475 matches found
GHSA-Q9HR-3PG4-3JP4 Improper Input Validation in Apache ActiveMQ
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service JMS ObjectMessage object...
Apache Tapestry Unsafe Object Storage
Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to cause a denial of service resource consumption or execute arbitrary code via crafted serialized data...
GHSA-C438-8CVQ-PXXX Apache Tapestry Unsafe Object Storage
Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to cause a denial of service resource consumption or execute arbitrary code via crafted serialized data...
Moodle vulnerable to PHP object injection attacks
The Repositories component in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via serialized data associated with an add-on...
GHSA-FCCF-P8FX-VJJ4 Moodle vulnerable to PHP object injection attacks
The Repositories component in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via serialized data associated with an add-on...
PHP Object Injection Vulnerability in Booking Calendar Plugin
On April 18, 2022, the Wordfence Threat Intelligence team initiated the responsible disclosure process for an Object Injection vulnerability in the Booking Calendar plugin for WordPress, which has over 60,000 installations. We received a response the same day and sent over our full disclosure ear...
The vulnerability of the object_common1 function in the PHP programming language, related to reading beyond the buffer in memory, allows attackers to trigger a service failure.
The vulnerability of the objectcommon1 function in the PHP programming language is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure by using specially created serialized data, which are incorrectly processed...
The vulnerability of the php_zip.c component of the PHP programming language interpreter allows a attacker to execute arbitrary PHP code or cause a service failure.
The vulnerability of the phpzip.c component of the PHP programming language interpreter relates to the use of memory after it is freed. Exploiting this vulnerability allows an attacker to execute arbitrary PHP code or cause a service failure by using specially created serialized data containing a...
The vulnerability of the SPL extension for the PHP programming language allows a hacker to execute arbitrary PHP code.
The vulnerability of the PHP programming language interpreter’s SPL extension relates to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary PHP code using specially created serialized data...
The vulnerability of the ext/snmp/snmp.c component of the PHP programming language interpreter allows a attacker to cause a service failure or potentially have other adverse effects.
The vulnerability of the ext/snmp/snmp.c component of the PHP programming language interpreter is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to cause service interruptions or potentially have other effects through specially created...
The vulnerability of the ext/wddx/wddx.c component of the PHP interpreter allows a attacker to cause a service failure.
The vulnerability of the ext/wddx/wddx.c component of the PHP interpreter is related to the assignment of a null pointer. Exploiting this vulnerability can allow an attacker to cause a service failure by using specially created serialized data in an XML document called wddxPacket...
The vulnerability of the `ext/standard/var_unserializer.c` component in the PHP interpreter’s magic method allows a attacker to cause a service failure or potentially have other adverse effects.
The vulnerability of the ext/standard/varunserializer.c component of the PHP interpreter is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability can allow an attacker to cause service failures or potentially have other adverse effects through specially created...
The vulnerability of the ext/spl/spl_array.c component of the PHP interpreter allows a attacker to cause a service failure or potentially cause other effects.
The vulnerability of the ext/spl/splarray.c component of the PHP interpreter exists due to insufficient checking of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures or potentially have other adverse effects using specially created serialized data...
log4j: Unsafe deserialization flaw in Chainsaw log viewer
A flaw was found in the log4j 1.x chainsaw component, where the contents of certain log entries are deserialized and possibly permit code execution. This flaw allows an attacker to send a malicious request with serialized data to the server to be deserialized when the chainsaw component is run...
log4j: Unsafe deserialization flaw in Chainsaw log viewer
A flaw was found in the log4j 1.x chainsaw component, where the contents of certain log entries are deserialized and possibly permit code execution. This flaw allows an attacker to send a malicious request with serialized data to the server to be deserialized when the chainsaw component is run...
log4j: Unsafe deserialization flaw in Chainsaw log viewer
A flaw was found in the log4j 1.x chainsaw component, where the contents of certain log entries are deserialized and possibly permit code execution. This flaw allows an attacker to send a malicious request with serialized data to the server to be deserialized when the chainsaw component is run...
多款 VMware 产品代码问题漏洞
Vmware vRealize Automation and others are products of Vmware, Inc. vRealize Automation is a management tool that provides self-service, supervised multi-cloud automation. vRealize Automation is a management tool that provides self-service, supervised multi-cloud automation. vRealize Automation is...
多款 VMware 产品代码问题漏洞
Vmware vRealize Automation and others are products of Vmware, Inc. vRealize Automation is a management tool that provides self-service, supervised multi-cloud automation. vRealize Automation is a management tool that provides self-service, supervised multi-cloud automation. vRealize Automation is...
Rockwell Automation Connected Components Workbench 代码问题漏洞
Rockwell Automation Connected Components Workbench is an application software from Rockwell Automation. An automated programming software. Rockwell Automation Connected Components Workbench version 13.00.00 ISaGRAF Workbench versions 6.0 through 6.6.9 and Safety Instrumented Systems Workstation...