1814 matches found
IBM MQ 代码问题漏洞
IBM MQ IBM WebSphere MQ is a messaging middleware product from IBM. The product is mainly for the service-oriented architecture SOA to provide a reliable and proven messaging backbone. A remote code execution vulnerability exists in IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD, which is caused ...
OpenCATS Remote Code Execution Vulnerability
OpenCATS is a free open source candidate/applicant tracking system designed to allow recruiters to manage the hiring process from job posting and candidate application to candidate selection and submission. A remote code execution vulnerability exists in OpenCATS version 0.9.5-3 and earlier. The...
XStream: remote code execution due to insecure XML deserialization when relying on blocklists
A flaw was found in xstream. An unsafe deserialization of user-supplied XML, in conjunction with relying on the default deny list, allows a remote attacker to perform a variety of attacks including a remote code execution of arbitrary code in the context of the JVM running the XStream application...
OpenCats 代码问题漏洞
OpenCATS is a free open source candidate/applicant tracking system designed to allow recruiters to manage the hiring process from job posting and candidate application to candidate selection and submission. A remote code execution vulnerability exists in OpenCATS version 0.9.5-3 and earlier. The...
FasterXML jackson-databind Insecure Deserialization (CVE-2020-36179)
An Insecure Deserialization vulnerability exists in FasterXML jackson-databind. A remote attacker can exploit this vulnerability by sending a specially crafted serialized object. Successful exploitation can result in arbitrary code execution in the affected system...
HPE Aruba Airwave Glass Code Issue Vulnerability
HPE Aruba Airwave Glass is a smart glasses device from Hewlett-Packard HPE. A security vulnerability exists in Airwave Glass before 1.3.3, which is caused by insecure Java deserialization and can be exploited by an attacker to execute arbitrary commands...
XStream: remote code execution due to insecure XML deserialization when relying on blocklists
A flaw was found in xstream. An unsafe deserialization of user-supplied XML, in conjunction with relying on the default deny list, allows a remote attacker to perform a variety of attacks including a remote code execution of arbitrary code in the context of the JVM running the XStream application...
XStream: remote code execution due to insecure XML deserialization when relying on blocklists
A flaw was found in xstream. An unsafe deserialization of user-supplied XML, in conjunction with relying on the default deny list, allows a remote attacker to perform a variety of attacks including a remote code execution of arbitrary code in the context of the JVM running the XStream application...
ThinkAdmin Code Issues Vulnerabilities
ThinkAdmin is a general purpose backend management system based on the ThinkPHP framework. ThinkAdmin version 4 has a security vulnerability vulnerability , the vulnerability stems from insecure deserialization , an attacker can use the vulnerability to remotely execute arbitrary code...
CVE-2020-35932
Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges such as subscribers to use the tpncrender AJAX action to inject arbitrary PHP objects via the optionsinlineedits parameter. NOTE: exploitability depends on PH...
CVE-2020-35932
Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges such as subscribers to use the tpncrender AJAX action to inject arbitrary PHP objects via the optionsinlineedits parameter. NOTE: exploitability depends on PH...
Deserialization of untrusted data
Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges such as subscribers to use the tpncrender AJAX action to inject arbitrary PHP objects via the optionsinlineedits parameter. NOTE: exploitability depends on PH...
CVE-2020-35932
The CVE concerns the WordPress Newsletter plugin prior to version 6.8.2, where an insecure deserialization flaw exists in the tpnc_render AJAX path. An authenticated user with minimal privileges (e.g., a subscriber) can submit options[inline_edits] data to wp-admin/admin-ajax.php, leading to unse...
WordPress Newsletter plugin 代码问题漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. An insecure deserialization vulnerability exists in the Newsletter plugin in WordPress versions prior to 6.8.2. An authenticated remote attacker can exploit this vulnerability to inject arbitrar...
Newsletter Manager <= 1.5.1 - Unauthenticated Insecure Deserialisation
The plugin is affected by an insecure deserialisation issue, which could lead to an unauthenticated PHP object injection when a suitable gadget chain is present...
Exploit for Injection in Elastic Elasticsearch
CVE-2015-5377 Elasticsearch 1.5.2 is vulner...
CVE-2020-20136
QuantConnect Lean versions from 2.3.0.0 to 2.4.0.1 are affected by an insecure deserialization vulnerability due to insecure configuration of TypeNameHandling property in Json.NET library...
CVE-2020-20136
QuantConnect Lean versions from 2.3.0.0 to 2.4.0.1 are affected by an insecure deserialization vulnerability due to insecure configuration of TypeNameHandling property in Json.NET library...
CVE-2020-20136
CVE-2020-20136 affects QuantConnect Lean versions 2.3.0.0 through 2.4.0.1, due to an insecure deserialization vulnerability caused by insecure configuration of TypeNameHandling in Json.NET. The issue is documented across multiple sources (NVD entry, Red Hat advisory, GHSA, OSV) and has high/criti...
