1772 matches found
CVE-2019-11030
Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Mirasys.Common.Utils.Security.DataCrypt method in Common.dll in AuditTrailService in SMServer.exe. This method triggers insecure deserialization within the .NET garbage collector, in which a gadget contained in a serialized object may...
CVE-2019-11030
Mirasys VMS (before v7.6.1 and before v8.3.2) is affected by CVE-2019-11030 due to insecure deserialization in Mirasys.Common.Utils.Security.DataCrypt within Common.dll (AuditTrailService in SMServer.exe). The vulnerability allows execution of a gadget contained in a serialized object with SYSTEM...
Security feature bypass
In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class...
CVE-2018-11779
In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class...
xstream: remote code execution due to insecure XML deserialization (regression of CVE-2013-7285)
It was found that xstream API version 1.4.10 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. This a regression of...
xstream: remote code execution due to insecure XML deserialization (regression of CVE-2013-7285)
It was found that xstream API version 1.4.10 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. This a regression of...
OpenMRS Platform Insecure Deserialization (CVE-2018-19276)
An Insecure Deserialization vulnerability exists in OpenMRS platform. A remote attacker can exploit this vulnerability by sending a specially crafted serialized object. Successful exploitation can result in arbitrary code execution in the effected system...
TYPO3 8.x.x <= 8.7.26 and 9.x.x <= 9.5.7 Multiple Vulnerabilities
TYPO3 is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:typo3:typo3"; if description...
TYPO3 9.4.x <= 9.5.7 Insecure Deserialization Vulnerability in Third Party Component
It has been discovered that a third party dependency used by TYPO3 is susceptible of being used during insecure deserialization. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
Unspecified Vulnerability in Magento (CNVD-2020-52454)
Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engine and payment gateway and other functions. A security vulnerability exists in Magento Open Source versions prior to 1.9.4.2 and Magento Commerce versions prio...
Ruby on Rails Active Storage Insecure Deserialization (CVE-2019-5420)
An insecure deserialization vulnerability exists in Ruby on Rails' ActiveStorage component. Successful exploitation of this vulnerability could allow a remote authenticated attacker with at least author-level privileges to execute arbitrary code on the affected system...
Insecure Deserialization in TYPO3 CMS
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-020...
Insecure Deserialization in TYPO3 CMS
It has been discovered that FormEngine and DataHandler are vulnerable to insecure deserialization. A valid backend user account is needed in order to exploit this vulnerability...
Joomla! < 3.9.6 Phar Stream Wrapper Vulnerability
Joomla! is prone to a protection bypass vulnerability of the Phar Stream Wrapper Interceptor. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only C...
Deserialization of untrusted data
Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component...
CVE-2019-12241
The Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-cartsguru-event-handler.php...
CVE-2019-12240
The Virim plugin 0.4 for WordPress allows Insecure Deserialization via svalues, tvalues, or cvalues in graph.php...
CVE-2019-12240
The Virim plugin 0.4 for WordPress allows Insecure Deserialization via svalues, tvalues, or cvalues in graph.php...