Remote Code Execution (RCE)

FasterXML jackson-databind is vulnerable to remote code execution RCE. A polymorphic typing issue allows a remote attacker to execute arbitrary code through the JNDI service due to unsafe deserialization of objects related to the apache-log4j-extra classpath...

cacti -- multiple vulnerabilities

The cacti developers reports: When viewing graphs, some input variables are not properly checked SQL injection possible. Multiple instances of lib/functions.php are affected by unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence...

CVE-2018-12549

In Eclipse OpenJ9 version 0.11.0, the OpenJ9 JIT compiler may incorrectly omit a null check on the receiver object of an Unsafe call when accelerating it...

jackson-databind: default typing mishandling leading to remote code execution

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the ehcache and logback JNDI gadgets when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLAS...

jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server.

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the mysql gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or Id.MINIMALCLASS...

Puppet Enterprise < 2016.2.1 Multiple Vulnerabilities

According to its self-reported version number, the Puppet Enterprise application running on the remote host is version prior to 2016.2.1. It is, therefore, affected by the following vulnerabilities : - A remote code execution vulnerability exists in the mcollective puppet-agent plugin due to an...

Puppet Enterprise 2015.x / 2016.x < 2016.4.0 Multiple Vulnerabilities

According to its self-reported version number, the Puppet Enterprise application running on the remote host is version 2015.x or 2016.x prior to 2016.4.0. It is, therefore, affected by the following vulnerabilities : - A cross-site redirection vulnerability exists within the /auth/login script du...

Puppet Enterprise < 2016.4.5 / 2016.5.x / 2017.1.x Multiple Vulnerabilities

According to its self-reported version number, the Puppet install on the remote host is affected by multiple vulnerabilities : - A remote command execution vulnerability exists in the MCollective plugin due to unsafe YAML deserialization. An unauthenticated, remote attacker can exploit this to...

The vulnerability of the PayAction.class.php script of the software controller for centralized control of wireless networks by D-Link Central WiFi Manager CWM(100) allows a hacker to execute arbitrary code.

The vulnerability of the PayAction.class.php script of the software controller for centralized control of wireless networks by D-Link Central WiFi Manager CWM100 is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows an attacker operating...

Arbitrary Code Execution

rediswrapper is vulnerable to arbitrary code execution. The vulnerability exists due to the unsafe usage of pickle deserialization...

Vulnerabilities fixed in Jackson databind

Debian has fixed vulnerabilities in Jackson databind. The vulnerabilities allow a malicious party to execute arbitrary code execute under user privileges and to obtain sensitive data. The vulnerabilities stem from the failure to adequately validate user input prior to the deserialization of an...

D-Link DBA-1510P OS Command Injection Vulnerability (CNVD-2019-36969)

The D-Link DBA-1510P is a wireless access point device from Taiwan, China-based AUO D-Link. An operating system command injection vulnerability exists in the CLI of D-Link DBA-1510P versions using firmware version 1.70b009 and earlier, which can be exploited by an attacker to execute illegal...

GitLab Omnibus 12.2.1 Logrotate Privilege Escalation Vulnerability

Gitlab Omnibus versions 7.4 through 12.2.1 suffer from a privilege escalation vulnerability that leverages a race condition in logrotate, resulting in a root shell. Privilege Escalation via Logrotate in Gitlab Omnibus Overview Target: GitLab Omnibus Vendor: GitLab Version: 7.4 through 12.2.1 Fixe...

CVE-2009-0367

The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the sandbox and execute arbitrary code by using a whitelisted module that imports an unsafe module, then using a hierarchical module name to access the unsafe module through the whitelisted module...

Ruby: Variant of CVE-2013-0269 (Denial of Service and Unsafe Object Creation Vulnerability in JSON)

During my recent keyword argument separation work on rbscanargs in the master branch, I discovered what I now think is a vulnerability. While the CVE-2013-0269 change fixed most usage of JSON.parse, it ended up not fixing KernelJSON. The reason behind this is that internally, in...

The vulnerability of the `my_parse_cookie_if_key_exists` function in the web server of the MOXA EDR-810 industrial router allows a hacker to execute arbitrary code.

The vulnerability of the myparsecookieifkeyexists function offset 0x1B698 on the web server jffs2-root\fs1\magicP\WebServer\webs of the MOXA EDR-810 industrial router arises due to the lack of checking the size of the data being copied into a buffer of 0x40 bytes. Exploiting this vulnerability...

The vulnerability of the my_parse_cookie function in the web server of the MOXA EDR-810 industrial router allows a hacker to execute arbitrary code.

The vulnerability of the myparsecookie function offset 0x1B014 on the web server jffs2-root\fs1\magicP\WebServer\webs of the MOXA EDR-810 industrial router arises due to the lack of checks on the size of the data being copied into a buffer of 0x40 bytes. Exploiting this vulnerability allows an...

jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server.

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the mysql gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or Id.MINIMALCLASS...

jackson-databind: default typing mishandling leading to remote code execution

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the ehcache and logback JNDI gadgets when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLAS...

codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities

A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported for FasterXML jackson-databind by implementing a whitelist...