PT-2023-12727 · Litedb · Litedb

Name of the Vulnerable Software and Affected Versions: LiteDB versions prior to 5.0.13 Description: The issue concerns the deserialization of untrusted data in LiteDB, a .NET NoSQL embedded database. When instances of an object are not the same class, BsonMapper uses a special field type string...

SUSE CVE-2010-3568

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.227 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from...

The vulnerability of the vRealize Log Insight log management tool, related to the restoration of unreliable data in memory, allows a intruder to trigger a service failure.

The vulnerability of the vRealize Log Insight log management tool is related to the restoration of unreliable data in memory. Exploiting this vulnerability can allow a malicious actor to cause a service failure due to the deserialization of unreliable data...

CVE-2023-25558 Deserialization of untrusted data in DataHub

DataHub is an open-source metadata platform. When the DataHub frontend is configured to authenticate via SSO, it will leverage the pac4j library. The processing of the idtoken is done in an unsafe manner which is not properly accounted for by the DataHub frontend. Specifically, if any of the...

CVE-2023-24997 Apache InLong: Jdbc Connection Security Bypass

Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick https://github.com/apache/inlong/pull/7223...

CVE-2022-41596

The system tool has inconsistent serialization and deserialization. Successful exploitation of this vulnerability will cause unauthorized startup of components...

CVE-2021-38241

CVE-2021-38241 describes a deserialization vulnerability in Ruoyi prior to 4.6.1 that allows remote code execution via a weak cipher in the Shiro framework. The issue is triggered during deserialization of untrusted data, enabling attackers to run arbitrary code on affected systems. The CVSS v3.1...

replicator vulnerable to Deserialization of Untrusted Data

A deserialization issue discovered in inikulin replicator before 1.0.4 allows remote attackers to run arbitrary code via the fromSerializable function in TypedArray object...

CVE-2021-33420

A deserialization issue discovered in inikulin replicator before 1.0.4 allows remote attackers to run arbitrary code via the fromSerializable function in TypedArray object...

CVE-2021-33420

The CVE-2021-33420 issue affects the inikulin replicator prior to 1.0.4, where deserialization in the TypedArray fromSerializable function allows remote attackers to execute arbitrary code. Impact is described as remote code execution with high severity; versions before 1.0.4 are vulnerable. Reme...

PT-2022-16239 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.6 GitHub Enterprise Server version 3.5.3 GitHub Enterprise Server version 3.4.6 GitHub Enterprise Server version 3.3.11 GitHub Enterprise Server version 3.2.16 Description: A deserialization of...

PT-2022-3927 · Rockwell Automation · Isagraf Workbench

Name of the Vulnerable Software and Affected Versions: Rockwell Automation ISaGRAF Workbench versions 6.0 through 6.6.9 Description: The issue is related to the deserialization of untrusted data, where the ISaGRAF Workbench software does not limit the objects that can be deserialized. This allows...

PT-2022-22983 · Inductive Automation · Inductive Automation Ignition

Name of the Vulnerable Software and Affected Versions: Inductive Automation Ignition version 8.1.15 b2022030114 Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a...

The vulnerability of the categoryId parameter in the WWebView component of the MCE Systems mobile device lifecycle management system allows attackers to enhance their privileges.

The vulnerability of the categoryId parameter in the WWebView component of the MCE Systems lifecycle management system is related to errors in link processing before accessing a file, as well as deserialization of the PendingDynamicLinkData structure from the Intent Extra array with the key...

EulerOS 2.0 SP3 : log4j (EulerOS-SA-2022-1744)

According to the versions of the log4j package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j...

Metasploit Framework user exposes Metasploit to same deserialization issue that is exploited by that module

By launching the drbremotecodeexec exploit, a Metasploit Framework user will inadvertently expose Metasploit to the same deserialization issue that is exploited by that module, due to the reliance on the vulnerable Distributed Ruby class functions. Since Metasploit Framework typically runs with...

GHSA-HJR4-FHGP-23G9 qlib Deserialization of Untrusted Data vulnerability

This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function...

Oracle Linux 6 : log4j (ELSA-2022-9419)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9419 advisory. - Fix CVE-2022-23302, CVE-2022-23305, CVE-2022-23307, CVE-2017-5645 Tenable has extracted the preceding description block directly from the Oracle Linu...

PT-2022-20312 · Laravel +1 · Laravel +1

Name of the Vulnerable Software and Affected Versions: Laravel version 9.1.8 Description: The issue allows Remote Code Execution via an unserialize pop chain in the destruct method of GuzzleHttpCookieFileCookieJar.php when processing attacker-controlled data for deserialization. Recommendations:...

AlmaLinux 8 : parfait:0.5 (ALSA-2022:0290)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:0290 advisory. log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender CVE-2022-23305 log4j: Unsafe deserialization flaw in Chainsaw log...