Remote Code Execution (RCE)

jackson-databind is vulnerable to remote code execution. The vulnerability exists as an unsafe deserializatino flaw due to the lack of sanitization of net.sf.ehcache.transaction.manager.selector.GenericJndiSelector, or net.sf.ehcache.transaction.manager.selector.GlassfishSelector classes when...

Security Bulletin: IBM Data Server Driver for JDBC and SQLJ is affected by a 3RD PARTY Unsafe deserialization

Summary Unsafe deserialization in DB2 JDBC driver Vulnerability Details CVEID: CVE-2017-1677 DESCRIPTION: IBM Data Server Driver for JDBC and SQLJ IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 deserializes the contents of /tmp/connlicj.bin which leads to object injection and...

CVE-2019-17358

Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the P...

CVE-2019-17358

Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the P...

Memory corruption

Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the P...

UBUNTU-CVE-2019-17358

Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the P...

CVE-2019-17358

Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the P...

CVE-2019-17358

Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the P...

CVE-2019-17358

Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the P...

CVE-2019-17358

Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the P...

Debian: Security Advisory (DLA-2032-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2032-1] cacti security update

Package : cacti Version : 0.8.8b+dfsg-8+deb8u8 CVE ID : CVE-2019-17358 It was discovered that there was unsafe deserialisation issue in cacti, server monitoring system system. Unsafe deserialisation of objects which can lead to abuse of the application logic, deny service or even execute arbitrar...

jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.*

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the log4j-extra gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...

CVE-2019-19230

An unsafe deserialization vulnerability exists in CA Release Automation Nolio 6.6 with the DataManagement component that can allow a remote attacker to execute arbitrary code...

CVE-2019-19230

CVE-2019-19230 affects CA Release Automation (Nolio) 6.6 – DataManagement component . It is an insecure/deserialization vulnerability that allows a remote attacker to execute arbitrary code. The issue is documented with a CRITICAL (CVSS v3.1 9.8) impact and a high-severity network-exposed vector....

PT-2019-15786

Name of the Vulnerable Software and Affected Versions CA Release Automation Nolio version 6.6 Description An issue exists due to unsafe deserialization in the DataManagement component, allowing a remote attacker to execute arbitrary code. Recommendations For CA Release Automation Nolio version 6....

Arbitrary Code Execution

odata-client-proxy is vulnerable to arbitrary code execution. The vulnerability exists as the classes that were deserialized were not checked in AbstractService, allowing unsafe deserialization that can lead to arbitrary code execution...

GHSA-QHRX-HCM6-PMRW Unsafe deserialization in SmtpTransport in CakePHP

An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction...

jackson-databind: Serialization gadgets in org.apache.commons.dbcp.datasources.*

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the commons-dbcp gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...

jackson-databind: Serialization gadgets in classes of the ehcache package

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the ehcache gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or Id.MINIMALCLA...