Remote Code Execution

apache heron is vulnerable to remote code execution. The YAML parser is not configured by default to prevent the instantiation of arbitrary types, resulting in remote code execution vulnerabilities...

Remote code execution

Jenkins AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

Security Bulletin: IBM QRadar SIEM is vulnerable to instantiation of arbitrary objects (CVE-2020-4272)

Summary IBM QRadar SIEM is vulnerable to vulnerable to instantiation of arbitrary objects based on user-supplied input. Vulnerability Details CVEID: CVE-2020-4272 DESCRIPTION: IBM QRadar could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted...

CVE-2020-2166

Jenkins Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2020-2121

The CVE-2020-2121 issue affects Jenkins Google Kubernetes Engine Plugin versions 0.8.0 and earlier. The root cause is the plugin’s YAML parser configuration that permits instantiation of arbitrary types, enabling remote code execution. The vulnerability is exploitable by users who can supply YAML...

jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server.

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the mysql gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or Id.MINIMALCLASS...

jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server.

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the mysql gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or Id.MINIMALCLASS...

Fedora Update for php-brumann-polyfill-unserialize FEDORA-2019-af7bef7165

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Unsafe Deserialization

shopware/shopware is vulnerable to XML external entity attacks via unsafe deserialization. The sort parameter in the function loadPreviewAction in the ShopwareControllersBackendProductStream controller is not validated before PHP object instantiation is performed, which would allow an attacker to...

Deserialization of untrusted data

In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code...

CVE-2019-12799

In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code...

CVE-2019-12799

In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code...

CVE-2019-12799

Shopware vulnerability CVE-2019-12799 affects the createInstanceFromNamedArguments function in Shopware up to version 5.6.x, where a crafted web request can trigger PHP object instantiation leading to arbitrary deserialization and remote code execution. The issue bypasses a prior whitelist patch ...

CVE-2019-12799

In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code...

CVE-2017-18375

Ampache 3.8.3 allows PHP Object Instantiation via democratic.ajax.php and democratic.class.php...

Code injection

Ampache 3.8.3 allows PHP Object Instantiation via democratic.ajax.php and democratic.class.php...

UBUNTU-CVE-2017-18375

Ampache 3.8.3 allows PHP Object Instantiation via democratic.ajax.php and democratic.class.php...

CVE-2017-18375

Ampache 3.8.3 allows PHP Object Instantiation via democratic.ajax.php and democratic.class.php...

CVE-2017-18375

Ampache 3.8.3 allows PHP Object Instantiation via democratic.ajax.php and democratic.class.php...

CVE-2017-18375

Ampache 3.8.3 is affected by a vulnerability that allows PHP object instantiation via the files democratic.ajax.php and democratic.class.php. The connected sources consistently state this issue but do not provide technical specifics such as vulnerable functions, versions beyond 3.8.3, root cause ...