CERT/CC Reports R Programming Language Vulnerability

CERT Coordination Center CERT/CC has released information on a vulnerability in R programming language implementations CVE-2024-27322link is external. A cyber threat actor could exploit this vulnerability to take control of an affected system. Users and administrators are encouraged to review the...

RHEL 7 : java-1.8.0-ibm (RHSA-2024:0879)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0879 advisory. IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IBM Java SE ...

WordPress Plugin Link Whisper Free 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

EUVD-2024-28157

Deserialization of Untrusted Data vulnerability in WPDeveloper BetterDocs.This issue affects BetterDocs: from n/a through 3.3.3...

PT-2024-23268 · Armember · Armember

Name of the Vulnerable Software and Affected Versions: ARMember versions n/a through 4.0.26 Description: The issue is related to the deserialization of untrusted data. This is a type of vulnerability where an application accepts data from an untrusted source and deserializes it, potentially...

PT-2024-22685

Name of the Vulnerable Software and Affected Versions Qiskit IBM Runtime versions 0.1.0 through 0.21.1 Description The issue concerns the deserialization of JSON data using qiskit ibm runtime.RuntimeDecoder, which can lead to arbitrary code execution given a correctly formatted input string. This...

Apache Camel Deserialization Vulnerability

Apache Camel is the United States Apache Apache Foundation of a set of open source based on Enterprise Integration Pattern Enterprise Integration Pattern , referred to as EIP integration framework. The framework provides Enterprise Integration Pattern Java objects POJO implementation , and throug...

CVE-2023-46615 WordPress KD Coming Soon Plugin <= 1.7 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in Kalli Dan. KD Coming Soon.This issue affects KD Coming Soon: from n/a through 1.7...

CVE-2024-1353 PHPEMS index.api.php index deserialization

A vulnerability, which was classified as critical, has been found in PHPEMS up to 1.0. Affected by this issue is the function index of the file app/weixin/controller/index.api.php. The manipulation of the argument picurl leads to deserialization. The exploit has been disclosed to the public and m...

CVE-2022-45845 WordPress Smart Slider 3 Plugin <= 3.5.1.9 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in Nextend Smart Slider 3.This issue affects Smart Slider 3: from n/a through 3.5.1.9...

PT-2024-14483 · Unknown · Gecka Terms Thumbnails

Name of the Vulnerable Software and Affected Versions: Gecka Terms Thumbnails versions 1.1 and earlier Description: The issue is related to the deserialization of untrusted data. This can potentially lead to security issues when untrusted data is processed by the application. Recommendations: For...

PT-2024-14473 · Unknown · Html5 Mp3 Player With Playlist Free

Name of the Vulnerable Software and Affected Versions: HTML5 MP3 Player with Playlist Free versions 3.0.0 and earlier Description: The issue is related to the deserialization of untrusted data, which can lead to potential security risks. No information is provided about the estimated number of...

CVE-2023-49442

CVE-2023-49442 concerns JEECG versions 4.0 and earlier where deserialization of untrusted data in the jeecgFormDemoController can lead to arbitrary code execution via a crafted POST request. The available connected sources consistently identify the issue as a deserialization vulnerability affecti...

CVE-2023-50711

vmm-sys-util is a collection of modules that provides helpers and utilities used by multiple rust-vmm components. Starting in version 0.5.0 and prior to version 0.12.0, an issue in the FamStructWrapper::deserialize implementation provided by the crate for vmmsysutil::fam::FamStructWrapper can lea...

CLSA-2023-1703612003 Fix CVE(s): CVE-2022-40433, CVE-2023-22067, CVE-2023-22081

Backport upstream releases 8u392 to 16.04 LTS CVEs fixed in 8u392: - CVE-2023-22067: IOR deserialization issue in CORBA - CVE-2023-22081: Certificate path validation issue Drop applied CVE-2022-40433.patch changes are already in the sources...

PT-2023-31343 · Unknown · Bcorp Shortcodes

Name of the Vulnerable Software and Affected Versions: BCorp Shortcodes versions 0.23 and earlier Description: The issue is related to the deserialization of untrusted data. This can potentially lead to security risks, as deserializing untrusted data can allow an attacker to execute malicious cod...

CVE-2023-46674

CVE-2023-46674 applies to Elastic Elasticsearch-Hadoop, where unsafe deserialization of Java objects from Hadoop or Spark configuration properties that could be modified by an authenticated user enables arbitrary code execution on the target system. The issue is triggered when a local authenticat...

apache-avro: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK

A flaw was found in apache-avro. When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints, leading to an out-of-memory error and a denial of service on the system...

CVE-2023-48967

Ssolon = 2.6.0 and =2.5.12 is vulnerable to Deserialization of Untrusted Data...

PT-2023-30285 · Publiccms · Publiccms

Name of the Vulnerable Software and Affected Versions: PublicCMS version 4.0.202302.e Description: The issue allows a remote attacker to execute arbitrary code via a crafted script to the writeReplace function. This is due to the deserialization of untrusted data. Recommendations: For PublicCMS...