EUVD-2022-1116

Malicious code in bioql PyPI...

GHSA-P5GM-FGFX-HR7H Gadget chain attack in Nippy

A deserialization flaw is present in Taoensso Nippy before 2.14.2. In some circumstances, it is possible for an attacker to create a malicious payload that, when deserialized, will allow arbitrary code to be executed. This occurs because there is automatic use of the Java Serializable interface...

CVE-2020-24164

A deserialization flaw is present in Taoensso Nippy before 2.14.2. In some circumstances, it is possible for an attacker to create a malicious payload that, when deserialized, will allow arbitrary code to be executed. This occurs because there is automatic use of the Java Serializable interface...

Deserialization of untrusted data

A deserialization flaw is present in Taoensso Nippy before 2.14.2. In some circumstances, it is possible for an attacker to create a malicious payload that, when deserialized, will allow arbitrary code to be executed. This occurs because there is automatic use of the Java Serializable interface...

CVE-2020-24164

Taoensso Nippy versions before 2.14.2 are affected by a deserialization flaw that, under certain conditions, allows arbitrary code execution due to automatic use of the Java Serializable interface during deserialization. The Red Hat advisory and related records corroborate a vulnerability in Nipp...

PHP interpreter vulnerabilities that allow attackers to execute arbitrary code

Multiple vulnerabilities in the PHP interpreter are related to the use of memory after it is freed. Exploiting these vulnerabilities allows a remote attacker to execute arbitrary code by interacting with the Serializable interface, the SplObjectStorage class, and the SplDoublyLinkedList class...

Design/Logic Flaw

Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to 1 the Serializable interface, 2 the SplObjectStorage class, and 3 the SplDoublyLinkedList class, which are mishandled...

CVE-2015-6834

Summary: CVE-2015-6834 (and related CVEs 2015-6835, 2015-6836, 2015-6837/6838) are PHP unserialize-related use-after-free and type-confusion vulnerabilities. They affect PHP priors to 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, enabling remote code execution via crafted serialized data ...