Node.JS - 'node-serialize' Remote Code Execution (3)

Exploit Title: Node.JS - 'node-serialize' Remote Code Execution 3 Date: 17.06.2021 Exploit Author: Beren Kuday GORUN Vendor Homepage: https://github.com/luin/serialize Software Link: https://github.com/luin/serialize Version: 0.0.4 Tested on: Windows & Ubuntu CVE : 2017-5941 var serialize =...

The vulnerability of the deleteFunctions function in the serialize-javascript application library of Aurora Center is related to errors in code generation. This allows a perpetrator to execute arbitrary code.

The vulnerability of the deleteFunctions function in the serialize-javascript application library of Aurora Center is related to code generation control errors. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

CVE-2021-24226

In the AccessAlly WordPress plugin before 3.5.7, the file "resource/frontend/product/product-shortcode.php" responsible for the accessallyorderform shortcode is dumping serialize$SERVER, which contains all environment variables. The leakage occurs on all public facing pages containing the...

PT-2021-15770

Name of the Vulnerable Software and Affected Versions: AccessAlly versions prior to 3.5.7 Description: The issue is related to the leakage of environment variables due to the dumping of serialize$ SERVER in the resource/frontend/product/product-shortcode.php file. This file is responsible for the...

PT-2021-28199

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow read crash has been reported. The crash involves the hb serialize context t::embed function, specifically with OT::AnchorFormat1,...

Design/Logic Flaw

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on...

Design/Logic Flaw

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who follow...

UBUNTU-CVE-2021-21366

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents. This may lead to unexpect...

PT-2021-28088

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 2 crash has been reported. The crash involves the hb serialize co function and the OT::AnchorMatrix::serialize function with hb...

Node.JS Remote Code Execution

Exploit Title: Node.JS - 'node-serialize' Remote Code Execution 2 Exploit Author: UndeadLarva Software Link: https://www.npmjs.com/package/node-serialize Version: 0.0.4 CVE: CVE-2017-5941 import requests import re import base64 import sys url = 'http://192.168.100.133:8000/' change this payload =...

Node.JS - 'node-serialize' Remote Code Execution (2)

Exploit Title: Node.JS - 'node-serialize' Remote Code Execution 2 Exploit Author: UndeadLarva Software Link: https://www.npmjs.com/package/node-serialize Version: 0.0.4 CVE: CVE-2017-5941 import requests import re import base64 import sys url = 'http://192.168.100.133:8000/' change this payload =...

RUSTSEC-2021-0089 Optional `Deserialize` implementations lacking validation

When activating the non-default feature serialize, most structs implement serde::Deserialize without sufficient validation. This allows breaking invariants in safe code, leading to: Undefined behavior in asstring methods which use std::str::fromutf8unchecked internally. Panics due to failed...

PT-2021-24261 · Raw-Cpuid · Raw-Cpuid

Name of the Vulnerable Software and Affected Versions: raw-cpuid crate versions prior to 9.1.1 Description: The issue arises when the non-default serialize feature is activated, allowing most structs to implement serde::Deserialize without sufficient validation. This can lead to breaking invarian...

OSV-2018-97 Heap-buffer-overflow in CFF::CFF2VariationStore::serialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11713 Crash type: Heap-buffer-overflow READ Crash state: CFF::CFF2VariationStore::serialize writecff2 hbsubsetcff2...

OSV-2018-26 UNKNOWN READ in BEInt<unsigned char, 1>::operator unsigned char

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11351 Crash type: UNKNOWN READ Crash state: BEInt::operator unsigned char OT::DeviceRecord::serialize OT::hdmx::serialize...

PT-2021-27643

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ crash occurred, involving the CFF2VariationStore::serialize function, specifically in the write cff2 and hb subset cff2...

PT-2021-27566

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A crash occurred due to an unknown read issue. The crash state involves the BEInt::operator unsigned char, OT::DeviceRecord::serialize, and...

Cross-Site Scripting

Overview Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements. Recommendation Upgrade to version 2.0.17 or...

GHSA-63Q7-H895-M982 Cross-site Scripting in dompurify

Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements...

Security Bulletin: A security vulnerability in Node.js serialize-javascript affects IBM Cloud Pak for Multicloud Management Managed Service.

Summary A security vulnerability in Node.js serialize-javascript affects IBM Cloud Pak for Multicloud Management Managed Service. Vulnerability Details Third Party Entry: 186585 DESCRIPTION: Node.js serialize-javascript module code execution CVSS Base score: 9.8 CVSS Temporal Score: See:...