CVE-2022-27158

pearweb 1.32 suffers from Deserialization of Untrusted Data...

pearweb 代码问题漏洞

pearweb is a PHP extension and application repository. A security vulnerability exists in pearweb before 1.32, which stems from deserialization of untrusted data...

CVE-2022-22958

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities CVE-2022-22957 & CVE-2022-22958. A malicious actor with administrative access can trigger deserialization of untrusted data through malicious JDBC URI which may result in remote...

Deserialization of untrusted data

A vulnerability has been identified in SIMATIC Energy Manager Basic All versions V7.3 Update 1, SIMATIC Energy Manager PRO All versions V7.3 Update 1. The affected system allows remote users to send maliciously crafted objects. Due to insecure deserialization of user-supplied content by the...

Siemens SIMATIC 代码问题漏洞

SIMATIC Energy Manager to visualize in detail the energy flow and consumption values of a process, assign them to the relevant consumer or cost center, and determine the reason for the change.A deserialization vulnerability exists in Siemens SIMATIC Energy Manager, which could be exploited by an...

VulnCheck KEV: CVE-2021-27852

Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code...

CVE-2022-20763

A vulnerability in the login authorization components of Cisco Webex Meetings could allow an authenticated, remote attacker to inject arbitrary Java code. This vulnerability is due to improper deserialization of Java code within login requests. An attacker could exploit this vulnerability by...

CVE-2022-28219

Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution. Rapid7 Analysis Overview On June 29, 2022, Horizon3 Attack Team posted a writeup of CVE-2022-28219, which is a Java deserialization issue in ManageEngine ADAudi...

CVE-2020-19229

Jeesite 1.2.7 uses the apache shiro version 1.2.3 affected by CVE-2016-4437. Because of this version of the java deserialization vulnerability, an attacker could exploit the vulnerability to execute arbitrary commands via the rememberMe parameter...

Deserialization of untrusted data

Jeesite 1.2.7 uses the apache shiro version 1.2.3 affected by CVE-2016-4437. Because of this version of the java deserialization vulnerability, an attacker could exploit the vulnerability to execute arbitrary commands via the rememberMe parameter...

CVE-2020-19229

CVE-2020-19229 affects Jeesite 1.2.7 which bundles Apache Shiro 1.2.3. The issue arises from a Java deserialization vulnerability via the rememberMe parameter when a cipher key is not configured, enabling remote code execution. Public details indicate the root cause is CVE-2016-4437 (Apache Shiro...

CVE-2020-19229

Jeesite 1.2.7 uses the apache shiro version 1.2.3 affected by CVE-2016-4437. Because of this version of the java deserialization vulnerability, an attacker could exploit the vulnerability to execute arbitrary commands via the rememberMe parameter...

USN-5365-1 h2database vulnerabilities

It was discovered that H2 was vulnerable to deserialization of untrusted data. An attacker could possibly use this issue to execute arbitrary code. CVE-2021-42392 It was discovered that H2 incorrectly handled some specially crafted connection URLs. An attacker could possibly use this issue to...

CVE-2021-33207

CVE-2021-33207 affects Software AG MashZone NextGen up to version 10.7 GA. The vulnerability arises in the HTTP client, which deserializes untrusted data when processing an HTTP response with status code 570. Connected sources confirm the affected product and the root cause (deserialization of un...

CVE-2020-19229

Jeesite 1.2.7 uses the apache shiro version 1.2.3 affected by CVE-2016-4437. Because of this version of the java deserialization vulnerability, an attacker could exploit the vulnerability to execute arbitrary commands via the rememberMe parameter. Recent assessments: Assessed Attacker Value: 0...

CVE-2021-27475 Rockwell Automation Connected Components Workbench Deserialization of Untrusted Data

Rockwell Automation Connected Components Workbench v12.00.00 and prior does not limit the objects that can be deserialized. This vulnerability allows attackers to craft a malicious serialized object that, if opened by a local user in Connected Components Workbench, may result in remote code...

CVE-2021-27470

Rockwell Automation FactoryTalk AssetCentre before version 11 is affected by a deserialization vulnerability in the LogService.rem component that allows remote, unauthenticated command execution. Affected product: FactoryTalk AssetCentre v10.00 and earlier. Root cause: improper deserialization/ve...

CVE-2021-27470 Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data

A deserialization vulnerability exists in how the LogService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in FactoryTalk AssetCentre...

CVE-2021-27466

Summary (validated by provided sources): Rockwell Automation FactoryTalk AssetCentre (v10.00 and earlier) is affected by a deserialization vulnerability in the ArchiveService.rem component that can allow a remote, unauthenticated attacker to execute arbitrary commands on FactoryTalk AssetCentre. ...

CVE-2021-27466 Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data

A deserialization vulnerability exists in how the ArchiveService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in FactoryTalk AssetCentre...