Liferay Portal Insecure Deserialization (CVE-2020-7961)

An insecure deserialization vulnerability exists in Liferay Portal. This vulnerability is due to improper sanitization of user-supplied data in the JSONWebServiceActionParameters class...

Oracle Fusion Middleware WebLogic Server Insecure Deserialization (CVE-2020-2883; CVE-2020-2546; CVE-2020-2798; CVE-2020-2801; CVE-2020-2884)

An insecure deserialization vulnerability exists in the Oracle WebLogic Server. The vulnerability is due to the lack of input validation by the servlet. A successful attack could result in the execution of arbitrary code on the affected system...

Mono MonoX CMS Code Issue Vulnerability

MonoX CMS is an ASP.NET-based content management system CMS and social networking platform from Mono Croatia. A security vulnerability exists in Mono MonoX CMS 5.1.40.5152 and earlier versions, which stems from an insecure behavior in the ModuleGallery.HTML5Upload,...

Oracle JDeveloper ADF Faces Insecure Deserialization (CVE-2019-2904)

An insecure deserialization vulnerability exists in Oracle JDeveloper ADF Faces. This vulnerability is due to insufficient validation of HTTP requests...

Apache ShardingSphere Insecure Deserialization (CVE-2020-1947)

An insecure deserialization vulnerability exists in Apache ShardingSphere incubator. Successful exploitation of this vulnerability could result in arbitrary code execution with the privileges of the application...

Apache OFBiz Insecure Deserialization (CVE-2019-0189)

An insecure deserialization vulnerability exists in Apache OFBiz. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Oracle Weblogic Insecure Deserialization (CVE-2020-2555)

An insecure deserialization vulnerability exists in Oracle Weblogic server. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

U.S. Dept Of Defense: Remote Code Execution via Insecure Deserialization in Telerik UI

Hello, I found an outdated version of Telerik Web UI v2016.2.607.40 at the following URL: https://███/Telerik.Web.UI.WebResource.axd?type=rau. This means that we can achieve full RCE by chaining two different CVEs: CVE-2017-11317, which allows us to upload arbitrary files on the server, and...

CVE-2020-6967

In Rockwell Automation all versions of FactoryTalk Diagnostics software, a subsystem of the FactoryTalk Services Platform, FactoryTalk Diagnostics exposes a .NET Remoting endpoint via RNADiagnosticsSrv.exe at TCPtcp/8082, which can insecurely deserialize untrusted data...

Design/Logic Flaw

In Rockwell Automation all versions of FactoryTalk Diagnostics software, a subsystem of the FactoryTalk Services Platform, FactoryTalk Diagnostics exposes a .NET Remoting endpoint via RNADiagnosticsSrv.exe at TCPtcp/8082, which can insecurely deserialize untrusted data...

CVE-2020-6967

In Rockwell Automation all versions of FactoryTalk Diagnostics software, a subsystem of the FactoryTalk Services Platform, FactoryTalk Diagnostics exposes a .NET Remoting endpoint via RNADiagnosticsSrv.exe at TCPtcp/8082, which can insecurely deserialize untrusted data...

FasterXML jackson-databind deserialization vulnerability (CNVD-2020-24668)

FasterXML Jackson is a U.S. FasterXML company for Java data processing tools . jackson-databind is one of the components with data binding capabilities . A security vulnerability exists in FasterXML jackson-databind version 2.x prior to 2.9.10.4, which stems from insecure deserialization of...

Apache Dubbo Insecure Deserialization (CVE-2019-17564)

An insecure deserialization vulnerability exists in Apache Dubbo. The vulnerability is due to deserialization of untrusted data. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

xstream: remote code execution due to insecure XML deserialization (regression of CVE-2013-7285)

It was found that xstream API version 1.4.10 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. This a regression of...

HPE Intelligent Management Center Insecure Deserialization (CVE-2019-11944)

An insecure deserialization vulnerability exists in HPE Intelligent Management Center. The vulnerability is due to deserialization of untrusted data by the MetaDataEntry while having vulnerable classes in the code path. Successful exploitation of this vulnerability could result in execution of...

Cisco Security Manager Insecure Deserialization (CVE-2019-12630)

An insecure deserialization vulnerability exists in Cisco Security Manager. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system...

Oracle Weblogic Server Remote Code Execution (CVE-2019-2890)

An insecure deserialization vulnerability exists in Oracle Weblogic. This vulnerability is due to insufficient validation of T3 requests. A remote authenticated attacker can exploit this vulnerability by sending crafted requests to a vulnerable server. Successful exploitation of this vulnerabilit...

NetGain Systems Enterprise Manager Insecure Deserialization (CVE-2017-17406)

An insecure deserialization vulnerability exists in the NetGain Systems Enterprise Manager. The vulnerability is due to the lack of input validation on objects in the RMI Registry before deserializing them. Successful exploitation can result in arbitrary code execution on the affected system...

XStream Library Insecure Deserialization (CVE-2019-10173)

An insecure serialization vulnerability exists in XStream Library. The vulnerability is due to insufficient validation of event handler type in user-supplied XML data. A remote attacker could exploit this vulnerability by sending specially crafted XML file to the affected application. Successful...

HPE ByteMessageResource Insecure Deserialization (CVE-2019-11956)

An insecure deserialization vulnerability exists in HPE Intelligent Management Center. Successful exploitation of this vulnerability could result in execution of arbitrary code on the target server in the context of SYSTEM...