Remote Code Execution Via JSON Deserialization

jodd-json is vulnerable to remote code execution via JSON deserialization. The JSON parser supports polymorphic deserialization when setClassMetadataName is set, which allows an attacker to execute arbitrary code using a crafted JSON request...

Arbitrary Code Execution

cryo is vulnerable to arbitrary code execution attacks. The attacks is possible when a JSON is deserialised into an object and the JSON contains a function, allowing a malicious user with access to the JSON to execute arbitrary code through the deserialization of the function...

CVE-2017-9785

Csrf.cs in NancyFX Nancy before 1.4.4 and 2.x before 2.0-dangermouse has Remote Code Execution via Deserialization of JSON data in a CSRF Cookie...

CVE-2017-9785

Csrf.cs in NancyFX Nancy before 1.4.4 and 2.x before 2.0-dangermouse has Remote Code Execution via Deserialization of JSON data in a CSRF Cookie...

CVE-2017-9785: Deserialization of Untrusted Data

Csrf.cs in NancyFX Nancy before 1.4.4 and 2.x before 2.0-dangermouse has Remote Code Execution via Deserialization of JSON data in a CSRF Cookie...

CVE-2017-9424

IdeaBlade Breeze Breeze.Server.NET before 1.6.5 allows remote attackers to execute arbitrary code, related to use of TypeNameHandling in JSON deserialization...

CVE-2017-9424

IdeaBlade Breeze Breeze.Server.NET before 1.6.5 allows remote attackers to execute arbitrary code, related to use of TypeNameHandling in JSON deserialization...

Deserialization of untrusted data

IdeaBlade Breeze Breeze.Server.NET before 1.6.5 allows remote attackers to execute arbitrary code, related to use of TypeNameHandling in JSON deserialization...

CVE-2017-9424

IdeaBlade Breeze Breeze.Server.NET before 1.6.5 allows remote attackers to execute arbitrary code, related to use of TypeNameHandling in JSON deserialization...

CVE-2017-9424

IdeaBlade Breeze Breeze.Server.NET before 1.6.5 allows remote attackers to execute arbitrary code, related to use of TypeNameHandling in JSON deserialization...

CVE-2017-9424

IdeaBlade Breeze Breeze.Server.NET prior to v1.6.5 is affected. The vulnerability arises from JSON deserialization using TypeNameHandling, enabling remote code execution. Impact is remote code execution with partial/high integrity and availability impacts. A fix is not provided in the description...

CVE-2017-9424: Deserialization of Untrusted Data

IdeaBlade Breeze Breeze.Server.NET before 1.6.5 allows remote attackers to execute arbitrary code, related to use of TypeNameHandling in JSON deserialization...

PT-2017-18911

Name of the Vulnerable Software and Affected Versions IdeaBlade Breeze Breeze.Server.NET versions prior to 1.6.5 Description The issue allows remote attackers to execute arbitrary code, related to the use of TypeNameHandling in JSON deserialization. Recommendations For versions prior to 1.6.5,...