ICONICS GENESIS64, GENESIS32

1. EXECUTIVE SUMMARY CVSS v3 9.4 ATTENTION: Exploitable remotely Vendor: ICONICS Equipment: GENESIS64, GENESIS32 Vulnerabilities: Out-of-Bounds Write, Deserialization of Untrusted Data, Code Injection 2. RISK EVALUATION Successful exploitation of these vulnerabilities may allow remote code...

Deserialization of Untrusted Data in jackson-databind

Withdrawn: Duplicate of GHSA-cjjf-94ff-43w7...

GHSA-WRR7-33FX-RCVJ Deserialization of Untrusted Data in jackson-databind

Withdrawn: Duplicate of GHSA-cjjf-94ff-43w7...

Remote Code Execution (RCE)

jackson-databind is vulnerable to deserialization of untrusted data that can lead to remote code execution. It is possible because it does not filter the untrusted serialization classes weblogic/oracle-aqjms from interaction between serialization gadgets and typing by default...

CVE-2020-10644

The affected product lacks proper validation of user-supplied data, which can result in deserialization of untrusted data on the Ignition 8 Gateway versions prior to 8.0.10 and Ignition 7 Gateway versions prior to 7.9.14, allowing an attacker to obtain sensitive information...

CVE-2020-12000

The affected product is vulnerable to the handling of serialized data. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data on the Ignition 8 Gateway versions prior to 8.0.10 and Ignition 7 Gateway versions prior to...

Deserialization of untrusted data

The affected product is vulnerable to the handling of serialized data. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data on the Ignition 8 Gateway versions prior to 8.0.10 and Ignition 7 Gateway versions prior to...

CVE-2020-12000

CVE-2020-12000 affects Inductive Automation Ignition Gateway products: Ignition 8 Gateway versions before 8.0.10 and Ignition 7 Gateway versions before 7.9.14. The issue arises from improper validation of user-supplied data, enabling deserialization of untrusted data via serialized-data handling ...

IBM WebSphere Application Server IIOP Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of IBM WebSphere. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the IIOP protocol. The issue results from the lack of proper validation of...

IBM WebSphere Application Server IIOP Deserialization of Untrusted Data Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of IBM WebSphere. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the IIOP protocol. The issue results from the lack of proper...

Deserialization of untrusted data

An issue was discovered in Foxit PhantomPDF before 8.3.7. It allows NTLM credential theft via a GoToE or GoToR action...

Deserialization of untrusted data

An issue was discovered in Foxit Reader and PhantomPDF before 9.2. It allows NTLM credential theft via a GoToE or GoToR action...

Exploit for Deserialization of Untrusted Data in Apache Tomcat

CVE-2020-9484 Reference Authored by redtimmysec, masahiro3...

Deserialization of Untrusted Data

Overview com.alibaba:fastjson is a fast JSON parser/generator for Java. Affected versions of this package are vulnerable to Deserialization of Untrusted Data. Fastjson uses a black and white list method to prevent deserialization vulnerabilities. As a result, when attackers continue to discover n...

Sabberworm PHP CSS Code Injection

Sabberworm PHP CSS parser - Code injection =============================================================================== Identifiers ------------------------------------------------- CVE-2020-13756 CVSSv3 score ------------------------------------------------- 8.6 -...

(Pwn2Own) Inductive Automation Ignition getDiffs Deserialization Of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is not required to exploit this vulnerability. The specific flaw exists with the handling of project diffs. The issue results from the lack of proper...

Exploit for Deserialization of Untrusted Data in Apache Shardingsphere

CVE-2020-1947 ApacheShardingShpereUIYAML解析远程代码执行漏洞复现及分析 概述...

Exploit for Deserialization of Untrusted Data in Fasterxml Jackson-Databind

CVE-20...

Rockwellautomation Factorytalk Deserialization of Untrusted Data

In Rockwell Automation all versions of FactoryTalk Diagnostics software, a subsystem of the FactoryTalk Services Platform, FactoryTalk Diagnostics exposes a .NET Remoting endpoint via RNADiagnosticsSrv.exe at TCPtcp/8082, which can insecurely deserialize untrusted data. File data ot500365.nasl...

Inductive Automation Ignition (Update B)

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Inductive Automation Equipment: Ignition Vulnerabilities: Missing Authentication for Critical Function, Deserialization of Untrusted Data 2. UPDATE INFORMATION This updated advisory is a follow-up...