1980 matches found
Java Deserialization Suspicious Traffic
An insecure deserialization vulnerability exists in web servers that accept serialized java objects from the user. Successful exploitation might allow an attacker to execute arbitrary code on an affected web server that accepts a serialized java object...
SAP NetWeaver Knowledge Management Configuration Service Insecure Deserialization Vulnerability
SAP NetWeaver Knowledge Management Configuration Service is a knowledge management solution configuration service from SAP. A security vulnerability exists in SAP NetWeaver Knowledge Management Configuration Service versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50, which allows remote attackers with...
CVE-2021-21488
Knowledge Management versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 allows a remote attacker with basic privileges to deserialize user-controlled data without verification, leading to insecure deserialization which triggers the attacker’s code, therefore impacting Availability...
CVE-2021-21488
Knowledge Management versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 allows a remote attacker with basic privileges to deserialize user-controlled data without verification, leading to insecure deserialization which triggers the attacker’s code, therefore impacting Availability...
CVE-2021-21488
Knowledge Management versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 allows a remote attacker with basic privileges to deserialize user-controlled data without verification, leading to insecure deserialization which triggers the attacker’s code, therefore impacting Availability...
Deserialization of untrusted data
Knowledge Management versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 allows a remote attacker with basic privileges to deserialize user-controlled data without verification, leading to insecure deserialization which triggers the attacker’s code, therefore impacting Availability...
CVE-2021-21488
CVE-2021-21488 affects SAP NetWeaver Knowledge Management Configuration Service versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50. The issue is insecure/deserialization of user-controlled data by a remote attacker with basic privileges, leading to attacker-controlled code execution and an impact on ava...
CVE-2021-21488
Knowledge Management versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 allows a remote attacker with basic privileges to deserialize user-controlled data without verification, leading to insecure deserialization which triggers the attacker’s code, therefore impacting Availability...
Microsoft Exchange 0-Day Attackers Spy on U.S. Targets
Microsoft has spotted multiple zero-day exploits in the wild being used to attack on-premises versions of Microsoft Exchange Server. Adversaries have been able to access email accounts, steal a raft of data and drop malware on target machines for long-term remote access, according to the computin...
Arbitrary Code Execution
Overview yolov5 is a Packaged version of the Yolov5 object detector Affected versions of this package are vulnerable to Arbitrary Code Execution. The package was vulnerable to insecure deserialization attack due to the usage of unsafe yaml load function in the package. Remediation Upgrade yolov5 ...
CVE-2021-27335
KollectApps before 4.8.16c is affected by insecure Java deserialization, leading to Remote Code Execution via a ysoserial.payloads.CommonsCollections parameter...
Deserialization of untrusted data
KollectApps before 4.8.16c is affected by insecure Java deserialization, leading to Remote Code Execution via a ysoserial.payloads.CommonsCollections parameter...
KollectApps Code Issue Vulnerability
kollect KollectApps is an application from the individual developers of kollect Kollect in Germany. Offers to automatically collect emails and phone numbers of people who send you contact information via inbox or comments. A security vulnerability exists in KollectApps. The vulnerability stems fr...
HPE Insight Manager Insecure Deserialization (CVE-2020-7200)
An Insecure Deserialization vulnerability exists in HPE Insight Manager. A remote attacker can exploit this vulnerability by sending a specially crafted serialized object. Successful exploitation can result in arbitrary code execution in the affected system...
XStream: remote code execution due to insecure XML deserialization when relying on blocklists
A flaw was found in xstream. An unsafe deserialization of user-supplied XML, in conjunction with relying on the default deny list, allows a remote attacker to perform a variety of attacks including a remote code execution of arbitrary code in the context of the JVM running the XStream application...
CVE-2021-25274
The Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ Microsoft Message Queue and doesn't set permissions on its private queues. As a result, remote unauthenticated clients can send messages to TCP port 1801 that the Collector Service will process. Additionally, upon...
CVE-2021-25274
The Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ Microsoft Message Queue and doesn't set permissions on its private queues. As a result, remote unauthenticated clients can send messages to TCP port 1801 that the Collector Service will process. Additionally, upon...
Design/Logic Flaw
The Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ Microsoft Message Queue and doesn't set permissions on its private queues. As a result, remote unauthenticated clients can send messages to TCP port 1801 that the Collector Service will process. Additionally, upon...
CVE-2021-25274
The Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ Microsoft Message Queue and doesn't set permissions on its private queues. As a result, remote unauthenticated clients can send messages to TCP port 1801 that the Collector Service will process. Additionally, upon...