CVE-2019-18935

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote...

Deserialization of untrusted data

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote...

Siemens SPPA-T3000 Deserialization Untrusted Data Vulnerability

The SPPA-T3000 is a distributed control system mainly used in thermal power plants and large renewable energy power plants. A security vulnerability exists in the Siemens SPPA-T3000. An attacker could exploit the vulnerability to execute arbitrary code...

CVE-2019-19230

An unsafe deserialization vulnerability exists in CA Release Automation Nolio 6.6 with the DataManagement component that can allow a remote attacker to execute arbitrary code...

The vulnerability of Microsoft Exchange Server’s mail server, related to deficiencies in the deserialization mechanism, allows attackers to execute arbitrary code.

The vulnerability of Microsoft Exchange Server is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

jackson-databind: improper polymorphic deserialization of types from Jodd-db library

A vulnerability was discovered in jackson-databind where it would permit deserialization of a malicious object using Jodd DB connection classes when using DefaultTyping. An attacker could use this flaw to achieve remote code execution under certain circumstances...

The vulnerability of the Config software interface towards the Apache Solr search server allows a hacker to execute arbitrary code.

The vulnerability of the Config software interface of the Apache Solr search server lies in the rehydration of unreliable data in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code on the Solr side through HTTP POST requests after deserialization...

BigTree CMS Deserialization Vulnerability

BigTree CMS is a small open source cms based on PHP and Mysql. BigTree CMS has a deserialization vulnerability that can be exploited by an attacker to gain control of the web server...

CVE-2019-8141

CVE-2019-8141 affects Magento open-source platforms Magento 2.1 (before 2.1.19), Magento 2.2 (before 2.2.10), and Magento 2.3 (before 2.3.3). The issue is a remote code execution via a Phar deserialization vulnerability in the system-level import functionality, exploitable by an authenticated use...

OpenJDK: Unexpected exception thrown during Font object deserialization (Serialization, 8224915)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Serialization. Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via...

codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities

A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported for FasterXML jackson-databind by implementing a whitelist...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.1.18 logging-elasticsearch5 security update

An update for logging-elasticsearch5-container is now available for Red Hat OpenShift Container Platform 4.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

The WebLogic vulnerability and patch analysis-vulnerability warning-the black bar safety net

Earlier this year, researchers found and published the Oracle WebLogic in a deserialization vulnerability. This vulnerability is more serious, so Oracle breaks the normal quarterly release patches practice, specially issued an emergency update. Unfortunately, the researchers soon realized that an...

Deserialization of untrusted data

The java.io.ObjectInputStream is known to cause Java serialisation issues. This issue here is exposed by the "webtools/control/httpService" URL, and uses Java deserialization to perform code execution. In the HttpEngine, the value of the request parameter "serviceContext" is passed to the...

OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Utilities. Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via...

CVE-2019-0344

Due to unsafe deserialization used in SAP Commerce Cloud virtualjdbc extension, versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection...

slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution

An XML deserialization vulnerability was discovered in slf4j's EventData, which accepts an XML serialized string and can lead to arbitrary code execution...

jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis

A vulnerability was discovered in jackson-databind where it would permit deserialization of a malicious object using MyBatis classes when using DefaultTyping. An attacker could use this flaw to achieve content exfiltration and possibly conduct further attacks...

OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Utilities. Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via...

Fastjson deserialization vulnerability alerts-a vulnerability alert-the black bar safety net

Recently, 360CERT monitoring to the widespread use of the JSON serialization framework Fastjson presence deserialization vulnerability can cause remote code execution, and there is evidence that The attacker can carefully construct the JSON data to achieve remote code execution, may cause the...