7901 matches found
PT-2024-10286 · Veritas · Veritas Enterprise Vault
Name of the Vulnerable Software and Affected Versions: Veritas Enterprise Vault versions prior to 15.2 Description: The issue allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized. This is due to insufficient deserializatio...
CVE-2024-6794
A deserialization of untrusted data vulnerability exists in NI VeriStand Waveform Streaming Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabilities affect NI VeriStand 2024 Q2 and prior versions...
Deserialization Of Untrusted Data
H2O is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to unsafe deserialization of any class in Iced models due to a lack of a class whitelist, allowing attackers to use Java gadgets to execute arbitrary code...
CVE-2024-6794 Deserialization of Untrusted Data in NI VeriStand Waveform Streaming Server
A deserialization of untrusted data vulnerability exists in NI VeriStand Waveform Streaming Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabilities affect NI VeriStand 2024 Q2 and prior versions...
CVE-2024-6793 Deserialization of Untrusted Data in NI VeriStand DataLogging Server
A deserialization of untrusted data vulnerability exists in NI VeriStand DataLogging Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabilities affect NI VeriStand 2024 Q2 and prior versions...
CVE-2024-6793 Deserialization of Untrusted Data in NI VeriStand DataLogging Server
A deserialization of untrusted data vulnerability exists in NI VeriStand DataLogging Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabilities affect NI VeriStand 2024 Q2 and prior versions...
CVE-2024-6675 Deserialization of Untrusted Data Vulnerability in NI VeriStand Project File
A deserialization of untrusted data vulnerability exists in NI VeriStand that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects VeriStand 2024 Q2 and prior versions...
CVE-2024-6675 Deserialization of Untrusted Data Vulnerability in NI VeriStand Project File
A deserialization of untrusted data vulnerability exists in NI VeriStand that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects VeriStand 2024 Q2 and prior versions...
CVE-2024-38759
Deserialization of Untrusted Data vulnerability in WP MEDIA SAS Search & Replace search-and-replace.This issue affects Search & Replace: from n/a through 3.2.2...
CVE-2024-38759
Deserialization of Untrusted Data vulnerability in WP MEDIA SAS Search & Replace search-and-replace.This issue affects Search & Replace: from n/a through 3.2.2...
CVE-2024-38759
CVE-2024-38759 is a Deserialization of Untrusted Data vulnerability in the WordPress plugin WP MEDIA SAS Search & Replace (Search & Replace) affecting versions from n/a up to and including 3.2.2. The root cause is deserialization of untrusted data leading to potential compromise. The connected do...
PT-2024-37868 · National Instruments · Ni Veristand
Name of the Vulnerable Software and Affected Versions: NI VeriStand versions prior to 2024 Q2 Description: A deserialization of untrusted data issue exists in the NI VeriStand Waveform Streaming Server, potentially leading to remote code execution. Successful exploitation requires an attacker to...
PT-2024-28200 · WordPress · Wp Media Sas Search & Replace
Name of the Vulnerable Software and Affected Versions: WP MEDIA SAS Search & Replace versions n/a through 3.2.2 Description: The issue is related to Deserialization of Untrusted Data, which affects the Search & Replace plugin. Recommendations: For versions n/a through 3.2.2, update to a version...
GHSA-W36W-948J-XHFW H2O vulnerable to Deserialization of Untrusted Data
The H2O machine learning platform uses "Iced" classes as the primary means of moving Java Objects around the cluster. The Iced format supports inclusion of serialized Java objects. When a model is deserialized, any class is allowed to be deserialized no class whitelist. An attacker can construct ...
SolarWinds Access Rights Manager createGlobalServerChannelInternal Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Access Rights Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the createGlobalServerChannelInternal method. The issue results from th...
TorrentPier Deserialization of Untrusted Data vulnerability
Summary In torrentpier/library/includes/functions.php, gettracks uses the unsafe native PHP serialization format to deserialize user-controlled cookies: https://github.com/torrentpier/torrentpier/blob/84f6c9f4a081d9ffff4c233098758280304bf50f/library/includes/functions.phpL41-L60 PoC One can use...
WordPress Search & Replace plugin <= 3.2.2 - Deserialization of untrusted data vulnerability
Deserialization of untrusted data vulnerability discovered by Trình Vũ / Sonicrrrr from VNPT-VCI Patchstack Alliance in WordPress Plugin Search & Replace versions = 3.2.2...
WordPress Search & Replace Plugin <= 3.2.2 is vulnerable to Deserialization of untrusted data
Software Search & Replace Type Plugin Vulnerable versions = 3.2.2 Fixed in 3.2.3 OWASP Top 10 A3: Injection Classification Deserialization of untrusted data CVE CVE-2024-38759 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID d349741333a6 Credits Trình Vũ Sonicrrrr from...
Important: R
Issue Overview: Deserialization of untrusted data can occur in the R statistical programming language, on any version starting at 1.4.0 up to and not including 4.4.0, enabling a maliciously crafted RDS R Data Serialization formatted file or R package to run arbitrary code on an end user's system...