Deserialization of untrusted data

MiR100, MiR200 and other MiR robots use the Robot Operating System ROS default packages exposing the computational graph to all network interfaces, wireless and wired. This is the result of a bad set up and can be mitigated by appropriately configuring ROS and/or applying custom patches as...

Deserialization of untrusted data

A vulnerability was found in Wildfly in versions before 20.0.0.Final, where a remote deserialization attack is possible in the Enterprise Application BeansEJB due to lack of validation/filtering capabilities in wildfly...

Deserialization of untrusted data

A deserialization of untrusted data vulnernerability exists in rails 5.2.4.3, rails 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE...

CVE-2020-8164

A deserialization of untrusted data vulnerability exists in rails 5.2.4.3, rails 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters...

Deserialization of untrusted data

A deserialization of untrusted data vulnerability exists in rails 5.2.4.3, rails 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters...

UBUNTU-CVE-2020-8164

A deserialization of untrusted data vulnerability exists in rails 5.2.4.3, rails 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters...

CVE-2020-8165

CVE-2020-8165 is a deserialization of untrusted data vulnerability in Ruby on Rails, affecting Rails versions prior to 5.2.4.3 and 6.0.3.1. It can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore, potentially leading to remote code execution. The issue is ...

CVE-2020-8165

A deserialization of untrusted data vulnernerability exists in rails 5.2.4.3, rails 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE...

Deserialization of Untrusted Data

A deserialization of untrusted data vulnernerability exists in rails, rails that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE...

GHSA-J823-4QCH-3RGM Deserialization of untrusted data in Jackson Databind

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool aka apache/drill...

GHSA-MC6H-4QGP-37QH Deserialization of untrusted data in Jackson Databind

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory aka org.jsecurity...

Mitsubishi Electric MC Works64, MC Works32

1. EXECUTIVE SUMMARY CVSS v3 9.4 ATTENTION: Exploitable remotely Vendor: Mitsubishi Electric Equipment: MC Works64, MC Works32 Vulnerabilities: Out-of-bounds Write, Deserialization of Untrusted Data, Code Injection 2. RISK EVALUATION Successful exploitation of these vulnerabilities may allow...

ICONICS GENESIS64, GENESIS32

1. EXECUTIVE SUMMARY CVSS v3 9.4 ATTENTION: Exploitable remotely Vendor: ICONICS Equipment: GENESIS64, GENESIS32 Vulnerabilities: Out-of-Bounds Write, Deserialization of Untrusted Data, Code Injection 2. RISK EVALUATION Successful exploitation of these vulnerabilities may allow remote code...

Deserialization of Untrusted Data in jackson-databind

Withdrawn: Duplicate of GHSA-cjjf-94ff-43w7...

GHSA-WRR7-33FX-RCVJ Deserialization of Untrusted Data in jackson-databind

Withdrawn: Duplicate of GHSA-cjjf-94ff-43w7...

Remote Code Execution (RCE)

jackson-databind is vulnerable to deserialization of untrusted data that can lead to remote code execution. It is possible because it does not filter the untrusted serialization classes weblogic/oracle-aqjms from interaction between serialization gadgets and typing by default...

CVE-2020-10644

The affected product lacks proper validation of user-supplied data, which can result in deserialization of untrusted data on the Ignition 8 Gateway versions prior to 8.0.10 and Ignition 7 Gateway versions prior to 7.9.14, allowing an attacker to obtain sensitive information...

CVE-2020-12000

The affected product is vulnerable to the handling of serialized data. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data on the Ignition 8 Gateway versions prior to 8.0.10 and Ignition 7 Gateway versions prior to...

Deserialization of untrusted data

The affected product is vulnerable to the handling of serialized data. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data on the Ignition 8 Gateway versions prior to 8.0.10 and Ignition 7 Gateway versions prior to...

CVE-2020-12000

CVE-2020-12000 affects Inductive Automation Ignition Gateway products: Ignition 8 Gateway versions before 8.0.10 and Ignition 7 Gateway versions before 7.9.14. The issue arises from improper validation of user-supplied data, enabling deserialization of untrusted data via serialized-data handling ...