CVE-2019-16891

Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload...

PT-2019-14848 · Liferay · Liferay Portal

Name of the Vulnerable Software and Affected Versions: Liferay Portal CE version 6.2.5 Description: The issue allows remote command execution due to deserialization of a JSON payload. Recommendations: For Liferay Portal CE version 6.2.5, update to a version that includes a fix for this issue, as...

CVE-2019-16891

Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload...

Remote Code Execution Via JSON Deserialization

jodd-json is vulnerable to remote code execution via JSON deserialization. The JSON parser supports polymorphic deserialization when setClassMetadataName is set, which allows an attacker to execute arbitrary code using a crafted JSON request...

Arbitrary Code Execution

cryo is vulnerable to arbitrary code execution attacks. The attacks is possible when a JSON is deserialised into an object and the JSON contains a function, allowing a malicious user with access to the JSON to execute arbitrary code through the deserialization of the function...

CVE-2017-9785

Csrf.cs in NancyFX Nancy before 1.4.4 and 2.x before 2.0-dangermouse has Remote Code Execution via Deserialization of JSON data in a CSRF Cookie...

CVE-2017-9785

Csrf.cs in NancyFX Nancy before 1.4.4 and 2.x before 2.0-dangermouse has Remote Code Execution via Deserialization of JSON data in a CSRF Cookie...

Deserialization of untrusted data

IdeaBlade Breeze Breeze.Server.NET before 1.6.5 allows remote attackers to execute arbitrary code, related to use of TypeNameHandling in JSON deserialization...

CVE-2017-9424

IdeaBlade Breeze Breeze.Server.NET before 1.6.5 allows remote attackers to execute arbitrary code, related to use of TypeNameHandling in JSON deserialization...

CVE-2017-9424

IdeaBlade Breeze Breeze.Server.NET before 1.6.5 allows remote attackers to execute arbitrary code, related to use of TypeNameHandling in JSON deserialization...

CVE-2017-9424

IdeaBlade Breeze Breeze.Server.NET before 1.6.5 allows remote attackers to execute arbitrary code, related to use of TypeNameHandling in JSON deserialization...

CVE-2017-9424

IdeaBlade Breeze Breeze.Server.NET prior to v1.6.5 is affected. The vulnerability arises from JSON deserialization using TypeNameHandling, enabling remote code execution. Impact is remote code execution with partial/high integrity and availability impacts. A fix is not provided in the description...