Sitecore Experience Platform Pre-Auth RCE

Sitecore XP 7.5 to Sitecore XP 8.2 Update 7 is vulnerable to an insecure deserialization attack where remote commands can be executed by an attacker with no authentication or special configuration required. id: CVE-2021-42237 info: name: Sitecore Experience Platform Pre-Auth RCE author: pdteam...

Deserialization of untrusted data

The PDF Invoices and Packing Slips For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.7 via deserialization of untrusted input via the orderid parameter. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2023-38524

CVE-2023-38524 affects Siemens Parasolid and Teamcenter Visualization. A null pointer dereference occurs while parsing specially crafted X_T files, enabling potential code execution in the affected process. Affected versions: Parasolid V34.1 (prior to 34.1.258), V35.0 (prior to 35.0.254), V35.1 (...