Apache HertzBeat Deserialization Vulnerability

Apache HertzBeat is a tool from the American company Apache Apache that can monitor various components. A deserialization vulnerability exists in Apache HertzBeat versions prior to 1.6.0, which stems from the insecure deserialization of serialized data received from users by the SnakeYAML library...

Deserialization Of Untrusted Data

Sqlitedict is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to insecure deserialization which allows attackers to execute arbitrary code by exploiting the deserialization process...

WordPress plugin Easy Digital Downloads 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

PT-2024-11528 · WordPress · Easy Digital Downloads

Name of the Vulnerable Software and Affected Versions: Easy Digital Downloads – Simple eCommerce for Selling Digital Files plugin for WordPress versions up to, and including 3.3.3 Description: The issue concerns deserialization of untrusted input via the uploadfile parameter. This allows...

SOFA-Hessian 注入漏洞

SOFA-Hessian is an open source binary serialization protocol. An injection vulnerability exists in SOFA-Hessian versions prior to 3.5.4, which stems from the presence of a deserialization vulnerability that allows bypassing the blacklisting mechanism...

Apache Seata Deserialization Vulnerability

Apache Seata is an open source distributed transaction solution , is committed to providing high performance and easy to use distributed transaction services in the microservices architecture . Apache Seata suffers from a deserialization vulnerability that can be exploited by a remote attacker to...

VulnCheck KEV: CVE-2020-14644

Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution...

Oracle WebLogic Server Remote Code Execution Vulnerability

Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution...

Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability

Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account...

Oracle ADF Faces Deserialization of Untrusted Data Vulnerability

Oracle ADF Faces library, included with Oracle JDeveloper Distribution, contains a deserialization of untrusted data vulnerability leading to unauthenticated remote code execution...

The vulnerability of the Ivanti EPM endpoint management software, related to defects in the deserialization mechanism, allows a hacker to access limited functions of the software.

The vulnerability of the Ivanti EPM endpoint management software relates to the bypassing of authentication processes. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to limited functions of the software...

PT-2024-37303

Name of the Vulnerable Software and Affected Versions: langchain-ai/langchain versions prior to 0.2.4 Description: A vulnerability in the FAISS.deserialize from bytes function allows for pickle deserialization of untrusted data, which can lead to the execution of arbitrary commands via the...

Exploit for Deserialization of Untrusted Data in Apache Tomcat

CVE-2020-9484 with interactive mode and args Designed speci...

CVE-2024-22399

CVE-2024-22399 describes a deserialization of untrusted data vulnerability in Apache Seata Server that can enable remote code execution when attackers exploit the Seata private protocol via serialized payloads. Affected are Seata versions ranging from 1.0.0 through 1.8.0 and 2.0.0, with exploitat...

CVE-2024-22399 Apache Seata: Remote Code Execution vulnerability via Hessian Deserialization in Apache Seata Server

Deserialization of Untrusted Data vulnerability in Apache Seata. When developers disable authentication on the Seata-Server and do not use the Seata client SDK dependencies, they may construct uncontrolled serialized malicious requests by directly sending bytecode based on the Seata private...

Deserialization Of Untrusted Data

MindsDB is vulnerable to Deserialization of Untrusted Data. The vulnerability is caused due to improper deserialization of untrusted pickle data in the finetune method within byomhandler.py, which allows the execution of arbitrary code on the server during the 'finetune' process...

Apache Seata 代码问题漏洞

Apache Seata is an open source distributed transaction solution , is committed to providing high performance and easy to use distributed transaction services in the microservices architecture . Apache Seata suffers from a deserialization vulnerability that can be exploited by a remote attacker to...

H2O 代码问题漏洞

H2O is an in-memory platform for distributed, scalable machine learning open-sourced by H2O.ai. A code issue vulnerability exists in H2O-3 version 3.46.0.4, which stems from the fact that incorrect manipulation of the parameter query can lead to deserialization...

CVE-2022-2446

The WP Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'currentthemeroot' parameter in versions up to, and including 1.2.9. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will...

CVE-2022-2446

CVE-2022-2446 affects the WP Editor WordPress plugin. The vulnerability is a PHAR deserialization issue via the current_theme_root parameter in versions up to and including 1.2.9. An authenticated attacker with administrative privileges who can upload a serialized payload can trigger deserializat...