CVE-2019-12240

The Virim plugin 0.4 for WordPress allows Insecure Deserialization via svalues, tvalues, or cvalues in graph.php...

CVE-2019-12241

The Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-cartsguru-event-handler.php...

CVE-2019-12241

CVE-2019-12241 affects the Carts Guru WordPress plugin up to version 1.4.5. The Red Hat and NVD records confirm an insecure deserialization flaw triggered by a cartsguru-source cookie that targets classes/wc-cartsguru-event-handler.php, enabling unauthenticated access with high impact. CVSS3 base...

CVE-2019-12241

The Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-cartsguru-event-handler.php...

CVE-2019-12240

The CVE-2019-12240 entry concerns the Virim WordPress plugin (version 0.4) with insecure deserialization via s_values, t_values, or c_values in graph.php. Root cause: unsafe deserialization of crafted data in these parameters could enable unauthorized access or code execution, as reflected by CVS...

CVE-2019-12240

The Virim plugin 0.4 for WordPress allows Insecure Deserialization via svalues, tvalues, or cvalues in graph.php...

PT-2019-12711

Name of the Vulnerable Software and Affected Versions Virim plugin version 0.4 Description The issue allows for Insecure Deserialization via s values, t values, or c values in the graph.php file. Recommendations For Virim plugin version 0.4, consider disabling the deserialization functionality in...

CVE-2019-12240: Deserialization of Untrusted Data

The Virim plugin 0.4 for WordPress allows Insecure Deserialization via svalues, tvalues, or cvalues in graph.php...

PT-2019-12712

Name of the Vulnerable Software and Affected Versions The Carts Guru plugin version 1.4.5 Description The issue allows for Insecure Deserialization via a cartsguru-source cookie to the classes/wc-cartsguru-event-handler.php file. Recommendations For The Carts Guru plugin version 1.4.5, consider...

CVE-2019-12241: Deserialization of Untrusted Data

The Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-cartsguru-event-handler.php...

Serious Phar Flaw Allows Arbitrary Code Execution on Drupal

Multiple content management systems – including Drupal, Joomla and Typo3 – are open to a vulnerability that can lead to arbitrary code execution on some systems. The flaw CVE-2019-11831 exists in the phar stream wrapper component used in PHP-driven projects. A Phar archive is used to distribute a...

By-passing protection of Phar Stream Wrapper Interceptor

Insecure deserialization is a vulnerability which occurs when untrusted data is used to abuse the logic of an application. In July 2018, the vulnerability of insecure deserialization when executing Phar archives was addressed by removing the known attack vector in the TYPO3 core. For more details...

By-passing protection of Phar Stream Wrapper Interceptor

Insecure deserialization is a vulnerability which occurs when untrusted data is used to abuse the logic of an application. In July 2018, the vulnerability of insecure deserialization when executing Phar archives was addressed by removing the known attack vector in the TYPO3 core. For more details...

Apache Solr Config API Insecure Deserialization Remote Code Execution (CVE-2019-0192)

An insecure deserialization vulnerability has been reported in Apache Solr. This vulnerability is due to the insufficient validation of requests to the Config API. A remote, unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request to the Config API...

Drupal Core stream wrapper Insecure Deserialization (CVE-2019-6339)

An insecure deserialization vulnerability exists in Drupal Core. The vulnerability is in a stream wrapper when performing file operations. Successful exploitation of this vulnerability could result in arbitrary code execution under the security context of the web server...

[20190502] - Core - By-passing protection of Phar Stream Wrapper Interceptor

In Joomla 3.9.3, the vulnerability of insecure deserialization when executing Phar archives was addressed by removing the known attack vector in the Joomla core. In order to intercept file invocations like fileexists or stat on compromised Phar archives the base name has to be determined and...

CVE-2018-19276

OpenMRS Platform vulnerability CVE-2018-19276 affects OpenMRS Platform

PT-2019-9785 · Openmrs · Openmrs

Name of the Vulnerable Software and Affected Versions: OpenMRS versions prior to 2.24.0 Description: The issue allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body. This is due to an Insecure Object Deserialization vulnerabilit...

Apache Solr Remote Code Execution Vulnerability

Apache Solr is an open source enterprise search platform written in Java. A remote code execution vulnerability exists in Apache Solr versions 5.0.0 - 5.5.5, 6.0.0 - 6.6.5. The vulnerability stems from the Config API allowing configuration of a JMX server via HTTP POST requests. An attacker can...

Oracle WebLogic Server Deployment Service Servlet Insecure Deserialization (CVE-2018-3252)

An insecure deserialization vulnerability exists in the Oracle WebLogic Server Deployment Service . The vulnerability is due to the lack of input validation by the servlet. A successful attack could lead to a remote code execution...