369 matches found
CVE-2024-11831 Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript
A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by...
CVE-2024-11831
A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by...
Serialize JavaScript 跨站脚本漏洞
Serialize JavaScript is a Yahoo open source serialization of JavaScript into a JSON superset containing regular expressions and functions. A cross-site scripting vulnerability exists in Serialize JavaScript that stems from not properly cleaning certain inputs. An attacker can exploit the...
PT-2025-5668 · Git +1 · Ndpi
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A crash occurred due to a segmentation fault on an unknown address. The crash involved the ndpi serialize string string and ndpi dpi2json functions, and ...
PT-2025-5663 · Oatpp · Oatpp
Name of the Vulnerable Software and Affected Versions: oatpp affected versions not specified Description: The issue is related to a heap-buffer-overflow error. Technical details about the error include the escapeString function, serializeString function, and serializePairs function...
CVE-2024-57900 ila: serialize calls to nf_register_net_hooks()
In the Linux kernel, the following vulnerability has been resolved: ila: serialize calls to nfregisternethooks syzbot found a race in ilaaddmapping 1 commit 031ae72825ce "ila: call nfunregisternethooks sooner" attempted to fix a similar issue. Looking at the syzbot repro, we have concurrent...
npm-serialize-javascript: Cross-site Scripting (XSS) in serialize-javascript
A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by...
PT-2025-5666 · Oatpp · Oatpp
Name of the Vulnerable Software and Affected Versions: oatpp affected versions not specified Description: The issue is related to a heap-buffer-overflow error. Technical details about the error include the escapeUtf8Char and escapeString functions within oatpp::json::Utils, and the serializeStrin...
UBUNTU-CVE-2024-47834
GStreamer is a library for constructing graphs of media-handling components. An Use-After-Free read vulnerability has been discovered affecting the processing of CodecPrivate elements in Matroska streams. In the GSTMATROSKAIDCODECPRIVATE case within the gstmatroskademuxparsestream function, a dat...
Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-779)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-779 advisory. In the Linux kernel, the following vulnerability has been resolved: posix-timers: Ensure timer ID search-loop limit is valid CVE-2023-53728 In the Linux kernel, the following vulnerability has...
Drupal core contains a potential PHP Object Injection vulnerability
Drupal core contains a potential PHP Object Injection vulnerability that if combined with another exploit could lead to Artbitrary File Deletion. It is not directly exploitable. This issue is mitigated by the fact that in order to be exploitable, a separate vulnerability must be present that allo...
PT-2024-16666 · WordPress · Migration
Name of the Vulnerable Software and Affected Versions: Migration, Backup, Staging – WPvivid plugin for WordPress versions up to, and including, 0.9.107 Description: The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted...
CVE-2024-44946
...
CVE-2024-46983
sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blackli...
CVE-2024-46983 Remote Command Execution(RCE) Vulnerbility in sofa-hessian
sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blackli...
PT-2024-32317
Name of the Vulnerable Software and Affected Versions sofahessian versions prior to 3.5.5 Description The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. However, there is a gadget chain that can bypass the SOF...
PT-2025-6048
Name of the Vulnerable Software and Affected Versions npm-serialize-javascript versions up to 6.0.1 Description The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to injec...
Malicious code in ar-json_serialize (RubyGems)
--- -= Per source details. Do not edit below this line.=-...