Sitecore Experience Platform Pre-Auth RCE

Sitecore XP 7.5 to Sitecore XP 8.2 Update 7 is vulnerable to an insecure deserialization attack where remote commands can be executed by an attacker with no authentication or special configuration required. id: CVE-2021-42237 info: name: Sitecore Experience Platform Pre-Auth RCE author: pdteam...

Deserialization of untrusted data

The PDF Invoices and Packing Slips For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.7 via deserialization of untrusted input via the orderid parameter. This makes it possible for authenticated attackers, with subscriber-level...

PT-2023-35971

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description The issue is related to a crash type of Use-of-uninitialized-value. The crash state involves the functions PyFunction FromConstructor, PyEval EvalCode, an...

CVE-2023-38524

CVE-2023-38524 affects Siemens Parasolid and Teamcenter Visualization. A null pointer dereference occurs while parsing specially crafted X_T files, enabling potential code execution in the affected process. Affected versions: Parasolid V34.1 (prior to 34.1.258), V35.0 (prior to 35.0.254), V35.1 (...