VulnCheck KEV: CVE-2022-31199

Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\SYSTEM user. Successful exploitation requires that the attacker is able to reach port...

CVE-2022-44351

Skycaiji v2.5.1 was discovered to contain a deserialization vulnerability via /SkycaijiApp/admin/controller/Mystore.php...

CVE-2022-44351

Skycaiji v2.5.1 was discovered to contain a deserialization vulnerability via /SkycaijiApp/admin/controller/Mystore.php...

Deserialization of untrusted data

Skycaiji v2.5.1 was discovered to contain a deserialization vulnerability via /SkycaijiApp/admin/controller/Mystore.php...

CVE-2022-44371

hope-boot 1.0.0 has a deserialization vulnerability that can cause Remote Code Execution RCE...

CVE-2022-44371

hope-boot 1.0.0 has a deserialization vulnerability that can cause Remote Code Execution RCE...

CVE-2022-44351

Skycaiji v2.5.1 was discovered to contain a deserialization vulnerability via /SkycaijiApp/admin/controller/Mystore.php...

CVE-2022-44351

CVE-2022-44351 impacts Skycaiji v2.5.1, with a deserialization flaw in /SkycaijiApp/admin/controller/Mystore.php. The CVSSv3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (score 9.8, CRITICAL). Affected component is a deserialization path; impact spans confidentiality, integrity, and a...

CVE-2022-44371

hope-boot 1.0.0 has a deserialization vulnerability that can cause Remote Code Execution RCE...

CVE-2022-44371

CVE-2022-44371 affects hope-boot 1.0.0 and is described as a deserialization vulnerability that can lead to Remote Code Execution (RCE). The issue arises from unsafe deserialization in the component, with CVSS v3.1 base metrics: Network, Low attack complexity, No privileges required, User interac...

CVE-2022-46366

Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, which applies the the also unsupported 4.x version line. NOTE: This vulnerability only affects Apache Tapestry version line 3.x, which is no...

OESA-2022-2119 apache-sshd security update

Apache SSHD is a 100% pure java library to support the SSH protocols on both the client and server side. Security Fixes: Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD = 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The...

CVE-2022-41958 Deserialization Vulnerability by yaml config input in super-xray

super-xray is a web vulnerability scanning tool. Versions prior to 0.7 assumed trusted input for the program config which is stored in a yaml file. An attacker with local access to the file could exploit this and compromise the program. This issue has been addressed in commit 4d0d5966 and will be...

CVE-2022-3861 Betheme <= 26.5.1.4 - Authenticated (Subscriber+) PHP Object Injection

The Betheme theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 26.5.1.4 via deserialization of untrusted input supplied via the import, mfn-items-import-page, and mfn-items-import parameters passed through the mfnbuilderimport, mfnbuilderimportpage,...

WordPress theme Betheme 代码问题漏洞

WordPress is a blogging platform developed in PHP by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress theme is a theme for WordPress. A deserialization vulnerability exists in WordPress Plugin Betheme them plugin 26.5.1.4 and...

LibreNMS 代码问题漏洞

LibreNMS is an open source network monitoring system based on PHP and MySQL from the LibreNMS community. The system features customizable alerts, auto-discovery of the network environment and automatic updates. A security vulnerability exists in LibreNMS versions prior to 22.10.0 that stems from...

AlmaLinux 9 : python3.9 (ALSA-2022:8493)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:8493 advisory. - Python 3.9.x and 3.10.x through 3.10.8 on Linux allows local privilege escalation in a non-default configuration. The Python multiprocessing library, when used...

Apache MINA Deserialization Vulnerability

Apache MINA is the United States Apache Apache Foundation of a web application framework. The product is mainly used to develop high-performance and highly scalable web applications. Apache MINA 2.9.1 and earlier versions suffer from a deserialization vulnerability that stems from the use of Java...

Apache MINA 代码问题漏洞

Apache MINA is the United States Apache Apache Foundation of a web application framework. The product is mainly used to develop high-performance and highly scalable web applications. Apache MINA 2.9.1 and earlier versions suffer from a deserialization vulnerability that stems from the use of Java...

CVE-2022-45047 Apache MINA SSHD: Java unsafe deserialization vulnerability

Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD = 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys ...