CVE-2020-5413

Spring Integration framework provides Kryo Codec implementations as an alternative for Java deserialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the "deserialization gadgets" exploit when provided data contains malicious cod...

CVE-2020-15842

Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-middle attackers to execute arbitrary code via crafted serialized payloads, because of insecure deserialization...

CVE-2020-15842

Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-middle attackers to execute arbitrary code via crafted serialized payloads, because of insecure deserialization...

CVE-2020-15842

Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-middle attackers to execute arbitrary code via crafted serialized payloads, because of insecure deserialization...

CVE-2020-15842

Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-middle attackers to execute arbitrary code via crafted serialized payloads, because of insecure deserialization...

CVE-2020-15842

CVE-2020-15842 affects Liferay Portal before 7.3.0 and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5. Insecure deserialization allows MITM attackers to execute arbitrary code via crafted serialized payloads. Mitigation: upgrade to Liferay Portal 7.3.0+ or D...

PT-2020-14665 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions prior to 7.3.0 Liferay DXP 7.0 versions prior to fix pack 90 Liferay DXP 7.1 versions prior to fix pack 17 Liferay DXP 7.2 versions prior to fix pack 5 Description: The issue allows man-in-the-middle attackers to execu...

TYPO3 8.x < 8.7.27 / 9.x < 9.5.8 Multiple Vulnerabilities

The version of TYPO3 installed on the remote host is 8.x prior to 8.7.27 or 9.x prior to 9.5.8. It is, therefore, affected by multiple vulnerabilities: - An insecure deserialization vulnerability exists in Typo3's FormEngine & DataHandler components. An unauthenticated, remote attacker, by sendin...

TYPO3 9.4 < 9.5.8 Insecure Deserialization (TYPO3-CORE-SA-2019-016)

The version of TYPO3 installed on the remote host is 9.4 prior to 9.5.8. It is, therefore, affected by an insecure deserialization vulnerability in its symfony/cache bundled, third-party component. An authenticated, remote attacker could exploit this, by sending a specially crafted object to an...

TYPO3 9.x < 9.5.17 / 10.x < 10.4.2 Multiple Vulnerabilities

The version of TYPO3 installed on the remote host is 9.x prior to 9.5.17 or 10.x prior to 10.4.2. It is, therefore, affected by multiple vulnerabilities: - A cross-site scripting XSS vulnerability exists in Typo3's form engine component due to improper validation of user-supplied input before...

TCPDF Phar Insecure Deserialization (CVE-2018-17057)

A remote code execution vulnerability exists in LimeSurvey. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

CVE-2020-14172

This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implemented. The way in which velocity templates were used in Atlassian Jira Server and Data Center in affected versions allowed remote attackers to achieve remote...

Deserialization of untrusted data

This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implemented. The way in which velocity templates were used in Atlassian Jira Server and Data Center in affected versions allowed remote attackers to achieve remote...

CVE-2020-14172

CVE-2020-14172 concerns Atlassian Jira Server/Data Center vulnerability where insecure deserialization via server-side Velocity templates enabled remote code execution. The affected versions are Jira Server/Data Center before 7.13.0, 8.0.x before 8.5.0, and 8.6.x before 8.8.1. The issue is addres...

Atlassian JIRA Server and Data Center Injection Vulnerabilities

Atlassian JIRA Server and Atlassian JIRA Data Center are both products of Atlassian Australia.Atlassian JIRA Server is the server version of a defect tracking management system. Atlassian JIRA Server is the server version of a defect tracking management system that is used to track and manage all...

CVE-2020-14172: Deserialization of Untrusted Data

This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implemented. The way in which velocity templates were used in Atlassian Jira Server and Data Center in affected versions allowed remote attackers to achieve remote...

PT-2020-13911

Name of the Vulnerable Software and Affected Versions Atlassian Jira Server and Data Center versions prior to 7.13.0 Atlassian Jira Server and Data Center versions 8.0.0 through 8.4.9 Atlassian Jira Server and Data Center versions 8.6.0 through 8.8.0 Description This issue allows remote attackers...

Insecure Deserialization in Apache Commons Collection

Serialized-object interfaces in Java applications using the Apache Commons Collections ACC library may allow remote attackers to execute arbitrary commands via a crafted serialized Java object...

GHSA-6HGM-866R-3CJV Insecure Deserialization in Apache Commons Collection

Serialized-object interfaces in Java applications using the Apache Commons Collections ACC library may allow remote attackers to execute arbitrary commands via a crafted serialized Java object...

Insecure Deserialization in Apache Commons Beanutils

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean...