Code Injection

Overview All versions of cryo are vulnerable to code injection due to an Insecure implementation of deserialization. Proof of concept var Cryo = require'cryo'; var frozen = '"root":"CRYOREF3","references":"contents":,"value":"CRYOFUNCTIONfunction console.log\"defconrussia\"; return...

Arbitrary Code Execution

cryo is vulnerable to arbitrary code execution attacks. The attacks is possible when a JSON is deserialised into an object and the JSON contains a function, allowing a malicious user with access to the JSON to execute arbitrary code through the deserialization of the function...

Node.js third-party modules: Insecure implementation of deserialization in cryo

I would like to report code injection in serialization package cryo It allows execute arbitrary code using custom prototype. Module module name: cryo version: 0.0.6 npm page: https://www.npmjs.com/package/cryo Module Description JSON on steroids. Built for node.js and browsers. Cryo is inspired b...

Code injection

Cryoserver Security Appliance 7.3.x uses weak permissions for /etc/init.d/cryoserver, which allows local users to gain privileges by leveraging access to the support account and running the /bin/cryo-mgmt program...

CVE-2014-4867

Cryoserver Security Appliance 7.3.x uses weak permissions for /etc/init.d/cryoserver, which allows local users to gain privileges by leveraging access to the support account and running the /bin/cryo-mgmt program...

CVE-2014-4867

Cryoserver Security Appliance 7.3.x is affected by a privilege-escalation issue due to weak permissions on the /etc/init.d/cryoserver script. The default support account can modify this script and leverage /bin/cryo-mgmt to gain elevated privileges, potentially yielding root on the device. Techni...