20 matches found
VulnCheck KEV: CVE-2023-54398
Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doActi...
CVE-2023-54398: Deserialization of Untrusted Data
Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doActi...
CVE-2026-47878
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier...
Unsafe Deserialization
Apache Camel is vulnerable to Unsafe Deserialization. The vulnerability is due to deserialization of untrusted data in FileBasedKeyLifecycleManager using ObjectInputStream.readObject without applying an ObjectInputFilter, where attacker-controlled .key files can trigger execution of malicious cod...
CVE-2026-35337: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject without any class filtering or...
CVE-2025-15222: Deserialization of Untrusted Data
A vulnerability has been found in Dromara Sa-Token up to 1.44.0. This issue affects the function ObjectInputStream.readObject of the file SaSerializerTemplateForJdkUseBase64.java. Such manipulation leads to deserialization. The attack can be executed remotely. This attack is characterized by high...
CVE-2021-41616
Apache DB DdlUtils 1.0 included a BinaryObjectsHelper that was intended for use when migrating database data with a SQL data type of BINARY, VARBINARY, LONGVARBINARY, or BLOB between databases using the ddlutils features. The BinaryObjectsHelper class was insecure and used...
CVE-2021-41616: Deserialization of Untrusted Data
Apache DB DdlUtils 1.0 included a BinaryObjectsHelper that was intended for use when migrating database data with a SQL data type of BINARY, VARBINARY, LONGVARBINARY, or BLOB between databases using the ddlutils features. The BinaryObjectsHelper class was insecure and used...
PT-2021-23359
Name of the Vulnerable Software and Affected Versions Apache DB DdlUtils version 1.0 Description The BinaryObjectsHelper class in Apache DB DdlUtils was insecure and used ObjectInputStream.readObject without validating the input data, making it unsafe to deserialize. This class was intended for...
CVE-2021-33806
The BDew BdLib library before 1.16.1.7 for Minecraft allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as part of its use of Java serialization...
PT-2021-20328
Name of the Vulnerable Software and Affected Versions: BDew BdLib library versions prior to 1.16.1.7 Description: The issue allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as part of its use of Java serialization. Recommendations: For versions...
CVE-2021-33806: Deserialization of Untrusted Data
The BDew BdLib library before 1.16.1.7 for Minecraft allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as part of its use of Java serialization...
CVE-2021-33790
The RebornCore library before 4.7.3 allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as part of reborncore.common.network.ExtendedPacketBuffer. An attacker can instantiate any class on the classpath with any data. A class usable for exploitation...
PT-2021-20319
Name of the Vulnerable Software and Affected Versions: RebornCore library versions prior to 4.7.3 Description: The issue allows remote code execution due to the deserialization of untrusted data in ObjectInputStream.readObject as part of reborncore.common.network.ExtendedPacketBuffer. This enable...
CVE-2021-33790: Deserialization of Untrusted Data
The RebornCore library before 4.7.3 allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as part of reborncore.common.network.ExtendedPacketBuffer. An attacker can instantiate any class on the classpath with any data. A class usable for exploitation...
CVE-2018-18628
An issue was discovered in Pippo 1.11.0. The function SerializationSessionDataTranscoder.decode calls ObjectInputStream.readObject to deserialize a SessionData object without checking the object types. An attacker can create a malicious object, base64 encode it, and place it in the PIPPOSESSION...
CVE-2018-18628
An issue was discovered in Pippo 1.11.0. The function SerializationSessionDataTranscoder.decode calls ObjectInputStream.readObject to deserialize a SessionData object without checking the object types. An attacker can create a malicious object, base64 encode it, and place it in the PIPPOSESSION...
PT-2018-14546
Name of the Vulnerable Software and Affected Versions Pippo version 1.11.0 Description An issue was discovered where the SerializationSessionDataTranscoder.decode function calls ObjectInputStream.readObject to deserialize a SessionData object without checking the object types. This allows an...
CVE-2018-18628: Deserialization of Untrusted Data
An issue was discovered in Pippo 1.11.0. The function SerializationSessionDataTranscoder.decode calls ObjectInputStream.readObject to deserialize a SessionData object without checking the object types. An attacker can create a malicious object, base64 encode it, and place it in the PIPPOSESSION...
