Halibut input validation error vulnerability

Halibut, a secure, RPC-based open source communication framework from Octopus Deploy individual developers, is vulnerable to an input validation error that stems from a deserialization vulnerability in versions of Halibut prior to version 4.4.7 that could allow remote execution on systems that ar...

GHSA-HPF7-4C2G-9CHF Remote Code Execution in Halibut

In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already trust each other based on certificate verification...

CVE-2021-31819

In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already trust each other based on certificate verification...

Remote code execution

In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already trust each other based on certificate verification...

GHSA-H9W3-F7X6-V54C Deserialization of Untrusted Data in com.jsoniter:jsoniter

Withdrawn was withdrawn by its CNA. Further investigation showed that it was not a security issue. Original Description All versions of package com.jsoniter:jsoniter are vulnerable to Deserialization of Untrusted Data via malicious JSON strings. This may lead to a Denial of Service, and in certai...

Siemens Desigo CC Series CCOM Communication Component Deserialization Vulnerability

Cerberus DMS is a hazard management station that helps users manage fire safety and security incidents.Desigo CC is an integrated building management platform for managing high-performance buildings.Desigo CC Compact expands the portfolio with solutions tailored for small and medium-sized...

PYSEC-2021-334

parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable to YAML deserialization attack caused by unsafe loading which leads to Arbitary code execution. This security bug is patched by avoiding...

CVE-2021-35217

Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. An Authenticated Attacker could exploit it by executing WSAsyncExecuteTasks deserialization of untrusted data...

Solarwinds Orion Platform 代码问题漏洞

Solarwinds Orion Platform is a network fault and network performance management platform from Solarwinds, Inc. The platform provides real-time monitoring and analysis of network devices and supports a customizable web interface, multiple user comments, and a map view of the entire network. A...

Solarwinds Orion Patch Manager Web Console 代码问题漏洞

solarwinds Patch Manager is an application from solarwinds, Inc. It is used to manage third-party software. A security vulnerability exists in the Solarwinds Orion Patch Manager Web Console that stems from. deserialization of untrusted data in the Web Console chart endpoint could lead to remote...

Deserialization of untrusted data

Deserialization of untrusted data in multiple functions in MIK.starlight 7.9.5.24363 allows authenticated remote attackers to execute operating system commands by crafting serialized objects...

CVE-2021-21869

An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this...

XStream 代码问题漏洞

XStream is an open source Java class library that is mainly used to serialize objects to XML JSON or deserialize them to objects.XStream 1.4.17 and earlier versions have an arbitrary code execution vulnerability that can be exploited by attackers to cause arbitrary code execution...

Deserialization of untrusted data

An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.getMissingTypes functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this...

CVE-2021-21868

CVE-2021-21868 affects CODESYS Development System 3.5.16 and 3.5.17. The root cause is an unsafe deserialization in ObjectManager.plugin GetMissingTypesFromAuxStream() that uses BinaryFormatter on untrusted data, enabling arbitrary code execution when a project auxiliary file (MissingTypeInformat...

PYSEC-2021-300

TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format. The implementation uses yaml.unsafeload which can perform arbitrary code execution...

log4j: Socket receiver deserialization vulnerability

It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the...

CVE-2021-23420

This affects the package codeception/codeception from 4.0.0 and before 4.1.22, before 3.1.3. The RunProcess class can be leveraged as a gadget to run arbitrary commands on a system that is deserializing user input without validation...

Cpanel 代码问题漏洞

Cpanel is a set of Web-based automated colocation platform from Cpanel, Inc. in the United States. The platform is primarily used to automate the management of websites and servers. A security vulnerability exists in versions prior to cPanel 98.0.1, which can be exploited to perform a...

The vulnerability of the Ehcache network service in RMI software products for processing Jira Data Center, Jira Core Data Center, and Jira Software Data Center data allows a perpetrator to execute arbitrary code.

The vulnerability of the Ehcache network service in RMI software products for processing data from Jira Data Center, Jira Core Data Center, and Jira Software Data Center is related to the deserialization of data during authentication processes. Exploiting this vulnerability allows an attacker to...