CVE-2024-52046 Apache MINA: MINA applications using unbounded deserialization may allow RCE

The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process incoming serialized data but lacks the necessary security checks and defenses. This vulnerability allows attackers to exploit the deserialization process by sending specially crafted malicious...

CVE-2024-52046

The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process incoming serialized data but lacks the necessary security checks and defenses. This vulnerability allows attackers to exploit the deserialization process by sending specially crafted malicious...

CVE-2024-52046

CVE-2024-52046 affects Apache MINA ObjectSerializationDecoder deserializing data via Java’s native protocol. Affected MINA core versions: 2.0.x, 2.1.x, 2.2.x; fixed in MINA core releases 2.0.27, 2.1.10 and 2.2.4. The issue only matters if IoBuffer#getObject() is invoked (e.g., when a ProtocolCode...

Deserialization Of Untrusted Data

Drupal Core is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to insecure deserialization of untrusted data, allows an attacker to inject malicious objects, which can be exploited through the gadget chain to achieve remote code execution...

Deserialization Of Untrusted Data

Drupal Core is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to insecure deserialization, allowing an attacker to exploit a chain of methods to achieve remote code execution when untrusted data is deserialized...

Deserialization Of Untrusted Data

Drupal Core is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to insecure deserialization, allowing an attacker to achieve Remote Code Execution RCE via a gadget chain...

CVE-2024-12721

The Custom Product Tabs For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.4 via deserialization of untrusted input from the 'wbcustomtabs' parameter. This makes it possible for authenticated attackers, with Shop Manager-level acce...

CVE-2024-12677

Delta Electronics DTM Soft deserializes objects, which could allow an attacker to execute arbitrary code...

CVE-2024-12677 Delta Electronics DTM Soft Deserialization of Untrusted Data

Delta Electronics DTM Soft deserializes objects, which could allow an attacker to execute arbitrary code...

CVE-2024-12677 Delta Electronics DTM Soft Deserialization of Untrusted Data

Delta Electronics DTM Soft deserializes objects, which could allow an attacker to execute arbitrary code...

Microsoft Update Catalog Deserialization Vulnerability

The Microsoft Update Catalog is an update Web site from the U.S.-based Microsoft Corporation Microsoft. It is used to provide the company with a list of patches, drivers and software. Microsoft Update Catalog suffers from a deserialization vulnerability that originates from deserializing untruste...

CVE-2024-12741 Deserialization Of Untrusted Data Vulnerability In NI DAQExpress Project File

A deserialization of untrusted data vulnerability exists in NI DAQExpress that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects DAQExpress 5.1 and prior versions. Please note that...

CVE-2024-12741 Deserialization Of Untrusted Data Vulnerability In NI DAQExpress Project File

A deserialization of untrusted data vulnerability exists in NI DAQExpress that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects DAQExpress 5.1 and prior versions. Please note that...

CVE-2024-12741

NI DAQExpress has a deserialization of untrusted data vulnerability that can lead to remote code execution when a user opens a specially crafted LVPROJECT file. Affected products: DAQExpress 5.1 and earlier (DAQExpress is EOL and will not receive updates). Exploitation requires user interaction (...

CVE-2024-56058

Deserialization of Untrusted Data vulnerability in denniskravetstns VRPConnector vrpconnector allows Object Injection.This issue affects VRPConnector: from n/a through = 2.0.1...

CVE-2024-56058

Summary (CVE-2024-56058): WordPress VRPConnector plugin versions ≤ 2.0.1 are affected by a deserialization of untrusted data vulnerability that enables PHP Object Injection. The issue allows unauthenticated attackers to inject a PHP object, potentially leading to compromise such as arbitrary file...

CVE-2024-56058 WordPress VRPConnector plugin <= 2.0.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Gueststream VRPConnector allows Object Injection.This issue affects VRPConnector: from n/a through 2.0.1...

NI DAQExpress 安全漏洞

NI DAQExpress National Instruments DAQExpress is an interactive application software from National Instruments NI Inc. It is used to quickly acquire, analyze, and present data from data acquisition devices. A security vulnerability exists in NI DAQExpress that stems from the inclusion of an...

CVE-2024-54367 WordPress ForumWP plugin <= 2.1.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Ultimate Member ForumWP forumwp allows Object Injection.This issue affects ForumWP: from n/a through = 2.1.0...

CVE-2024-54367 WordPress ForumWP plugin <= 2.1.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Ultimate Member ForumWP forumwp allows Object Injection.This issue affects ForumWP: from n/a through = 2.1.0...