363 matches found
(0Day) Horde Groupware Webmail Edition Nag display_tasklists Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Horde Groupware Webmail Edition. Authentication is required to exploit this vulnerability. The specific flaw exists within Nag.php. When parsing the displaytasklists parameter, the process does not...
(0Day) Horde Groupware Webmail Edition Kronolith remote_cals Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Horde Groupware Webmail Edition. Authentication is required to exploit this vulnerability. The specific flaw exists within Kronolith.php. When parsing the remotecals parameter, the process does not...
Oracle Business Intelligence AMF Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oracle Business Intelligence. Authentication is not required to exploit this vulnerability. The specific flaw exists within BIRemotingServlet. The issue results from the lack of proper validation of...
CVE-2020-7961
The CVE-2020-7961 issue affects Liferay Portal’s JSONWS deserialization of untrusted data, enabling unauthenticated remote code execution. Vulnerable software is Liferay Portal prior to 7.2.1 CE GA2, where the root cause is unsafe deserialization in JSONWebServiceActionParameters processed via JS...
CVE-2020-10189
Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets. Recent assessments: J3rryBl4nks at March 13, 2020 9:41pm...
Apache Log4j Untrusted Data Deserialization Vulnerability
Apache Log4j is the United States Apache Apache Software Foundation of a Java-based open source logging tools. A security vulnerability exists in Apache Log4j version 1.2. Attackers can exploit the vulnerability to execute code...
CVE-2019-18580
Dell EMC Storage Monitoring and Reporting version 4.3.1 contains a Java RMI Deserialization of Untrusted Data vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by sending a crafted RMI request to execute arbitrary code on the target host...
Deserialization of Untrusted Data
Amendment This was deemed not a vulnerability. Overview parso is a Python parser that supports error recovery and round-trip parsing for different Python versions. Affected versions of this package are vulnerable to Deserialization of Untrusted Data. A deserialization vulnerability exists in the...
IBM Websphere Application Server - Network Deployment Untrusted Data Deserialization Exploit
This Metasploit module exploits untrusted serialized data processed by the WAS DMGR Server and Cells in the IBM Websphere Application Server. NOTE: There is a required 2 minute timeout between attempts as the neighbor being added must be reset. This module requires Metasploit:...
IBM Websphere Application Server - Network Deployment Untrusted Data Deserialization Remote Code Execution (Metasploit)
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'IBM Websphere Application Server Network Deployment Untrusted Data Deserialization Remote Code Execution', 'Description' = % This module exploits...
IBM Websphere Application Server Remote Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'IBM Websphere Application Server Network Deployment Untrusted Data Deserialization Remote Code Execution', 'Description' = % This module exploits...
IBM Websphere Application Server Network Deployment Untrusted Data Deserialization Remote Code Execution
This module exploits untrusted serialized data processed by the WAS DMGR Server and Cells. NOTE: There is a required 2 minute timeout between attempts as the neighbor being added must be reset. Module Options msf use exploit/windows/ibm/ibm/wasdmgrjavadeserializationrce msf...
(0Day) Hewlett Packard Enterprise Intelligent Management Center AMF3 Externalizable Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling AMF3 requests to the amf endpoin...
CVE-2019-0187
Unauthenticated RCE is possible when JMeter is used in distributed mode -r or -R command line options. Attacker can establish a RMI connection to a jmeter-server using RemoteJMeterEngine and proceed with an attack using untrusted data deserialization. This only affect tests running in Distributed...
Adobe ColdFusion untrustworthy data deserialization vulnerability (CNVD-2018-18736)
Adobe ColdFusion is a commercial rapid application development platform. An untrusted data deserialization vulnerability exists in Adobe ColdFusion. A remote user can exploit this vulnerability by sending specially crafted data to execute arbitrary code on the target system...
Adobe ColdFusion untrustworthy data deserialization vulnerability (CNVD-2018-18735)
Adobe ColdFusion is a commercial rapid application development platform. An untrusted data deserialization vulnerability exists in Adobe ColdFusion. A remote user can exploit this vulnerability by sending specially crafted data to execute arbitrary code on the target system...
Adobe ColdFusion untrustworthy data deserialization vulnerability (CNVD-2018-18737)
Adobe ColdFusion is a commercial rapid application development platform. An untrusted data deserialization vulnerability exists in Adobe ColdFusion. A remote user can exploit this vulnerability by sending specially crafted data to execute arbitrary code on the target system...
CVE-2017-11283
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11...
