5535 matches found
Deserialization of untrusted data
Phpok 6.1 has a deserialization vulnerability via framework/phpokcall.php...
CVE-2022-40889
Phpok 6.1 has a deserialization vulnerability via framework/phpokcall.php...
CVE-2022-39198 Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass
A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version...
CVE-2022-39198
The CVE-2022-39198 entry describes a deserialization vulnerability in dubbo hessian-lite prior to 3.2.12, which could allow arbitrary code execution. Affected software/components include dubbo hessian-lite 3.2.12 and earlier, impacting Apache Dubbo 2.7.x up to 2.7.17; 3.0.x up to 3.0.11; and 3.1....
CVE-2022-40889
Phpok 6.1 has a deserialization vulnerability via framework/phpokcall.php...
CVE-2022-40889
CVE-2022-40889 : Phpok 6.1 has a deserialization vulnerability via framework/phpok_call.php. Affected: Phpok 6.1 (framework/phpok_call.php). Root cause: deserialization vulnerability in the PHP code path. Impact: high confidentiality, integrity, and availability impacts per CVSS 3.1 score (9.8, C...
PHPOK 代码问题漏洞
PHPOK is an enterprise website builder with extension support. A security vulnerability exists in PHPOK version 6.1, which stems from a deserialization vulnerability found via framework/Phpokcall.php...
CVE-2022-39198 Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass
A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version...
PT-2022-24799 · Apache · Apache Dubbo +1
Name of the Vulnerable Software and Affected Versions: Apache Dubbo versions 2.7.17 and prior Apache Dubbo versions 3.0.11 and prior Apache Dubbo versions 3.1.0 and prior dubbo hessian-lite versions 3.2.12 and earlier Description: A deserialization vulnerability existed in dubbo hessian-lite, whi...
CVE-2022-42004
A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer.deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices...
GoCD 代码问题漏洞
GoCD is a continuous delivery server. A security vulnerability exists in GoCD versions 19.2.0 through 19.11.0, which stems from a Spring RemoteInvocation endpoint exposed for proxy communication that allows deserialization of arbitrary java objects, which can be exploited by an attacker to execut...
CVE-2022-39298
MelisFront is the engine that displays website hosted on Melis Platform. It deals with showing pages, plugins, URL rewritting, search optimization and SEO, etc. Attackers can deserialize arbitrary data on affected versions of melisplatform/melis-front, and ultimately leads to the execution of...
CVE-2018-18446
dotPDN Paint.NET before 4.1.2 allows Deserialization of Untrusted Data issue 1 of 2...
CVE-2018-18447
dotPDN Paint.NET before 4.1.2 allows Deserialization of Untrusted Data issue 2 of 2...
dotPDN Paint.NET 代码问题漏洞
dotPDN Paint.NET is a free image and photo editing software for PCs running Windows from dotPDN, Inc. A security vulnerability exists in dotPDN Paint.NET versions prior to 4.1.2 that stems from allowing deserialization of untrusted data...
dotPDN Paint.NET 代码问题漏洞
dotPDN Paint.NET is a free image and photo editing software for PCs running Windows from dotPDN, Inc. A security vulnerability exists in dotPDN Paint.NET versions prior to 4.1.2 that stems from allowing deserialization of untrusted data...
Media Links routers 代码问题漏洞
Media Links routers are a series of wireless routers from the Japanese company Media Links. Media Links routers are vulnerable to a code issue that originates from an attacker being able to deserialize arbitrary data from melisplatform/melis-front, ultimately leading to the execution of arbitrary...
VMware vCenter Server Platform Services Controller Unsafe Deserialization vulnerability
Talos Vulnerability Report TALOS-2022-1587 VMware vCenter Server Platform Services Controller Unsafe Deserialization vulnerability October 10, 2022 CVE Number CVE-2022-31680 SUMMARY An unsafe deserialization vulnerability exists in the Platform Services Controller functionality of VMware vCenter...
CVE-2022-31680
The vCenter Server contains an unsafe deserialisation vulnerability in the PSC Platform services controller. A malicious actor with admin access on vCenter server may exploit this issue to execute arbitrary code on the underlying operating system that hosts the vCenter Server...
