CVE-2022-40889

CVE-2022-40889 : Phpok 6.1 has a deserialization vulnerability via framework/phpok_call.php. Affected: Phpok 6.1 (framework/phpok_call.php). Root cause: deserialization vulnerability in the PHP code path. Impact: high confidentiality, integrity, and availability impacts per CVSS 3.1 score (9.8, C...

CVE-2022-39198

The CVE-2022-39198 entry describes a deserialization vulnerability in dubbo hessian-lite prior to 3.2.12, which could allow arbitrary code execution. Affected software/components include dubbo hessian-lite 3.2.12 and earlier, impacting Apache Dubbo 2.7.x up to 2.7.17; 3.0.x up to 3.0.11; and 3.1....

CVE-2022-39198 Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass

A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version...

PHPOK 代码问题漏洞

PHPOK is an enterprise website builder with extension support. A security vulnerability exists in PHPOK version 6.1, which stems from a deserialization vulnerability found via framework/Phpokcall.php...

PT-2022-24799 · Apache · Apache Dubbo +1

Name of the Vulnerable Software and Affected Versions: Apache Dubbo versions 2.7.17 and prior Apache Dubbo versions 3.0.11 and prior Apache Dubbo versions 3.1.0 and prior dubbo hessian-lite versions 3.2.12 and earlier Description: A deserialization vulnerability existed in dubbo hessian-lite, whi...

CVE-2022-42004

A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer.deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices...

GoCD 代码问题漏洞

GoCD is a continuous delivery server. A security vulnerability exists in GoCD versions 19.2.0 through 19.11.0, which stems from a Spring RemoteInvocation endpoint exposed for proxy communication that allows deserialization of arbitrary java objects, which can be exploited by an attacker to execut...

CVE-2022-39298

MelisFront is the engine that displays website hosted on Melis Platform. It deals with showing pages, plugins, URL rewritting, search optimization and SEO, etc. Attackers can deserialize arbitrary data on affected versions of melisplatform/melis-front, and ultimately leads to the execution of...

CVE-2018-18446

dotPDN Paint.NET before 4.1.2 allows Deserialization of Untrusted Data issue 1 of 2...

dotPDN Paint.NET 代码问题漏洞

dotPDN Paint.NET is a free image and photo editing software for PCs running Windows from dotPDN, Inc. A security vulnerability exists in dotPDN Paint.NET versions prior to 4.1.2 that stems from allowing deserialization of untrusted data...

CVE-2018-18447

dotPDN Paint.NET before 4.1.2 allows Deserialization of Untrusted Data issue 2 of 2...

dotPDN Paint.NET 代码问题漏洞

dotPDN Paint.NET is a free image and photo editing software for PCs running Windows from dotPDN, Inc. A security vulnerability exists in dotPDN Paint.NET versions prior to 4.1.2 that stems from allowing deserialization of untrusted data...

Media Links routers 代码问题漏洞

Media Links routers are a series of wireless routers from the Japanese company Media Links. Media Links routers are vulnerable to a code issue that originates from an attacker being able to deserialize arbitrary data from melisplatform/melis-front, ultimately leading to the execution of arbitrary...

VMware vCenter Server Platform Services Controller Unsafe Deserialization vulnerability

Talos Vulnerability Report TALOS-2022-1587 VMware vCenter Server Platform Services Controller Unsafe Deserialization vulnerability October 10, 2022 CVE Number CVE-2022-31680 SUMMARY An unsafe deserialization vulnerability exists in the Platform Services Controller functionality of VMware vCenter...

CVE-2022-31680

The vCenter Server contains an unsafe deserialisation vulnerability in the PSC Platform services controller. A malicious actor with admin access on vCenter server may exploit this issue to execute arbitrary code on the underlying operating system that hosts the vCenter Server...

Exploit for Deserialization of Untrusted Data in Apache Struts

CVE-2017-9805 CVE-2017-9805 POC The issue comes fro...

Uncontrolled Resource Consumption in FasterXML jackson-databind

In FasterXML jackson-databind before 2.12.7.1 and in 2.13.x before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer.deserializeFromArray to prevent use of deeply nested arrays. This issue can only happen when the UNWRAPSINGLEVALUEARRAYS feature is explicitly...

CVE-2022-42004

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer.deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization...

CVE-2022-39256 Orckestra C1 CMS's deserialization of untrusted data allows for arbitrary code execution.

Orckestra C1 CMS is a .NET based Web Content Management System. A vulnerability in versions prior to 6.13 allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS. Authentication is required to exploit this vulnerability. The authenticated user may perform t...

Orckestra C1 CMS 代码问题漏洞

C1 CMS is an open source web content management system CMS based on .NET. A deserialization vulnerability exists in versions of Orckestra C1 CMS prior to 6.13. An authenticated attacker can exploit this vulnerability to execute arbitrary code...