MindsDB 安全漏洞

MindsDB is an emerging low-code machine learning platform from MindsDB, Inc. A security vulnerability exists in MindsDB version 23.10.2.0 and earlier, which stems from the presence of deserialization of untrusted data, allowing a maliciously uploaded model to run arbitrary code on the server when...

CVE-2024-43931

CVE-2024-43931 is a Deserialization of Untrusted Data vulnerability in JobSearch (WP Job Board) that allows PHP Object Injection in unauthenticated context. The issue affects JobSearch versions up to 2.5.3 and has a high impact profile (CVSS 3.1, base score 9.8, CRITICAL). The connected documents...

CVE-2024-43252 WordPress Crew HRM plugin <= 1.1.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Crew HRM Crew HRM hr-management.This issue affects Crew HRM: from n/a through = 1.1.1...

CVE-2024-7561 The Next <= 1.1.0 - Authenticated (Contributor+) PHP Object Injection

The The Next theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of untrusted input from the wpedenpostmeta post meta value. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject...

SolarWinds Access Rights Manager createGlobalServerChannelInternal Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Access Rights Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the createGlobalServerChannelInternal method. The issue results from th...

Deserialization Of Untrusted Data

ydata-profiling is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to inadequate input validation in the loads function within serializereport.py, resulting in arbitrary code execution when utilizing the load function directly or passing bytes from external sources into...

CVE-2024-4606

Deserialization of Untrusted Data in BdThemes Ultimate Store Kit Elementor Addons CVE-2024-4606 affects Ultimate Store Kit Elementor Addons and related bundles (WordPress plugins) up to version 2.0.3. Root cause: PHP object deserialization in the plugin, leading to potential arbitrary PHP object ...

CVE-2023-50218

Inductive Automation Ignition ModuleInvoke Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is required to exploit this...

CVE-2023-39475

Inductive Automation Ignition ParameterVersionJavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is not requir...

CVE-2024-32603 WordPress WooBuddy plugin <= 3.4.20 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeKraft WooBuddy.This issue affects WooBuddy: from n/a through 3.4.20...

PT-2024-24561 · Unknown · Wp All Import

Name of the Vulnerable Software and Affected Versions: WP All Import Import Users from CSV versions 1.2 and earlier Description: The issue is related to Deserialization of Untrusted Data, which affects the Import Users from CSV functionality. Recommendations: For versions 1.2 and earlier, update ...

CVE-2024-31308

Deserialization of Untrusted Data vulnerability in VJInfotech WP Import Export Lite.This issue affects WP Import Export Lite: from n/a through 3.9.26...

CVE-2024-30222 WordPress ARMember plugin <= 4.0.26 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.26...

CVE-2024-30227 WordPress Geo Controller plugin <= 8.6.4 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in INFINITUM FORM Geo Controller.This issue affects Geo Controller: from n/a through 8.6.4...

PT-2024-23272 · Unknown · Infinitum Form Geo Controller

Name of the Vulnerable Software and Affected Versions: INFINITUM FORM Geo Controller versions n/a through 8.6.4 Description: The issue is related to Deserialization of Untrusted Data, which affects the Geo Controller. Recommendations: For versions n/a through 8.6.4, at the moment, there is no...

PT-2024-23267 · Armember · Armember

Name of the Vulnerable Software and Affected Versions: ARMember versions 4.0.26 and earlier Description: The issue is related to the deserialization of untrusted data. This can potentially lead to security risks. There is no information provided about the estimated number of potentially affected...

PT-2024-12134 · Unknown · Wpeverest User Registration

Name of the Vulnerable Software and Affected Versions: WPEverest User Registration versions through 2.3.2.1 Description: The issue is related to Deserialization of Untrusted Data, which affects the user registration process. Recommendations: For versions through 2.3.2.1, update to a version later...

PT-2024-22182 · Unknown · Propertyhive

Name of the Vulnerable Software and Affected Versions: PropertyHive versions prior to 2.0.10 Description: The issue is related to Deserialization of Untrusted Data. This can potentially lead to security risks if exploited. Recommendations: For versions prior to 2.0.10, update to version 2.0.10 or...

CVE-2024-2721

Deserialization of Untrusted Data vulnerability in Social Media Share Buttons By Sygnoos Social Media Share Buttons.This issue affects Social Media Share Buttons: from n/a through 2.1.0...

PT-2024-19456 · Allegra · Allegra

Name of the Vulnerable Software and Affected Versions: Allegra affected versions not specified Description: The issue concerns a remote code execution vulnerability due to the deserialization of untrusted data in the renderFieldMatch function. Recommendations: At the moment, there is no informati...