581 matches found
CVE-2014-8731
PHPMemcachedAdmin 1.2.2 and earlier is affected by CVE-2014-8731. The vulnerability allows remote code execution through vectors involving serialized data and the last part of the concatenated filename, which can create a file in the webroot. Affected software is PHPMemcachedAdmin (web-based fron...
F5 BIG-IP - PHP vulnerability CVE-2016-7124
ext/standard/varunserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that leads to a 1 destruct call or 2 magic method call...
CVE-2017-5830
Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery scripts...
Design/Logic Flaw
Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery scripts...
CVE-2017-5830
Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery scripts...
CVE-2017-5830
CVE-2017-5830 affects Revive Adserver prior to 4.0.1, where an attacker can execute arbitrary code by sending serialized data in cookies used by delivery scripts. The impact is remote code execution with high severity (per CVSS scores in sources). Affected component: the delivery-script cookies h...
CVE-2017-5830
Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery scripts...
PT-2017-16695
Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 4.0.1 Description The issue allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery scripts. Recommendations For versions prior to 4.0.1, update to version...
PHP zend_hash_destroy Uninitialized Pointer Code Execution (CVE-2017-5340)
An access-of-uninitialized-pointer vulnerability exists in PHP. A remote attacker can exploit this vulnerability by sending crafted serialized data to an affected PHP application. Successful exploitation could result in arbitrary code execution under the context of the target application...
HPE Operations Orchestration Insecure Deserialization (CVE-2016-8519)
An insecure deserialization vulnerability has been reported in HPE Operations Orchestration. The vulnerability is due to the deserialization of untrusted data in several servlets used for backwards compatibility with older API versions. A remote, unauthenticated attacker can exploit this...
SUSE-SU-2017:0534-1 Security update for php7
This update for php7 fixes the following security issues: - CVE-2016-7480: The SplObjectStorage unserialize implementation in ext/spl/splobserver.c in PHP did not verify that a key is an object, which allowed remote attackers to execute arbitrary code or cause a denial of service uninitialized...
CVE-2016-10161
The objectcommon1 function in ext/standard/varunserializer.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service buffer over-read and application crash via crafted serialized data that is mishandled in a finishnesteddata call...
Medium: php70
Issue Overview: The SplObjectStorage unserialize implementation in ext/spl/splobserver.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service uninitialized memory access via crafted serialized data...
Design/Logic Flaw
The objectcommon1 function in ext/standard/varunserializer.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service buffer over-read and application crash via crafted serialized data that is mishandled in a finishnesteddata call...
CVE-2016-10161
The objectcommon1 function in ext/standard/varunserializer.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service buffer over-read and application crash via crafted serialized data that is mishandled in a finishnesteddata call...
CVE-2016-10161
Removed by vendor...
UBUNTU-CVE-2016-10161
The objectcommon1 function in ext/standard/varunserializer.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service buffer over-read and application crash via crafted serialized data that is mishandled in a finishnesteddata call...
PT-2017-4182
Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.6.30 PHP versions 7.0.x prior to 7.0.15 PHP versions 7.1.x prior to 7.1.1 Description The issue is related to a buffer over-read in the object common1 function, allowing remote attackers to cause a denial of service via...