Insecure Deserialization in Query Generator & Query View

More info at https://typo3.org/security/advisory/typo3-core-sa-2019-026...

Possible Insecure Deserialization in Extbase Request Handling

More info at https://typo3.org/security/advisory/typo3-psa-2019-011...

Possible Insecure Deserialization in Extbase Request Handling

More info at https://typo3.org/security/advisory/typo3-psa-2019-011...

Insecure Deserialization in Query Generator & Query View

It has been discovered that classes QueryGenerator and QueryView are vulnerable to insecure deserialization...

CVE-2019-19849: Deserialization of Untrusted Data

An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the classes QueryGenerator and QueryView are vulnerable to insecure deserialization. One exploitable scenario requires having the system extension ext:lowlevel Backend Module: DB...

Possible Insecure Deserialization in Extbase Request Handling

It has been discovered that request handling in Extbase can be vulnerable to insecure deserialization. User submitted payload has to be signed with a corresponding HMAC-SHA1 using the sensitive TYPO3 encryptionKey as secret - invalid or unsigned payload is not deserialized...

typo3 -- multiple vulnerabilities

Typo3 core team reports: It has been discovered that the output of field validation errors in the Form Framework is vulnerable to cross-site scripting. It has been discovered that t3:// URL handling and typolink functionality are vulnerable to cross-site scripting. Not only regular backend forms...

CA Release Automation DataManagement Insecure Deserialization Vulnerability

CA Release Automation is a suite of enterprise-class release automation solutions from CA USA that enables continuous delivery across the application lifecycle and the ability to streamline and execute application releases, centralize application operations from development to production, oversee...

Adobe ColdFusion Insecure Deserialization (CVE-2019-7091)

An insecure deserialization vulnerability exists in Adobe ColdFusion. This vulnerability is due to the lack of input validation of the JavaAdapter and JavaBeanAdapter classes. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected...

Oracle WebLogic Server AbstractPlatformTransactionManager Insecure Deserialization (CVE-2018-3191)

An insecure deserialization vulnerability has been reported in Oracle WebLogic Server. A remote attacker can exploit this vulnerability by sending a specially crafted serialized object. Successful exploitation can result in arbitrary code execution in the context of the user account running...

CVE-2017-15089

It was found that the Hotrod client in Infinispan would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks...

CVE-2019-12630

A vulnerability in the Java deserialization function used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An...

Deserialization of untrusted data

A vulnerability in the Java deserialization function used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An...

CVE-2019-9365

CVE-2019-9365 corresponds to a Bluetooth deserialization bug in Android 10 that can enable remote code execution with network access and no user interaction. Affected component is Bluetooth deserialization in Android 10; root cause is missing string validation during deserialization, leading to R...

CVE-2019-16894

download.php in inoERP 4.15 allows SQL injection through insecure deserialization...

CVE-2019-16894

download.php in inoERP 4.15 allows SQL injection through insecure deserialization...

Sql injection

download.php in inoERP 4.15 allows SQL injection through insecure deserialization...

CVE-2019-16894

download.php in inoERP 4.15 allows SQL injection through insecure deserialization...

CVE-2019-16894: Improper Neutralization of Special Elements used in an SQL Command

download.php in inoERP 4.15 allows SQL injection through insecure deserialization...

CVE-2019-11666

Insecure deserialization of untrusted data in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploited to allow insecure deserialization of untrusted data...