CVE-2020-28948

ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked...

CVE-2020-28948

CVE-2020-28948 affects Archive_Tar (PHP PEAR) up to version 1.4.10/1.4.11, where an unserialization flaw occurs because phar: is blocked but PHAR: is not blocked. This can enable write operations via directory traversal when processing crafted archives (documented as a related vulnerability to CV...

CVE-2020-28948

ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked...

CVE-2020-28948

ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked...

CVE-2020-28948: Deserialization of Untrusted Data

ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked...

CVE-2020-28948

ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked. Recent assessments: gwillcox-r7 at January 15, 2021 7:39pm UTC reported: Edit: PoC code for this can be found at along with the original advisory. An interesting vulnerability using the...

PT-2020-6225

Name of the Vulnerable Software and Affected Versions Archive Tar versions 1.4.10 and earlier Description The issue allows an unserialization attack because phar: is blocked but PHAR: is not blocked. This can be exploited by a remote attacker to execute arbitrary PHP code using a specially crafte...

Welcart e-Commerce < 1.9.36 - Authenticated PHP Object Injection

The plugin unserialises via uscesunserialize the content of the uscescookie cookie, which could lead to a PHP Object Injection issue...

Insecure Deserialization of untrusted data

Impact Unserialization of untrusted data. Patches The issue has been patched and users of Requests 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0. References Publications about the vulnerability:...

CVE-2020-15188

SOY CMS 3.0.2.327 and earlier is affected by Unauthenticated Remote Code Execution RCE. The allows remote attackers to execute any arbitrary code when the inquiry form feature is enabled by the service. The vulnerability is caused by unserializing the form without any restrictions. This was fixed...

Remote code execution

SOY CMS 3.0.2.327 and earlier is affected by Unauthenticated Remote Code Execution RCE. The allows remote attackers to execute any arbitrary code when the inquiry form feature is enabled by the service. The vulnerability is caused by unserializing the form without any restrictions. This was fixed...

PT-2020-14259

Name of the Vulnerable Software and Affected Versions SOY CMS versions 3.0.2.327 and earlier Description The issue allows remote attackers to execute arbitrary code when the inquiry form feature is enabled. This is caused by unserializing the form without restrictions. Recommendations For version...

CVE-2020-14933

compose.php in SquirrelMail 1.4.22 calls unserialize for the $attachments value, which originates from an HTTP POST request. NOTE: the vendor disputes this because these two conditions for PHP object injection are not satisfied: existence of a PHP magic method such as wakeup or destruct, and any...

CVE-2020-4043

phpMussel from versions 1.0.0 and less than 1.6.0 has an unserialization vulnerability in PHP's phar wrapper. Uploading a specially crafted file to an affected version allows arbitrary code execution discovered, tested, and confirmed by myself, so the risk factor should be regarded as very high...

CVE-2020-4043

phpMussel from versions 1.0.0 and less than 1.6.0 has an unserialization vulnerability in PHP's phar wrapper. Uploading a specially crafted file to an affected version allows arbitrary code execution discovered, tested, and confirmed by myself, so the risk factor should be regarded as very high...

Code injection

phpMussel from versions 1.0.0 and less than 1.6.0 has an unserialization vulnerability in PHP's phar wrapper. Uploading a specially crafted file to an affected version allows arbitrary code execution discovered, tested, and confirmed by myself, so the risk factor should be regarded as very high...

CVE-2020-4043

phpMussel from versions 1.0.0 and less than 1.6.0 has an unserialization vulnerability in PHP's phar wrapper. Uploading a specially crafted file to an affected version allows arbitrary code execution discovered, tested, and confirmed by myself, so the risk factor should be regarded as very high...

CVE-2020-4043 Phar unserialization vulnerability in phpMussel

phpMussel from versions 1.0.0 and less than 1.6.0 has an unserialization vulnerability in PHP's phar wrapper. Uploading a specially crafted file to an affected version allows arbitrary code execution discovered, tested, and confirmed by myself, so the risk factor should be regarded as very high...

CVE-2020-4043

CVE-2020-4043 affects phpMussel versions 1.0.0 to

PT-2020-17850

Name of the Vulnerable Software and Affected Versions phpMussel versions 1.0.0 through 1.5.x Description The issue is an unserialization vulnerability in PHP's phar wrapper, allowing arbitrary code execution when a specially crafted file is uploaded to an affected version. The risk factor is very...