5574 matches found
Exploit for Deserialization of Untrusted Data in Huggingface Transformers
CVE-2024-11394 Hugging Face Transformers Trax Model Deseri...
Exploit for Deserialization of Untrusted Data in Huggingface Transformers
CVE-2024-11393 Hugging Face Transformers MaskFormer Model D...
CVE-2024-11501 Gallery <= 1.3 - Authenticated (Contributor+) PHP Object Injection
The Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3 via deserialization of untrusted input from wdgallery$id parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object...
CVE-2024-54135
Summary: CVE-2024-54135 affects ClipBucket-v5 (versions 2.0–5.5.1 Revision 199). The root cause is improper sanitization of user input in upload/photo_upload.php’s decode_key function, which calls PHP unserialize (photos.class.php). This deserialization can be triggered by crafted input via GET (...
ClipBucket 安全漏洞
ClipBucket is an open source and freely downloadable PHP script from MacWarrior Open Source. It is used for sharing video sites. A security vulnerability exists in ClipBucket 5.5.1-199 and earlier versions, which stems from vulnerability to a PHP deserialization vulnerability and improper input...
GHSA-6HQR-C69M-R76Q Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore
Apache Hive Metastore HMS uses SerializationUtilitiesdeserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and can lead to Remote Code Execution RCE since it allows the deserialization of arbitrary data. In real deployments, the vulnerability can be...
CVE-2022-41137 Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore
Apache Hive Metastore HMS uses SerializationUtilitiesdeserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and can lead to Remote Code Execution RCE since it allows the deserialization of arbitrary data. In real deployments, the vulnerability can be...
Veeam Backup & Replication 安全漏洞
Veeam Backup & Replication is a backup and replication software from Veeam USA. A security vulnerability exists in Veeam Backup & Replication 12.2.0.334 and previous versions 12.X. The vulnerability stems from an insufficient blacklist during deserialization, which allows for the deletion of any...
Horilla 代码问题漏洞
Horilla is a free and open source human resources software from Horilla, Inc. A code issue vulnerability exists in Horilla 1.2.1 and prior versions that stems from the presence of a deserialization vulnerability...
PT-2024-17454 · Horilla · Horilla
Name of the Vulnerable Software and Affected Versions: horilla versions up to 1.2.1 Description: A critical vulnerability was found in horilla, affecting the function request new/get employee shift/create reimbursement/key result current value update/create meetings/create skills. The manipulatio...
CVE-2024-51772 Authenticated Deserialization Vulnerability in ClearPass Policy Manager Web-Based Management Interface Leading to a Remote Command Execution (RCE)
An authenticated RCE vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...
CVE-2024-51772
CVE-2024-51772 is an authenticated RCE vulnerability affecting Aruba ClearPass Policy Manager’s web-based management interface. The provided documents describe that authenticated users can remotely execute arbitrary commands on the underlying operating system, leading to potential full compromise...
CVE-2024-51772 Authenticated Deserialization Vulnerability in ClearPass Policy Manager Web-Based Management Interface Leading to a Remote Command Execution (RCE)
An authenticated RCE vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...
Remote Code Execution (RCE)
backpack/filemanager is vulnerable to Remote Code Execution. The vulnerability is due to improper handling of untrusted data during deserialization from the mimes parameter, allows an attacker to execute remote code on the affected system...
LINQPad Deserialization
This module exploits a bug in LIQPad up to version 5.48.00. The bug is only exploitable in paid version of software. The core of a bug is cache file containing deserialized data, which attacker can overwrite with malicious payload. The data gets deserialized every time the app restarts. Module...
CVE-2024-53477
JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java...
PT-2024-27093 · Symfony · Symfony
Name of the Vulnerable Software and Affected Versions: Symfony version 7.0.3 Description: A deserialization vulnerability is reported to exist in the Stub class of the VarDumper module in Symfony. The issue stems from deficiencies in handling properties with null or uninitialized values,...
CVE-2024-36610
Removed by vendor...
CVE-2024-36610
CVE-2024-36610 is associated with Symfony’s VarDumper deserialization issue in the Stub class, reportedly allowing crafted serialized data to trigger code execution. The primary public entries treat the candidate as withdrawn/invalid (e.g., advisories and sources noting withdrawal or removal). A ...