1980 matches found
PT-2019-9785 · Openmrs · Openmrs
Name of the Vulnerable Software and Affected Versions: OpenMRS versions prior to 2.24.0 Description: The issue allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body. This is due to an Insecure Object Deserialization vulnerabilit...
Apache Solr Remote Code Execution Vulnerability
Apache Solr is an open source enterprise search platform written in Java. A remote code execution vulnerability exists in Apache Solr versions 5.0.0 - 5.5.5, 6.0.0 - 6.6.5. The vulnerability stems from the Config API allowing configuration of a JMX server via HTTP POST requests. An attacker can...
Oracle WebLogic Server Deployment Service Servlet Insecure Deserialization (CVE-2018-3252)
An insecure deserialization vulnerability exists in the Oracle WebLogic Server Deployment Service . The vulnerability is due to the lack of input validation by the servlet. A successful attack could lead to a remote code execution...
Oracle WebLogic Server Insecure Deserialization (CVE-2018-3245)
An insecure deserialization vulnerability exists in Oracle WebLogic Server. This vulnerability is due to deserialization of untrusted data. Successful exploitation can result in arbitrary code execution...
Zoho ManageEngine OpManager Insecure Deserialization (CVE-2018-19403)
An insecure deserialization vulnerability has been reported in ManageEngine OpManager.The vulnerability is due to deserialization of untrusted data. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
GE MDS PulseNET Insecure Deserialization (CVE-2018-10611)
An insecure deserialization vulnerability has been reported in GE MDS PulseNET and PulseNET Enterprise. The vulnerability is due to deserialization of untrusted data on a JBoss Remoting port. Successful exploitation can result in arbitrary code execution in the context of the user running PulseNE...
Apache Struts 2 Commons FileUpload Insecure Deserialization (CVE-2016-1000031)
An insecure deserialization vulnerability exists in Apache Struts 2. This vulnerability is due to Apache Struts 2 having a dependency on a vulnerable version of Commons FileUpload. Successful exploitation can result in arbitrary file upload within the security context of the target application...
Cisco Unity Express Arbitrary Command Execution Vulnerability
A Java deserialization vulnerability in Cisco Unity Express CUE could allow an unauthenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An...
Apache Struts Remote Code Execution (CVE-2016-1000031)
An insecure deserialization vulnerability has been reported in Apache Struts. This vulnerability is due to deseralization of untrusted data while having the vulnerable version of Apache-Commons-FileUpload library. A remote, unauthenticated attacker can exploit this vulnerability by sending a...
CVE-2016-0750
The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks...
CVE-2018-15691
Insecure deserialization of a specially crafted serialized object, in CA Release Automation 6.5 and earlier, allows attackers to potentially execute arbitrary code...
CVE-2018-15691
Insecure deserialization of a specially crafted serialized object, in CA Release Automation 6.5 and earlier, allows attackers to potentially execute arbitrary code...
CVE-2018-15691
CVE-2018-15691 affects CA Release Automation NiMi 6.5 and earlier. The root cause is insecure deserialization of a crafted serialized object, permitting potential arbitrary code execution. Documents describe a remote command execution vector via deserialization and note PoC exploits using Commons...
CVE-2018-15691
Insecure deserialization of a specially crafted serialized object, in CA Release Automation 6.5 and earlier, allows attackers to potentially execute arbitrary code...
GHSA-38F5-GHC2-FCMV Code Injection in cryo
All versions of cryo are vulnerable to code injection due to an Insecure implementation of deserialization. Proof of concept js var Cryo = require'cryo'; var frozen = '"root":"CRYOREF3","references":"contents":,"value":"CRYOFUNCTIONfunction console.log\"defconrussia\"; return...
cryo code injection vulnerability
cryo is a software package that supports the structuring of data. A code injection vulnerability exists in cryo version 0.0.6, which stems from a failure to securely implement deserialization in the program. An attacker can exploit this vulnerability to arbitrarily execute code...
WordPress Core Phar Insecure Deserialization
An insecure deserialization vulnerability exists in WordPress core. The vulnerability is due to the lack of input validation in PHP phar stream wrapper. Successful exploitation of this vulnerability could allow a remote authenticated attacker with at least author-level privileges to execute...
CVE-2018-3784
A code injection in cryo 0.0.6 allows an attacker to arbitrarily execute code due to insecure implementation of deserialization...
