PT-2014-4957

Name of the Vulnerable Software and Affected Versions pimcore versions 1.4.9 through 2.0.0 Description The issue concerns the getObjectByToken function in the Pimcore Tool Newsletter module, which does not properly handle objects obtained from unserializing Lucene search data. This allows remote...

CVE-2014-2922: Improper Input Validation

The getObjectByToken function in Newsletter.php in the PimcoreToolNewsletter module in pimcore 1.4.9 through 2.1.0 does not properly handle an object obtained by unserializing a pathname, which allows remote attackers to conduct PHP object injection attacks and delete arbitrary files via vectors...

CVE-2014-2921: Improper Control of Generation of Code

The getObjectByToken function in Newsletter.php in the PimcoreToolNewsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via...

PT-2014-4958

Name of the Vulnerable Software and Affected Versions pimcore versions 1.4.9 through 2.1.0 Description The issue concerns the getObjectByToken function in Newsletter.php within the Pimcore Tool Newsletter module. It fails to properly handle an object obtained by unserializing a pathname, allowing...