Deserialization of untrusted data

Deserialization of Untrusted Data in the BVMS Mobile Video Service BVMS MVS allows an unauthenticated remote attacker to execute arbitrary code on the system. This affects Bosch BVMS versions 10.0 = 10.0.0.1225, 9.0 = 9.0.0.827, 8.0 = 8.0.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000...

CVE-2020-6770 Deserialization of Untrusted Data in Bosch BVMS Mobile Video Service

Deserialization of Untrusted Data in the BVMS Mobile Video Service BVMS MVS allows an unauthenticated remote attacker to execute arbitrary code on the system. This affects Bosch BVMS versions 10.0 = 10.0.0.1225, 9.0 = 9.0.0.827, 8.0 = 8.0.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000...

CVE-2020-6770

CVE-2020-6770 describes a deserialization of untrusted data in the BVMS Mobile Video Service (BVMS MVS) that allows an unauthenticated remote attacker to execute arbitrary code. Affected are Bosch BVMS versions 10.0.0.1225, 9.0.0.827, 8.0.0.329, and 7.5 and older; it also impacts DIVAR IP 3000/70...

CVE-2020-6770: Deserialization of Untrusted Data

Deserialization of Untrusted Data in the BVMS Mobile Video Service BVMS MVS allows an unauthenticated remote attacker to execute arbitrary code on the system. This affects Bosch BVMS versions 10.0 = 10.0.0.1225, 9.0 = 9.0.0.827, 8.0 = 8.0.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000...

Deserialization of Untrusted Data in Apache Olingo

Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesn't check classes being deserialized. If an attacker can feed malicious metadata to the class, then it may result in running attacker's code in the worse case...

GHSA-GJ76-429M-56WC Deserialization of Untrusted Data in Apache Olingo

Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesn't check classes being deserialized. If an attacker can feed malicious metadata to the class, then it may result in running attacker's code in the worse case...

Denial Of Service (DoS)

MessagePack is vulnerable to denial of service. Untrusted data and deeply nested object graphs can lead to hash collisions and stack overflow that results in an application crash...

PYSEC-2020-35

Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter. By passing a suitably crafted delimiter...

CVE-2020-7471

Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter. By passing a suitably crafted delimiter...

CVE-2020-7471

CVE-2020-7471 affects Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3. The issue is a SQL injection via untrusted data used as a StringAgg delimiter in contrib.postgres.aggregates.StringAgg, which can break escaping and inject SQL. Affected releases include Django’s PostgreSQL...

CVE-2020-7471: Improper Neutralization of Special Elements used in an SQL Command

Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter. By passing a suitably crafted delimiter...

PT-2020-5474

Name of the Vulnerable Software and Affected Versions jackson-databind versions through 2.9.10.4 Description A deserialization flaw was discovered in the jackson-databind library. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core, specifically through...

Deserialization of untrusted data

Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution...

CVE-2020-3716

Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution...

CVE-2020-6770

Deserialization of Untrusted Data in the BVMS Mobile Video Service BVMS MVS allows an unauthenticated remote attacker to execute arbitrary code on the system. This affects Bosch BVMS versions 10.0 = 10.0.0.1225, 9.0 = 9.0.0.827, 8.0 = 8.0.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000...

PT-2020-17699 · Adobe · Magento

Name of the Vulnerable Software and Affected Versions: Magento versions 2.3.3 and earlier Magento versions 2.2.10 and earlier Magento versions 1.14.4.3 and earlier Magento versions 1.9.4.3 and earlier Description: The issue is related to the deserialization of untrusted data, which could lead to...

CVE-2020-3716: Deserialization of Untrusted Data

Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution...

Sql injection

sql.rb in Geocoder before 1.6.1 allows Boolean-based SQL injection when withinboundingbox is used in conjunction with untrusted swlat, swlng, nelat, or nelng data...

Huawei EulerOS: Security Advisory for ruby (EulerOS-SA-2019-2250)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Remote code execution

The following versions of MAXPRO VMS and NVR, MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build 595 T2-Patch, HNMSWVMSLT prior to Version VMS560 Build 595 T2-Patch, MAXPRO NVR: MAXPRO NVR XE prior to Version NVR 5.6 Build 595 T2-Patch, MAXPRO NVR SE prior to Version NVR 5.6 Build 595 T2-Patch,...