OpenJDK: unbounded memory allocation in CodeSource deserialization (Serialization, 8174113)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: Serialization. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker...

jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper

A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper...

Jenkins groovy.util.Expando Java deserialization vulnerability

Added: 08/15/2017 CVE: CVE-2016-0792 BID: 83720 Background Jenkins is a standalone, open-source automation server written in Java. Problem A deserialization vulnerability in the groovy.util.Expando class allows a remote attacker to execute arbitrary commands by requesting createItem with speciall...

camel-jacksonxml: Unmarshalling operation are vulnerable to RCE

It was found that Apache Camel's camel-jackson and camel-jacksonxml components are vulnerable to Java object de-serialisation vulnerability. Camel allows such a type through the 'CamelJacksonUnmarshalType' property. De-serializing untrusted data can lead to security flaws as demonstrated in vario...

Synology Photo Station Deserialization Vulnerability

Synology Photo Station is an online photo album and blog owned and managed by DSM users. A deserialization vulnerability in synophotocsPhotoMisc.php in Synology Photo Station can be exploited by remote attackers to gain administrator privileges via a specially crafted serialized payload...

CVE-2017-11153

CVE-2017-11153 is a deserialization vulnerability in Synology Photo Station (affecting versions prior to 6.7.3-3432 and 6.3-2967) that allows remote attackers to gain administrator privileges via a crafted serialized payload in synophoto_csPhotoMisc.php. The issue is part of a multi-vulnerability...

Exploit for Deserialization of Untrusted Data in Apache Log4J

CVE-2017-5645...

DotNetNuke arbitrary code execution vulnerability(CVE-2017-9822)

0x00 background description DNN uses web cookies to identify users. A malicioususer can decode one of such cookies and identify who that user is, and possiblyimpersonate other users and even upload malicious code to the server. --DNNsecurity-center 2017 7 November 5, DNN security sector released ...

jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper

A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper...

Artemis: Deserialization of untrusted input vulnerability

It was found that use of a JMS ObjectMessage does not safely handle user supplied data when deserializing objects. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage...

Artemis: Deserialization of untrusted input vulnerability

It was found that use of a JMS ObjectMessage does not safely handle user supplied data when deserializing objects. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage...

Apache Kafka Deserialization Vulnerability

Apache Kafka is an application service for building real-time data pipelines and streaming media. Apache kafka connect-api is vulnerable to a deserialization vulnerability in the execution of the FileOffsetBackingStore class. An attacker can exploit the vulnerability to cause remote code executio...

Deserialization of untrusted data

application/core/controller/images.php in FineCMS through 2017-07-12 allows remote authenticated admins to conduct XSS attacks by uploading an image via a route=images action...

DEBIAN-CVE-2017-2292

Versions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safeload, allowing the potential for arbitrary code execution on the server. The fix for this is to call YAML.safeload on input. This has been tested in all Puppet-supplied MCollective plugins, but there is a...

CVE-2017-5878

The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized Java data...

CVE-2017-7504

HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss Application Server = Jboss 4.X does not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via...

Debian Lintian Deserialization Vulnerability

Debian lintian is a package checker developed and maintained by the Debian Project Collaboration. A security vulnerability exists in Debian lintian 2.5.50.3 and earlier versions. The vulnerability can be exploited to execute code via specially crafted YAML files...

DEBIAN-CVE-2017-8829

Deserialization vulnerability in lintian through 2.5.50.3 allows attackers to trigger code execution by requesting a review of a source package with a crafted YAML file...

CVE-2017-8829

Deserialization vulnerability in lintian through 2.5.50.3 allows attackers to trigger code execution by requesting a review of a source package with a crafted YAML file...

CVE-2017-8829

CVE-2017-8829 is a deserialization vulnerability in lintian up to version 2.5.50.3. A remote attacker could trigger code execution by having a user or automated system run lintian on a package with a crafted YAML file. The issue is documented across multiple sources (Debian/CNVD, Ubuntu USN-3310-...