2201 matches found
Joomla! < 3.9.6 Phar Stream Wrapper Vulnerability
Joomla! is prone to a protection bypass vulnerability of the Phar Stream Wrapper Interceptor. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only C...
Deserialization of untrusted data
Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component...
CVE-2019-12241
The Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-cartsguru-event-handler.php...
CVE-2019-12240
The Virim plugin 0.4 for WordPress allows Insecure Deserialization via svalues, tvalues, or cvalues in graph.php...
CVE-2019-12240
The Virim plugin 0.4 for WordPress allows Insecure Deserialization via svalues, tvalues, or cvalues in graph.php...
CVE-2019-12241
The Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-cartsguru-event-handler.php...
Deserialization of untrusted data
The Virim plugin 0.4 for WordPress allows Insecure Deserialization via svalues, tvalues, or cvalues in graph.php...
CVE-2019-12241
The Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-cartsguru-event-handler.php...
CVE-2019-12241
CVE-2019-12241 affects the Carts Guru WordPress plugin up to version 1.4.5. The Red Hat and NVD records confirm an insecure deserialization flaw triggered by a cartsguru-source cookie that targets classes/wc-cartsguru-event-handler.php, enabling unauthenticated access with high impact. CVSS3 base...
CVE-2019-12240
The Virim plugin 0.4 for WordPress allows Insecure Deserialization via svalues, tvalues, or cvalues in graph.php...
CVE-2019-12240
The CVE-2019-12240 entry concerns the Virim WordPress plugin (version 0.4) with insecure deserialization via s_values, t_values, or c_values in graph.php. Root cause: unsafe deserialization of crafted data in these parameters could enable unauthorized access or code execution, as reflected by CVS...
CVE-2019-12241: Deserialization of Untrusted Data
The Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-cartsguru-event-handler.php...
CVE-2019-12240: Deserialization of Untrusted Data
The Virim plugin 0.4 for WordPress allows Insecure Deserialization via svalues, tvalues, or cvalues in graph.php...
Serious Phar Flaw Allows Arbitrary Code Execution on Drupal
Multiple content management systems – including Drupal, Joomla and Typo3 – are open to a vulnerability that can lead to arbitrary code execution on some systems. The flaw CVE-2019-11831 exists in the phar stream wrapper component used in PHP-driven projects. A Phar archive is used to distribute a...
By-passing protection of Phar Stream Wrapper Interceptor
Insecure deserialization is a vulnerability which occurs when untrusted data is used to abuse the logic of an application. In July 2018, the vulnerability of insecure deserialization when executing Phar archives was addressed by removing the known attack vector in the TYPO3 core. For more details...
By-passing protection of Phar Stream Wrapper Interceptor
Insecure deserialization is a vulnerability which occurs when untrusted data is used to abuse the logic of an application. In July 2018, the vulnerability of insecure deserialization when executing Phar archives was addressed by removing the known attack vector in the TYPO3 core. For more details...
Apache Solr Config API Insecure Deserialization Remote Code Execution (CVE-2019-0192)
An insecure deserialization vulnerability has been reported in Apache Solr. This vulnerability is due to the insufficient validation of requests to the Config API. A remote, unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request to the Config API...
Drupal Core stream wrapper Insecure Deserialization (CVE-2019-6339)
An insecure deserialization vulnerability exists in Drupal Core. The vulnerability is in a stream wrapper when performing file operations. Successful exploitation of this vulnerability could result in arbitrary code execution under the security context of the web server...
[20190502] - Core - By-passing protection of Phar Stream Wrapper Interceptor
In Joomla 3.9.3, the vulnerability of insecure deserialization when executing Phar archives was addressed by removing the known attack vector in the Joomla core. In order to intercept file invocations like fileexists or stat on compromised Phar archives the base name has to be determined and...