Important: Red Hat Security Advisory: swiftonfile security update

An updated swiftonfile package that fixes one security issue is now available for Red Hat Gluster Storage 3.1 for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which give...

swiftonfile: use of insecure Python pickle for metadata serialization and storage

A flaw was found in the way swiftonfile gluster-swift serialized and stored metadata on disk by using Python's pickle module. A remote, authenticated user could use this flaw to execute arbitrary code on the storage node...

CVE-2014-3699

eDeploy has RCE via cPickle deserialization of untrusted data...

Django任意代码执行

SECRETKEY作用 SECTETKEY在djanog中使用非常广泛，基本上涉及到安全，加密等的地方都用到了，下面列举一些常见情景： 1，json object的签名 2，加密函数，如密码重置，表单，评论，csrf的key，session数据 这里面就要重点讲到session的问题，在这里使用不当就会导致代码执行 代码执行 settings的session设置 django默认存储session到数据库中，但是可能会比较慢，就会使用到缓存，文件，还有cookie等方式，如果采用了cookie机制则有可能代码执行，settings配置如下： SESSIONENGINE =...

check-mk: multiple flaws fixed in versions 1.2.4p4 and 1.2.5i4

The wato component in CheckMK before 1.2.4p4 and 1.2.5 before 1.2.5i4 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, related to an automation URL...

CVE-2015-0693

Cisco Web Security Appliance WSA devices with software 8.5.0-ise-147 do not properly restrict use of the pickle Python module during certain tunnel-status checks, which allows local users to execute arbitrary Python code and gain privileges via a crafted pickle file, aka Bug ID CSCut39259...

CVE-2015-0693

Cisco Web Security Appliance WSA devices with software 8.5.0-ise-147 do not properly restrict use of the pickle Python module during certain tunnel-status checks, which allows local users to execute arbitrary Python code and gain privileges via a crafted pickle file, aka Bug ID CSCut39259...

Cisco Web Security Appliance Python File Processing Privilege Escalation Vulnerability

A vulnerability in the status-checking process of remote access tunnels for supporting Cisco Web Security Appliances WSA could allow an authenticated, local attacker to execute arbitrary Python code on the affected system. The vulnerability is due to improper usage and handling of the pickle Pyth...

Cisco Web Security Appliance (WSA) Local Arbitrary Python Code Execution Vulnerability

The Cisco Adaptive Security Appliance is an adaptive security appliance that provides modules for security and VPN services. A security vulnerability exists in the Cisco Web Security Appliance WSA that allows a local attacker to execute arbitrary Python code via specially crafted serialized objec...

Cisco Web Security Appliance Pickle Python Module Arbitrary Code Execution Vulnerability

A vulnerability in the status checking process of support remote access tunnels in the Cisco Web Security Appliance WSA could allow an authenticated, local attacker to execute arbitrary Python code on a targeted system. The vulnerability is due to improper use and handling of the pickle Python...

PT-2018-4213 · Python · Rope +1

Name of the Vulnerable Software and Affected Versions: CPython affected versions not specified Description: The issue allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load in the Rope library. This is due to a problem in the base/oi/doa.py file...

CVE-2014-8165

scripts/amsvis/powerpcAMS/amsnet.py in powerpc-utils-python uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object...

Code injection

scripts/amsvis/powerpcAMS/amsnet.py in powerpc-utils-python uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object...

CVE-2014-8165

scripts/amsvis/powerpcAMS/amsnet.py in powerpc-utils-python uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object...

CVE-2014-8165

scripts/amsvis/powerpcAMS/amsnet.py in powerpc-utils-python uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object...

PT-2015-4023 · Python +1 · Powerpc-Utils-Python +1

Name of the Vulnerable Software and Affected Versions: powerpc-utils-python affected versions not specified Description: The issue arises from the unsafe use of the pickle Python module in the amsnet.py script, allowing remote attackers to execute arbitrary code via a crafted serialized object...

Python-Pickle-Class-Constructor

Python is an open source, object oriented programming language. The Python Pickle module is provided to convert object variables into a serialized form "pickling", and later recover the data back into an object hierarchy "unpickling". A vulnerability has been reported in the Pickle implementation...

Zenoss Core Version Check Remote Code Execution (CVE-2014-6261)

A remote code execution vulnerability exists in the Zenoss Core Application. The vulnerability is due to unpickling of potentially unsafe Python pickle serialized object when checking for software updates from the Zenoss home server. A remote attacker can exploit this vulnerability. Successful...

DEBIAN-CVE-2014-0485

S3QL 1.18.1 and earlier uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object in 1 common.py or 2 local.py in backends/...

CVE-2014-0485

S3QL 1.18.1 and earlier uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object in 1 common.py or 2 local.py in backends/...