The vulnerability is due not considering URL encoding while blacklisting certain user-controllable jdbc parameters in the JDBC connection url while calling methods getExtraParams and URLDecoder.decodegetExtraParams within Mysql.java. An attacker...

Apache James 代码问题漏洞

Apache James is the United States Apache Apache Foundation of a completely written in Java open source Smtp and Pop3 mail transfer agent and Nntp news server . Apache James suffers from an elevation of privilege vulnerability caused by insecure deserialization in JMX endpoints. An attacker can...

Insecure Deserialization

autoprognosis is vulnerable to Insecure Deserialization. The vulnerability is due to loading untrusted data from loadmodelfromfile function within the Release Note Handler component, resulting in Command Injection...

Insecure Deserialization

org.apache.camel:camel-cassandraql is vulnerable to Insecure Deserialization. The vulnerability is due to insufficient validation of serialized objects, which can be exploited by attackers to execute arbitrary code...

Insecure Deserialisation

org.apache.camel:camel-sql is vulnerable to Insecure Deserialisation. The vulnerability is due to insufficient validation of serialized objects, which can be exploited by attackers to execute arbitrary code...

BuddyForms Plugin for WordPress < 2.7.8 Insecure Deserialization

The WordPress BuddyForms Plugin installed on the remote host is affected by an unauthenticated insecure deserialization in the function buddyformsuploadimagefromurl which allowed for the deserialization of untrusted input via the url parameter. Note that the scanner has not tested for these issue...

Lead Generated Plugin for WordPress < 1.25 Insecure Deserialization

The WordPress Lead Generated Plugin installed on the remote host is affected by an unauthenticated insecure deserialization. The tvelabels parameter of the tveapiformsubmit action is passed to the PHP unserialize function without being sanitized or verified, and as a result could lead to PHP obje...

Insecure Deserialization

Torrentpier is vulnerable to Insecure Deserialization. The vulnerability is due to a lack of proper validation during deserialization. This allows an attacker to execute arbitrary commands on the server...

Deserialization of Untrusted Data in Torrentpier

Torrentpier version 2.4.1 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to insecure deserialization...