The vulnerability of Microsoft Exchange Server’s mail server, related to deficiencies in the deserialization mechanism, allows attackers to execute arbitrary code.

The vulnerability of Microsoft Exchange Server is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

PT-2023-27908 · Sofarpc · Sofarpc

Name of the Vulnerable Software and Affected Versions: SOFARPC versions prior to 5.11.0 Description: SOFARPC is a Java RPC framework. Through a carefully crafted payload, an attacker can achieve JNDI injection or system command execution. The default configuration of the SOFARPC framework uses a...

Microsoft Exchange ApprovedApplicationCollection Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Exchange. Authentication is required to exploit this vulnerability. The specific flaw exists within the lack of protection against deserialization of the ApprovedApplicationCollection class...

CVE-2022-1415

CVE-2022-1415 corresponds to Drools core deserialization vulnerability. Affected component: KIE Drools (Drools core) where improper safeguards during data deserialization allow an authenticated attacker to craft serialized objects (gadgets) and execute arbitrary code on the server. Documented imp...

DELL Alienware Command Center Deserialization Untrusted Data Vulnerability

DELL Alienware Command Center is Dell's proprietary control software for Alienware-branded computers, which is used to customize hardware features, optimize performance and manage game settings. DELL Alienware Command Center suffers from a deserialization untrustworthy data vulnerability, which...

CVE-2023-4528: Java Deserialization Vulnerability in JSCAPE MFT (Fixed)

In August 2023, Rapid7 discovered a Java deserialization vulnerability in Redwood Software’s JSCAPE MFT secure managed file transfer product. The vulnerability was later assigned CVE-2023-4528. It can be exploited by sending an XML-encoded Java object to the Manager Service port, which, by defaul...

JSCAPE MFT Server Code Issue Vulnerability

JSCAPE MFT Server is a flexible and scalable hosted file transfer solution from JSCAPE USA. A security vulnerability exists in JSCAPE MFT Server versions prior to 2023.1.9 that stems from the presence of insecure deserialization, which allows an attacker to run arbitrary Java code through its...

CVE-2023-0925 Software AG webMethods OneData Deserialization Vulnerability

Version 10.11 of webMethods OneData runs an embedded instance of Azul Zulu Java 11.0.15 which hosts a Java RMI registry listening on TCP port 2099 by default and two RMI interfaces listening on a single, dynamically assigned TCP high port. Port 2099 serves as a Java Remote Method Invocation RMI...

CVE-2023-28072

Dell Alienware Command Center, versions prior to 5.5.51.0, contain a deserialization of untrusted data vulnerability. A local malicious user could potentially send specially crafted requests to the .NET Remoting server to run arbitrary code on the system...

CVE-2023-28072

Dell Alienware Command Center, versions prior to 5.5.51.0, contain a deserialization of untrusted data vulnerability. A local malicious user could potentially send specially crafted requests to the .NET Remoting server to run arbitrary code on the system...

Dell Alienware Command Center 代码问题漏洞

DELL Alienware Command Center is Dell's proprietary control software for Alienware-branded computers, which is used to customize hardware features, optimize performance and manage game settings. DELL Alienware Command Center suffers from a deserialization untrustworthy data vulnerability, which...

PT-2023-21534 · Dell · Dell Alienware Command Center

Name of the Vulnerable Software and Affected Versions: Dell Alienware Command Center versions prior to 5.5.51.0 Description: The issue is related to a deserialization of untrusted data vulnerability. A local malicious user could potentially send specially crafted requests to the .NET Remoting...

VulnCheck KEV: CVE-2023-29300

Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution...

PYSEC-2023-156

Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Software Foundation Apache Airflow Spark Provider.When the Apache Spark provider is installed on an Airflow deployment, an Airflow user that is authorized to configure Spark hooks c...

CVE-2023-40195 Apache Airflow Spark Provider Deserialization Vulnerability RCE

Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Software Foundation Apache Airflow Spark Provider. When the Apache Spark provider is installed on an Airflow deployment, an Airflow user that is authorized to configure Spark hooks...

CVE-2023-40571

weblogic-framework is a tool for detecting weblogic vulnerabilities. Versions 0.2.3 and prior do not verify the returned data packets, and there is a deserialization vulnerability which may lead to remote code execution. When weblogic-framework gets the command echo, it directly deserializes the...

Deserialization of untrusted data

weblogic-framework is a tool for detecting weblogic vulnerabilities. Versions 0.2.3 and prior do not verify the returned data packets, and there is a deserialization vulnerability which may lead to remote code execution. When weblogic-framework gets the command echo, it directly deserializes the...

CVE-2023-40571

The CVE-2023-40571 entry concerns the weblogic-framework tool for detecting WebLogic vulnerabilities. Versions ≤0.2.3 deserialize server-returned data without verification when processing the echo command, enabling a deserialization-focused remote code execution vector. The issue is tied to handl...

Oracle WebLogic Server 代码问题漏洞

Oracle WebLogic Server is an Oracle Oracle application service middleware for cloud and traditional environments, which provides a modern lightweight development platform that supports the entire lifecycle management of applications from development to production and simplifies application...

PT-2023-27516 · Unknown · Weblogic-Framework

Name of the Vulnerable Software and Affected Versions: weblogic-framework versions 0.2.3 and prior Description: The issue is related to a deserialization vulnerability that may lead to remote code execution. When the weblogic-framework receives the command echo, it directly deserializes the data...