5519 matches found
CVE-2022-41958 Deserialization Vulnerability by yaml config input in super-xray
super-xray is a web vulnerability scanning tool. Versions prior to 0.7 assumed trusted input for the program config which is stored in a yaml file. An attacker with local access to the file could exploit this and compromise the program. This issue has been addressed in commit 4d0d5966 and will be...
CVE-2022-3861 Betheme <= 26.5.1.4 - Authenticated (Subscriber+) PHP Object Injection
The Betheme theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 26.5.1.4 via deserialization of untrusted input supplied via the import, mfn-items-import-page, and mfn-items-import parameters passed through the mfnbuilderimport, mfnbuilderimportpage,...
WordPress theme Betheme 代码问题漏洞
WordPress is a blogging platform developed in PHP by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress theme is a theme for WordPress. A deserialization vulnerability exists in WordPress Plugin Betheme them plugin 26.5.1.4 and...
LibreNMS 代码问题漏洞
LibreNMS is an open source network monitoring system based on PHP and MySQL from the LibreNMS community. The system features customizable alerts, auto-discovery of the network environment and automatic updates. A security vulnerability exists in LibreNMS versions prior to 22.10.0 that stems from...
Apache MINA Deserialization Vulnerability
Apache MINA is the United States Apache Apache Foundation of a web application framework. The product is mainly used to develop high-performance and highly scalable web applications. Apache MINA 2.9.1 and earlier versions suffer from a deserialization vulnerability that stems from the use of Java...
AlmaLinux 9 : python3.9 (ALSA-2022:8493)
The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:8493 advisory. - Python 3.9.x and 3.10.x through 3.10.8 on Linux allows local privilege escalation in a non-default configuration. The Python multiprocessing library, when used...
Apache MINA 代码问题漏洞
Apache MINA is the United States Apache Apache Foundation of a web application framework. The product is mainly used to develop high-performance and highly scalable web applications. Apache MINA 2.9.1 and earlier versions suffer from a deserialization vulnerability that stems from the use of Java...
CVE-2022-45047 Apache MINA SSHD: Java unsafe deserialization vulnerability
Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD = 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys ...
DEBIAN-CVE-2022-45136
Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying database server to return malicious data. The mySQL JDBC driver in particular is known to be vulnerable to this class of attack. As a resu...
Exploit for Deserialization of Untrusted Data in Apache Tomcat
CVE-2020-9484Exploit Exploit for Apache Tomcat deserializati...
CVE-2022-38652
A remote insecure deserialization vulnerability exixsts in VMWare Hyperic Agent 5.8.6. Exploitation of this vulnerability enables a malicious authenticated user to run arbitrary code or malware within a Hyperic Agent instance and its host operating system with the privileges of the Hyperic Agent...
CVE-2022-38652
CVE-2022-38652 pertains to VMware Hyperic; remote insecure deserialization affects Hyperic Agent 5.8.6, allowing a malicious authenticated user to run code with Hyperic Agent privileges (often SYSTEM on Windows). Related CVE-2022-38650 affects VMware Hyperic Server 5.8.6 and is unauthenticated. R...
PT-2022-7391 · Siemens +1 · Simatic Step 7 +2
Name of the Vulnerable Software and Affected Versions: SIMATIC PCS neo version 4.0 SIMATIC STEP 7 versions 16 through 17 SIMATIC STEP 7 versions 18 through 18 Update 1 Description: A vulnerability has been identified in the affected applications, which do not properly restrict the .NET...
SAP BusinessObjects BI Platform Deserialization Vulnerability
SAP BusinessObjects BI Platform is a centralized suite for data reporting, visualization, and sharing from SAP, Germany. A deserialization vulnerability exists in SAP BusinessObjects BI Platform versions 4.2, 4.3, which arises from unsafe deserialization of serialized data received by the...
CVE-2022-41203
In some workflow of SAP BusinessObjects BI Platform Central Management Console and BI LaunchPad, an authenticated attacker with low privileges can intercept a serialized object in the parameters and substitute with another malicious serialized object, which leads to deserialization of untrusted...
CVE-2022-41203
In some workflow of SAP BusinessObjects BI Platform Central Management Console and BI LaunchPad, an authenticated attacker with low privileges can intercept a serialized object in the parameters and substitute with another malicious serialized object, which leads to deserialization of untrusted...
SAP BusinessObjects BI Platform 代码问题漏洞
SAP BusinessObjects BI Platform is a centralized suite for data reporting, visualization, and sharing from SAP, Germany. A deserialization vulnerability exists in SAP BusinessObjects BI Platform versions 4.2, 4.3, which arises from unsafe deserialization of serialized data received by the...
CVE-2022-41203
CVE-2022-41203 affects SAP BusinessObjects BI Platform (Central Management Console and BI LaunchPad). An authenticated user with low privileges can trick the application by substituting a serialized parameter with a malicious serialized object, causing deserialization of untrusted data and impact...
PT-2022-6646 · Vmware · Vmware Aria Operations For Networks
Name of the Vulnerable Software and Affected Versions: VMware Aria Operations for Networks affected versions not specified Description: The issue is related to a deserialization vulnerability in VMware Aria Operations for Networks. This vulnerability can be exploited by a remote attacker to execu...