CVE-2022-1032 Insecure deserialization of not validated module file in crater-invoice/crater

Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6...

CVE-2022-1032

CVE-2022-1032 affects the Crater Invoice Crater project prior to 6.0.6, reported as insecure deserialization of unvalidated module files. The exploit path demonstrated in the documents involves uploading a manipulated Phar archive (phar.phar) via the web API, then triggering remote code execution...

CVE-2022-1032 Insecure deserialization of not validated module file in crater-invoice/crater

Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6...

Crater Invoice Crater 代码问题漏洞

Crater Invoice Crater is an open source web and mobile application from Crater Invoice, Inc. for tracking expenses, payments and creating professional invoices and estimates. A security vulnerability exists in Crater Invoice Crater versions prior to 6.0.6 that stems from insecure deserialization ...

VulnCheck KEV: CVE-2021-42237

Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution...

Cisco Secure Access Control System Java Deserialization Vulnerability

A vulnerability in Java deserialization used by Cisco Secure Access Control System ACS could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software...

Sitecore XP Remote Command Execution Vulnerability

Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution...

SuiteCRM Deserialization Vulnerability

SuiteCRM is a customer relationship management system from the SuiteCRM team. SuiteCRM suffers from a deserialization vulnerability that stems from insecure deserialization of serialized data received by the application from users, which can be exploited by attackers to execute arbitrary code via...

Insecure deserialization of not validated module file

Description In recent Crater version 18507ddb tag: 6.0.6 highly privileged user can upload malicious module file and run insecure deserialization, which can lead to remote code execution. Proof of Concept 1. Prepare PHAR file - php --define phar.readonly=0 phar.php PHP data = $data; function...

SuiteCRM 代码问题漏洞

SuiteCRM is a customer relationship management system from the SuiteCRM team. SuiteCRM suffers from a deserialization vulnerability that stems from insecure deserialization of serialized data received by the application from users, which can be exploited by attackers to execute arbitrary code via...

CVE-2022-24282

CVE-2022-24282 affects Siemens SINEC NMS and SINEMA Server V14. The vulnerability is due to insecure deserialization of user-supplied JSON objects into Java objects, allowing a privileged attacker to execute arbitrary code on the device with root privileges. Affected versions of SINEC NMS include...

CVE-2022-24282

A vulnerability has been identified in SINEC NMS All versions = V1.0.3 V2.0, SINEC NMS All versions V1.0.3, SINEMA Server V14 All versions. The affected system allows to upload JSON objects that are deserialized to Java objects. Due to insecure deserialization of user-supplied content by the...

HPESBCR04221 rev.1 - HPE Cray System Software, Apache Log4j 2, Multiple Vulnerabilities

Potential Security Impact: Remote: Arbitrary Command Execution, Code Execution, Denial of Service DoS, SQL Injection, Insecure Deserialization SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Cray View for ClusterStor Versions 1.3.1 HPE Data Management Framework 7 Versions 7.x Cray...

kubernetes-client: Insecure deserialization in unmarshalYaml method

A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML...

CVE-2022-0138

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 has a deserialization function that does not validate or check the data, allowing arbitrary classes to be created...

Deserialization of Untrusted Data in Magnolia CMS

A vulnerability in the Snake YAML parser of Magnolia CMS v6.2.3 and below allows attackers to execute arbitrary code via a crafted YAML file...

kubernetes-client: Insecure deserialization in unmarshalYaml method

A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML...

Insecure Java Deserialization in Apache Karaf

Apache Karaf allows monitoring of applications and the Java runtime by using the Java Management Extensions JMX. JMX is a Java RMI based technology that relies on Java serialized objects for client server communication. Whereas the default JMX implementation is hardened against unauthenticated...

VulnLab - A Web Vulnerability Lab Project

VulnLab A web vulnerability lab project developed by Yavuzlar. Vulnerabilities SQL Injection Cross Site Scripting XSS Command Injection Insecure Direct Object References IDOR Cross Site Request Forgery CSRF XML External Entity XXE Insecure Deserialization File Upload File Inclusion Broken...

WordPress ToTop Link plugin code problem vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. ToTop Link Plugin is a WordPress open source application plugin. WordPress ToTop Link Plugin has a code issue vulnerability in versions prior to 1.7.1, which stems from the plugin passing...