Remote Code Execution (RCE)

Kedro is vulnerable to Remote Code Execution RCE. The vulnerability is due to unsafe deserialization due to the ShelveStore class using Python's shelve module, which relies on pickle for serialization, allowing attackers to craft malicious payloads that execute arbitrary Python code upon...

CVE-2024-9701: Deserialization of Untrusted Data

A Remote Code Execution RCE vulnerability has been identified in the Kedro ShelveStore class version 0.19.8. This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class use...

Remote Code Execution (RCE)

DGL is vulnerable to Remote Code Execution RCE.The vulnerability is due to unsafe deserialization due to the use of Python's pickle module for serializing and deserializing network messages, which can allow attackers to execute arbitrary code remotely...

PT-2026-7636

Name of the Vulnerable Software and Affected Versions DiskCache python-diskcache versions through 5.6.3 Description DiskCache python-diskcache through version 5.6.3 utilizes Python pickle for serialization by default. An attacker who has write access to the cache directory can execute arbitrary...

RCE in Wordnet Browser

Description A user who visits a malicious link with wordnet browser open will execute code on system Proof of Concept Visit http://localhost:8000/lookupgASVKwAAAAAAAACMBXBvc2l4lIwGc3lzdGVtlJOUjBB0b3VjaCAvdG1wL1BXTkVElIWUUpQu The base64 is created from import pickle import sys import base64...

GHSA-M2C7-42RF-C62F Unrestricted Upload of File with Dangerous Type in motionEye

motionEye = 0.42.1 and motioneEyeOS = 20200606 allow a remote attacker to upload a configuration backup file containing a malicious python pickle file. This is possible when an installation is accessible over the Internet and uses no or poor authentication credentials. The GitHub repositories for...

CVE-2021-44255

Authenticated remote code execution in MotionEye = 0.42.1 and MotioneEyeOS = 20200606 allows a remote attacker to upload a configuration backup file containing a malicious python pickle file which will execute arbitrary code on the server...

CVE-2021-44255

Authenticated remote code execution in MotionEye = 0.42.1 and MotioneEyeOS = 20200606 allows a remote attacker to upload a configuration backup file containing a malicious python pickle file which will execute arbitrary code on the server...

CVE-2021-44255

Authenticated remote code execution in MotionEye = 0.42.1 and MotioneEyeOS = 20200606 allows a remote attacker to upload a configuration backup file containing a malicious python pickle file which will execute arbitrary code on the server...

CVE-2021-44255

Authenticated remote code execution in MotionEye = 0.42.1 and MotioneEyeOS = 20200606 allows a remote attacker to upload a configuration backup file containing a malicious python pickle file which will execute arbitrary code on the server...

motionEyeOS and MotionEye-Project MotionEye Access Control Vulnerability

Both motionEyeOS and MotionEye-Project MotionEye are products of Calin Crisan, an individual developer. motionEyeOS is a video surveillance operating system for single-board computers. motionEye-Project MotionEye is a web-based motion front-end. An access control error vulnerability exists in...

CVE-2021-44255: Missing Authentication for Critical Function

Authenticated remote code execution in MotionEye = 0.42.1 and MotioneEyeOS = 20200606 allows a remote attacker to upload a configuration backup file containing a malicious python pickle file which will execute arbitrary code on the server...

Sentry 8.2.0 Remote Code Execution

Exploit Title: Sentry 8.2.0 - Remote Code Execution RCE Authenticated Date: 22/09/2021 Exploit Author: Mohin Paramasivam Shad0wQu35t Vulnerability Discovered By : Clement Berthaux SYNACKTIV Software Link: https://sentry.io/welcome/ Advisory:...

Privilege Escalation

system-config-firewall is vulnerable to privilege escalation. It was found that system-config-firewall used the Python pickle module in an insecure way when sending data via D-Bus to the privileged back-end mechanism. A local user authorized to configure firewall rules using system-config-firewal...

CVE-2019-6446

An issue was discovered in NumPy before 1.16.3. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior that might have...

Arbitrary Code Execution

OpenStack Object Storage swift is vulnerable to arbitrary code execution attack. It unsafely uses python pickle to load and store metadata in memcached,allowing the attacker to execute arbitrary code via a malicious serialized object...

Described in the CTF game found Python deserialization BUG vulnerability flaws-vulnerability warning-the black bar safety net

In the first few days, I had the privilege to join the ToorConCTF（https://twitter.com/toorconctf in addition this event the process of my first time in Python in the invention the sequence of the flaws. In our competition process, there are two provocative touch to be able to perhaps receive the...

Check_MK 1.2.4 < 1.2.4p4 / 1.2.5 < 1.2.5i4 Multiple Vulnerabilities

The version of CheckMK running on the remote web server is 1.2.4 prior to 1.2.4p4 or 1.2.5 prior to 1.2.5i4. It is, therefore, affected by multiple vulnerabilities : - Multiple cross-site script XSS vulnerabilities exist in the multisite component, specifically within the renderstatusicons functi...

swiftonfile: use of insecure Python pickle for metadata serialization and storage

A flaw was found in the way swiftonfile gluster-swift serialized and stored metadata on disk by using Python's pickle module. A remote, authenticated user could use this flaw to execute arbitrary code on the storage node...

Zenoss Core Version Check Remote Code Execution (CVE-2014-6261)

A remote code execution vulnerability exists in the Zenoss Core Application. The vulnerability is due to unpickling of potentially unsafe Python pickle serialized object when checking for software updates from the Zenoss home server. A remote attacker can exploit this vulnerability. Successful...