dotPDN Paint.NET 代码问题漏洞

dotPDN Paint.NET is a free image and photo editing software for PCs running Windows from dotPDN, Inc. A security vulnerability exists in dotPDN Paint.NET versions prior to 4.1.2 that stems from allowing deserialization of untrusted data...

CVE-2018-18446

dotPDN Paint.NET before 4.1.2 allows Deserialization of Untrusted Data issue 1 of 2...

dotPDN Paint.NET 代码问题漏洞

dotPDN Paint.NET is a free image and photo editing software for PCs running Windows from dotPDN, Inc. A security vulnerability exists in dotPDN Paint.NET versions prior to 4.1.2 that stems from allowing deserialization of untrusted data...

CVE-2018-18447

CVE-2018-18447 affects Paint.NET (dotPDN Paint.NET) before version 4.1.2. The issue is a deserialization of untrusted data vulnerability (root cause described as deserialization flaw). CVSS v3.1 base score 9.8 (CRITICAL) with network attack vector, no user interaction, and impact on confidentiali...

PT-2022-8039 · Paint.Net · Paint.Net

Name of the Vulnerable Software and Affected Versions: Paint.NET versions prior to 4.1.2 Description: The issue allows deserialization of untrusted data. Recommendations: For versions prior to 4.1.2, update to version 4.1.2 or later to resolve the issue...

PT-2022-8040 · Paint.Net · Paint.Net

Name of the Vulnerable Software and Affected Versions: Paint.NET versions prior to 4.1.2 Description: The issue allows deserialization of untrusted data. Recommendations: For versions prior to 4.1.2, update to version 4.1.2 or later to resolve the issue...

UBUNTU-CVE-2022-3433

The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unordered-containers library by sending specially crafted JSON data, resulting in a denial of service...

com.google.code.gson-gson: Deserialization of Untrusted Data in com.google.code.gson-gson

A flaw was found in gson, which is vulnerable to Deserialization of Untrusted Data via the writeReplace method in internal classes. This issue may lead to availability attacks...

com.google.code.gson-gson: Deserialization of Untrusted Data in com.google.code.gson-gson

A flaw was found in gson, which is vulnerable to Deserialization of Untrusted Data via the writeReplace method in internal classes. This issue may lead to availability attacks...

WordPress String Locator Plugin <= 2.5.0 Deserialization of Untrusted Data Vulnerability

The WordPress plugin Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

Security Bulletin: The IBM® Engineering Requirements Management DOORS/DWA fixes for Log4j vulnerabilities CVE-2021-4104

Summary Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of untrusted data when the attacker has write access to the Log4j configuration. The IBM® Engineering Requirements Management DOORS/DWA product versions 9.6.1.x, 9.7.0.x,...

Deserialization Of Untrusted Data

scala-library is vulnerable to deserialization of untrusted data. The vulnerability exists because the readObject function in the LazyList.scala allows an attacker to erase the contents of arbitrary files, make network connections, or possibly run arbitrary code on Function0 via a gadget chain...

PT-2022-24856 · Unknown · Isolated-Vm

Name of the Vulnerable Software and Affected Versions: isolated-vm versions 4.3.6 and prior Description: The issue allows attackers to bypass the sandbox and run arbitrary code in the nodejs process if untrusted v8 cached data is passed to the API through CachedDataOptions. This can be exploited ...

CVE-2022-39256 Orckestra C1 CMS's deserialization of untrusted data allows for arbitrary code execution.

Orckestra C1 CMS is a .NET based Web Content Management System. A vulnerability in versions prior to 6.13 allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS. Authentication is required to exploit this vulnerability. The authenticated user may perform t...

Deserialization of untrusted data

Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network...

Mageia: Security Advisory (MGASA-2022-0340)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

autogluon.multimodal vulnerable to unsafe YAML deserialization

Impact A potential unsafe deserialization issue exists within the autogluon.multimodal module, where YAML files are loaded via yaml.load instead of yaml.safeload. The deserialization of untrusted data may allow an unprivileged third party to cause remote code execution, denial of service, and...

CVE-2022-23951

In Keylime before 6.3.0, quote responses from the agent can contain possibly untrusted ZIP data which can lead to zip bombs...

CVE-2022-23951

In Keylime before 6.3.0, quote responses from the agent can contain possibly untrusted ZIP data which can lead to zip bombs...

Updated google-gson packages fix security vulnerability

The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace method in internal classes, which may lead to DoS attacks. CVE-2022-25647...