1828 matches found
Serious Phar Flaw Allows Arbitrary Code Execution on Drupal
Multiple content management systems – including Drupal, Joomla and Typo3 – are open to a vulnerability that can lead to arbitrary code execution on some systems. The flaw CVE-2019-11831 exists in the phar stream wrapper component used in PHP-driven projects. A Phar archive is used to distribute a...
By-passing protection of Phar Stream Wrapper Interceptor
Insecure deserialization is a vulnerability which occurs when untrusted data is used to abuse the logic of an application. In July 2018, the vulnerability of insecure deserialization when executing Phar archives was addressed by removing the known attack vector in the TYPO3 core. For more details...
By-passing protection of Phar Stream Wrapper Interceptor
Insecure deserialization is a vulnerability which occurs when untrusted data is used to abuse the logic of an application. In July 2018, the vulnerability of insecure deserialization when executing Phar archives was addressed by removing the known attack vector in the TYPO3 core. For more details...
Apache Solr Config API Insecure Deserialization Remote Code Execution (CVE-2019-0192)
An insecure deserialization vulnerability has been reported in Apache Solr. This vulnerability is due to the insufficient validation of requests to the Config API. A remote, unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request to the Config API...
Drupal Core stream wrapper Insecure Deserialization (CVE-2019-6339)
An insecure deserialization vulnerability exists in Drupal Core. The vulnerability is in a stream wrapper when performing file operations. Successful exploitation of this vulnerability could result in arbitrary code execution under the security context of the web server...
[20190502] - Core - By-passing protection of Phar Stream Wrapper Interceptor
In Joomla 3.9.3, the vulnerability of insecure deserialization when executing Phar archives was addressed by removing the known attack vector in the Joomla core. In order to intercept file invocations like fileexists or stat on compromised Phar archives the base name has to be determined and...
CVE-2018-19276
OpenMRS Platform vulnerability CVE-2018-19276 affects OpenMRS Platform
PT-2019-9785 · Openmrs · Openmrs
Name of the Vulnerable Software and Affected Versions: OpenMRS versions prior to 2.24.0 Description: The issue allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body. This is due to an Insecure Object Deserialization vulnerabilit...
Apache Solr Remote Code Execution Vulnerability
Apache Solr is an open source enterprise search platform written in Java. A remote code execution vulnerability exists in Apache Solr versions 5.0.0 - 5.5.5, 6.0.0 - 6.6.5. The vulnerability stems from the Config API allowing configuration of a JMX server via HTTP POST requests. An attacker can...
Oracle WebLogic Server Deployment Service Servlet Insecure Deserialization (CVE-2018-3252)
An insecure deserialization vulnerability exists in the Oracle WebLogic Server Deployment Service . The vulnerability is due to the lack of input validation by the servlet. A successful attack could lead to a remote code execution...
Oracle WebLogic Server Insecure Deserialization (CVE-2018-3245)
An insecure deserialization vulnerability exists in Oracle WebLogic Server. This vulnerability is due to deserialization of untrusted data. Successful exploitation can result in arbitrary code execution...
Zoho ManageEngine OpManager Insecure Deserialization (CVE-2018-19403)
An insecure deserialization vulnerability has been reported in ManageEngine OpManager.The vulnerability is due to deserialization of untrusted data. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
GE MDS PulseNET Insecure Deserialization (CVE-2018-10611)
An insecure deserialization vulnerability has been reported in GE MDS PulseNET and PulseNET Enterprise. The vulnerability is due to deserialization of untrusted data on a JBoss Remoting port. Successful exploitation can result in arbitrary code execution in the context of the user running PulseNE...
Apache Struts 2 Commons FileUpload Insecure Deserialization (CVE-2016-1000031)
An insecure deserialization vulnerability exists in Apache Struts 2. This vulnerability is due to Apache Struts 2 having a dependency on a vulnerable version of Commons FileUpload. Successful exploitation can result in arbitrary file upload within the security context of the target application...
Cisco Unity Express Arbitrary Command Execution Vulnerability
A Java deserialization vulnerability in Cisco Unity Express CUE could allow an unauthenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An...
Apache Struts Remote Code Execution (CVE-2016-1000031)
An insecure deserialization vulnerability has been reported in Apache Struts. This vulnerability is due to deseralization of untrusted data while having the vulnerable version of Apache-Commons-FileUpload library. A remote, unauthenticated attacker can exploit this vulnerability by sending a...
CVE-2016-0750
The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks...
CVE-2018-15691
Insecure deserialization of a specially crafted serialized object, in CA Release Automation 6.5 and earlier, allows attackers to potentially execute arbitrary code...
