Apache IoTDB: Deserialization of untrusted Data

Summary Apache IoTDB deserializes data from external inputs without sufficient validation, allowing attacker-controlled serialized objects to be processed. In environments where a compatible gadget chain is reachable, this can be abused to execute arbitrary code or alter server state; at minimum ...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the procedure module. An attacker can execute arbitrary code by sending specially crafted procedure files. Details Serialization is a process of converting an object into a sequence of bytes which c...

GHSA-776Q-JW43-FHJX Apache IoTDB: Deserialization of untrusted Data

Summary Apache IoTDB deserializes data from external inputs without sufficient validation, allowing attacker-controlled serialized objects to be processed. In environments where a compatible gadget chain is reachable, this can be abused to execute arbitrary code or alter server state; at minimum ...

PYSEC-2025-88

Deserialization of Untrusted Data vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 2.0.5. Users are recommended to upgrade to version 2.0.5, which fixes the issue...

PYSEC-2025-88

Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 1.0.0 before 2.0.5.Users are recommended to upgrade to version 2.0.5, which fixes the issue...

CVE-2025-48459

Deserialization of Untrusted Data vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 2.0.5. Users are recommended to upgrade to version 2.0.5, which fixes the issue...

CVE-2025-48459 Apache IoTDB: Deserialization of untrusted Data

Deserialization of Untrusted Data vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 2.0.5. Users are recommended to upgrade to version 2.0.5, which fixes the issue...

CVE-2025-48459

CVE-2025-48459 concerns Apache IoTDB, where deserialization of untrusted data could be exploited via attacker-controlled serialized objects. Affected: IoTDB 1.0.0 up to, but not including, 2.0.5. Reports across multiple sources describe potential ability to execute arbitrary code or alter server ...

CVE-2025-48459 Apache IoTDB: Deserialization of untrusted Data

Deserialization of Untrusted Data vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 2.0.5. Users are recommended to upgrade to version 2.0.5, which fixes the issue...

CVE-2025-57350

The connected documents provide concrete details for CVE-2025-57350: The csvtojson package (node module) has a prototype pollution vulnerability in versions before 2.0.10, caused by insufficient sanitization of nested header names in the parser_jsonarray component. Attackers can supply specially ...

PT-2025-39235

Name of the Vulnerable Software and Affected Versions Apache IoTDB versions 1.0.0 through 2.0.4 Description A flaw exists in Apache IoTDB related to the deserialization of untrusted data. This issue could potentially allow for malicious data to be processed, leading to unexpected behavior or...

CVE-2025-57350

The csvtojson package, a tool for converting CSV data to JSON with customizable parsing capabilities, contains a prototype pollution vulnerability in versions prior to 2.0.10. This issue arises due to insufficient sanitization of nested header names during the parsing process in the parserjsonarr...

CVE-2025-57350

The csvtojson package, a tool for converting CSV data to JSON with customizable parsing capabilities, contains a prototype pollution vulnerability in versions prior to 2.0.10. This issue arises due to insufficient sanitization of nested header names during the parsing process in the parserjsonarr...

WordPress TF Woo Product Grid Addon For Elementor Plugin <= 1.0.1 - Deserialization of untrusted data Vulnerability

Deserialization of untrusted data Vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin TF Woo Product Grid Addon For Elementor versions = 1.0.1...

SolarWinds Web Help Desk AjaxProxy Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Web Help Desk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the AjaxProxy class. The issue results from the lack of proper validation of...

CVE-2025-58662

Deserialization of Untrusted Data vulnerability in awesomesupport Awesome Support awesome-support allows Object Injection.This issue affects Awesome Support: from n/a through = 6.3.5...

CVE-2025-57919

Deserialization of Untrusted Data vulnerability in ConveyThis ConveyThis conveythis-translate allows Object Injection.This issue affects ConveyThis: from n/a through = 269.1...

CVE-2025-53465

Deserialization of Untrusted Data vulnerability in raoinfotech GSheets Connector sheetlink allows Object Injection.This issue affects GSheets Connector: from n/a through = 1.1.1...

WordPress Awesome Support plugin <= 6.3.5 - Deserialization of untrusted data vulnerability

Deserialization of untrusted data vulnerability discovered by mcdruid in WordPress Plugin Awesome Support versions = 6.3.5...

CVE-2025-53465

CVE-2025-53465 describes a deserialization of untrusted data vulnerability in the raoinfotech GSheets Connector. This allows Object Injection and affects the GSheets Connector versions from n/a through 1.1.1. The CVSS 3.1 base score is 7.2 (High) with network attack vector, low attack complexity,...