CVE-2022-3525

CVE-2022-3525 describes a vulnerability in the LibreNMS project (librenms/librenms) before version 22.10.0, caused by deserialization of untrusted data. The Red Hat, CNVD, CNNVD, GHSA, OSV, NVD, and CVE listings confirm this issue across multiple ecosystems, with the core impact described as seve...

CVE-2022-3525: Deserialization of Untrusted Data

Deserialization of Untrusted Data in GitHub repository librenms/librenms prior to 22.10.0...

CVE-2022-3525 Deserialization of Untrusted Data in librenms/librenms

Deserialization of Untrusted Data in GitHub repository librenms/librenms prior to 22.10.0...

Deserialization Of Untrusted Data

Apache Mina SSHD is vulnerable to Deserialization Of Untrusted Data. The vulnerability exists in SimpleGeneratorHostKeyProvider.java due to using Java deserialization to load a serialized java.security.PrivateKey which allows an attacker to execute arbitrary code...

CVE-2022-45077: Deserialization of Untrusted Data

Auth. subscriber+ PHP Object Injection vulnerability in Betheme theme = 26.5.1.4 on WordPress...

Deserialization of untrusted data

Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD = 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys ...

Deserialization Of Untrusted Data

jena-sdb is vulnerable to deserialization of untrusted data. The vulnerability exists when the attacker is able to control the JDBC url or cause the underlying database server to return malicious data, leading to remote code execution when connected to a malicious database...

Deserialization Of Untrusted Data

soap is vulnerable to untrusted data deserialization. The vulnerability exists due to lack of authentication in RPCRouterServlet which allows an attacker to execute arbitrary code in to the system...

Exploit for Deserialization of Untrusted Data in Apache Dubbo

CVE-2021-25641 A Exploit Tool For CVE-2021-25641. All depende...

Deserialization Of Untrusted Data

org.drools:drools-compiler is vulnerable to deserialization of untrusted data. The vulnerability exists due to lack of serialization in multiple functions in CompositeKnowledgeBuilderImpl.java and KnowledgeBuilderImpl.java which allows an attacker to execute arbitrary malicious code on the system...

Siemens SINEC Network Management System Logback Component

1. EXECUTIVE SUMMARY CVSS v3 6.6 ATTENTION: Exploitable remotely Vendor: Siemens Equipment: SINEC NMS Vulnerability: Deserialization of Untrusted Data 2. RISK EVALUATION Successful exploitation of this vulnerability could allow attackers with write access to the logback configuration file to...

CVE-2022-43567: Deserialization of Untrusted Data

In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system commands remotely through the use of specially crafted requests to the mobile alerts feature in the Splunk Secure Gateway app...

jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection

A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the extend function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with...

PT-2022-6646 · Vmware · Vmware Aria Operations For Networks

Name of the Vulnerable Software and Affected Versions: VMware Aria Operations for Networks affected versions not specified Description: The issue is related to a deserialization vulnerability in VMware Aria Operations for Networks. This vulnerability can be exploited by a remote attacker to execu...

Deserialization of untrusted data

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-Gateway service port without proper verification. An attacker could provide malicious serialized objects to execute arbitrary code upon deserialization...

CVE-2022-41779: Deserialization of Untrusted Data

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize network packets without proper verification. If the device connects to an attacker-controlled server, the attacker could send maliciously crafted packets that would be deserialized and executed, leading to remote...

CVE-2022-3380: Deserialization of Untrusted Data

The Customizer Export/Import WordPress plugin before 0.9.5 unserializes the content of an imported file, which could lead to PHP object injection issues when an admin imports intentionally or not a malicious file and a suitable gadget chain is present on the blog...

CVE-2022-3366: Deserialization of Untrusted Data

The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2 unserializes the content of imported files, which could lead to PHP object injection attacks by administrators, on multisite WordPress configurations. Successful exploitation i...

PT-2022-26069 · Delta Electronics · Infrasuite Device Master

Name of the Vulnerable Software and Affected Versions: Delta Electronics InfraSuite Device Master versions 00.00.01a and prior Description: The issue allows remote code execution due to deserialization of untrusted data. If the device connects to an attacker-controlled server, the attacker could...

Delta Industrial Automation InfraSuite Device Master Device-Gateway Service Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Industrial Automation InfraSuite Device Master. Authentication is not required to exploit this vulnerability. The specific flaw exists exists within the Device-Gateway service, which listens on...