XStream: remote code execution due to insecure XML deserialization when relying on blocklists

A flaw was found in xstream. An unsafe deserialization of user-supplied XML, in conjunction with relying on the default deny list, allows a remote attacker to perform a variety of attacks including a remote code execution of arbitrary code in the context of the JVM running the XStream application...

WordPress 插件代码问题漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. ToTop Link Plugin is a WordPress open source application plugin. WordPress ToTop Link Plugin has a code issue vulnerability in versions prior to 1.7.1, which stems from the plugin passing...

Sunnet eHRD Insecure Deserialization Vulnerability

Sunnet eHRD is a talent management system from Sun Chat Technology, Taiwan, China. The system supports talent management and performance management, etc. An insecure deserialization vulnerability exists in Sunnet eHRD, which stems from the inadequate input object validation and restriction of the...

AjaxPro Deserialization Remote Code Execution

This module leverages an insecure deserialization of data to get remote code execution on the target OS in the context of the user running the website which utilized AjaxPro. To achieve code execution, the module will construct some JSON data which will be sent to the target. This data will be...

CVE-2021-43360 Sunnet eHRD - Insecure Deserialization

Sunnet eHRD e-mail delivery task schedule’s serialization function has inadequate input object validation and restriction, which allows a post-authenticated remote attacker with database access privilege, to execute arbitrary code and control the system or interrupt services...

旭聊科技 Sunnet eHRD 代码问题漏洞

Sunnet eHRD is a talent management system from Sun Chat Technology, Taiwan, China. The system supports talent management and performance management, etc. An insecure deserialization vulnerability exists in Sunnet eHRD, which stems from the inadequate input object validation and restriction of the...

SolarWinds Orion Platform 2020.2.0 < 2020.2.6 Multiple Vulnerabilities

The version of SolarWinds Orion Platform installed on the remote host is prior to 2020.2.6. It is, therefore, affected by multiple vulnerabilities as referenced in the orionplatform202026 advisory. - An Improper Access Control Privilege Escalation Vulnerability was discovered in the User Setting ...

Apache ShardingSphere 代码问题漏洞

Apache ShardingSphere, an open source distributed database middleware solution from the Apache Foundation, has a security vulnerability in the Apache ShardingSphere UI that stems from insecure deserialization of serialized data received by the application from users, which could be exploited by a...

CVE-2021-42237

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability...

CVE-2021-42237

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability...

Deserialization of untrusted data

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability...

CVE-2021-42237

CVE-2021-42237 – Sitecore XP is an insecure deserialization vulnerability affecting Sitecore Experience Platform 7.5 to 8.2 Update-7, enabling remote code execution without authentication. Concrete details across connected docs show vulnerable versions include Sitecore XP 7.5.x (7.5.0–7.5.2) and ...

CVE-2021-42237

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability...

CVE-2021-42237

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability...

Sitecore 代码问题漏洞

Sitecore is an online marketing content management system CMS from Sitecore, Denmark. The system supports content editing, multiple languages, multi-site deployment, digital asset management, and more. Sitecore XP suffers from a security vulnerability that stems from Sitecore XP 7.5 through...

CVE-2021-42237

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability. Recent assessments:...

CVE-2021-33728

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. The affected system allows to upload JSON objects that are deserialized to JAVA objects. Due to insecure deserialization of user-supplied content by the affected software, a privileged attacker could exploit this...

Deserialization of untrusted data

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. The affected system allows to upload JSON objects that are deserialized to JAVA objects. Due to insecure deserialization of user-supplied content by the affected software, a privileged attacker could exploit this...

CVE-2021-33728

Summary of advisory for CVE-2021-33728 (Siemens SINEC NMS) Affected product: Siemens SINEC NMS (all versions

PT-2021-5577

Name of the Vulnerable Software and Affected Versions Sitecore XP versions 7.5 Initial Release through 8.2 Update-7 Description The issue is related to an insecure deserialization attack that can lead to remote command execution on the machine. No authentication or special configuration is requir...