CVE-2017-18357

Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction method of the ShopwareControllersBackendProductStream controller, with resultant XXE via instantiation of a SimpleXMLElement object...

CVE-2017-18357

Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction method of the ShopwareControllersBackendProductStream controller, with resultant XXE via instantiation of a SimpleXMLElement object...

CVE-2017-18357

Shopware before 5.3.4 is affected by an XXE via PHP object instantiation in the sort parameter of loadPreviewAction() of the ProductStream backend controller, caused by instantiating SimpleXMLElement. Mitigation: upgrade to Shopware 5.3.4 or newer (per GHSA notes referencing a whitelist patch for...

December 11, 2018—KB4471324 (OS Build 17134.471)

None None...

CVE-2017-3202

The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter methods. The ability to exploit this vulnerability...

CVE-2017-3202

The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter methods. The ability to exploit this vulnerability...

Design/Logic Flaw

The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0 derives class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an...

CVE-2017-3200

The Java implementation of AMF3 deserializers used in GraniteDS, version 3.1.1.G, may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter methods. The ability to exploit this vulnerability depends on the availabili...

CVE-2017-3200

CVE-2017-3200 concerns GraniteDS’s AMF3 deserializers. The Java AMF3 implementation in GraniteDS 3.1.1.GA can instantiate arbitrary classes via public no-arg constructors and invoke JavaBeans setters during deserialization, enabling remote attackers to execute arbitrary code if affected classes a...

CVE-2017-3202 The implementation of Action Message Format (AMF3) deserializers in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes due to improper code control

The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter methods. The ability to exploit this vulnerability...

Moodle Design Vulnerability (CNVD-2018-10647)

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment, developed by Dr. Martin Dougiamas of Australia. A security vulnerability exists in the Moodle 3.x version. By replacing the URL in the...

Unauthorized Instantiation And Denial Of Service (DoS)

Moodle is vulnerable to unauthorized instantiation and denial of service DoS. The authenticated user is allowed to instantiate any class just by changing URLs in portfolios. Guest users can also launch DoS using this flaw...

UBUNTU-CVE-2018-1137

An issue was discovered in Moodle 3.x. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by users who are logged in as guests to create a DDoS attack...

Code injection

An issue was discovered in Moodle 3.x. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by users who are logged in as guests to create a DDoS attack...

CVE-2018-1137

An issue was discovered in Moodle 3.x. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by users who are logged in as guests to create a DDoS attack...

CVE-2018-1137

CVE-2018-1137 affects Moodle 3.x. The issue arises when URLs in portfolios are substituted, allowing an attacker to instantiate any class. This can be exploited by users logged in as guests to launch a DDoS attack. Publicly documented details describe the vulnerability mechanism and impact; no re...

RHEL 6 : chromium-browser (RHSA-2018:0334)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2018:0334 advisory. Chromium is an open-source web browser, powered by WebKit Blink. This update upgrades Chromium to version 64.0.3282.167. Security Fixes:...

OPENSUSE-SU-2018:0453-1 Security update for chromium

This update for chromium to version 64.0.3282.167 fixes the following issue: CVE-2018-6056: Incorrect derived class instantiation in V8 bsc1080920...

kernel: local privesc in key management

A flaw was found in the Linux kernel's key management system where it was possible for an attacker to escalate privileges or crash the machine. If a user key gets negatively instantiated, an error code is cached in the payload area. A negatively instantiated key may be then be positively...

kernel: local privesc in key management

A flaw was found in the Linux kernel's key management system where it was possible for an attacker to escalate privileges or crash the machine. If a user key gets negatively instantiated, an error code is cached in the payload area. A negatively instantiated key may be then be positively...