EUVD-2021-28602

Malicious code in bioql PyPI...

EUVD-2025-16888

Malicious code in bioql PyPI...

EUVD-2023-28958

Malicious code in bioql PyPI...

EUVD-2023-3294

Malicious code in bioql PyPI...

CVE-2025-20276

A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, remote attacker to execute arbitrary code on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insecure...

CVE-2025-20276: Deserialization of Untrusted Data

A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, remote attacker to execute arbitrary code on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insecure...

Cisco Unified CCX 代码问题漏洞

Cisco Unified CCX is a contact center software from Cisco USA. A code issue vulnerability exists in Cisco Unified CCX that stems from insecure deserialization of Java objects, which could lead to the execution of arbitrary code...

CVE-2024-28213

nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via unsafe Java objects deserialization...

CVE-2023-20258

A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. This vulnerability is due to improper processing of serialized Java objects by the affected...

CVE-2021-41588

In Gradle Enterprise before 2021.1.3, a crafted request can trigger deserialization of arbitrary unsafe Java objects. The attacker must have the encryption and signing keys...

CVE-2025-32408

In Soffid Console 3.6.31 before 3.6.32, authorization to use the pam service is mishandled...

CVE-2025-32408

CVE-2025-32408 affects Soffid Console prior to 3.6.32 (specifically 3.6.31 and earlier). The root cause is mishandled authorization to use the PAM service, as described in multiple sources. The base CVSS score is low (2.5, LOCAL access, high attack complexity, no user interaction). Red Hat and ot...

CVE-2024-6960

The H2O machine learning platform uses "Iced" classes as the primary means of moving Java Objects around the cluster. The Iced format supports inclusion of serialized Java objects. When a model is deserialized, any class is allowed to be deserialized no class whitelist. An attacker can construct ...

Untitled

org.pac4j:pac4j-core is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to the handling of serialized Java objects inside the InternalAttributeHandlerprepare method. An attacker can execute arbitrary code by providing a specially crafted attribute that contains a...

CVE-2024-6960

The H2O machine learning platform uses "Iced" classes as the primary means of moving Java Objects around the cluster. The Iced format supports inclusion of serialized Java objects. When a model is deserialized, any class is allowed to be deserialized no class whitelist. An attacker can construct ...

CVE-2024-6960 H2O deserializes ML models without filtering, potentially allowing execution of malicious code

The H2O machine learning platform uses "Iced" classes as the primary means of moving Java Objects around the cluster. The Iced format supports inclusion of serialized Java objects. When a model is deserialized, any class is allowed to be deserialized no class whitelist. An attacker can construct ...

CVE-2024-39669

The Soffid IAM Console is vulnerable to arbitrary code execution in the Sync Server due to insufficient checks applied to certain Java objects and the mishandling of authorization to use the pam service . Affected versions include Soffid Console 3.5.38 and 3.6.31 . To remediate, users should upda...

CVE-2024-39669

In the Console in Soffid IAM before 3.5.39, necessary checks were not applied to some Java objects. A malicious agent could possibly execute arbitrary code in the Sync Server and compromise security...

PT-2024-28608 · Soffid · Soffid Iam

Name of the Vulnerable Software and Affected Versions: Soffid IAM versions prior to 3.5.39 Description: The issue arises from insufficient checks applied to certain Java objects in the Console component of Soffid IAM. This could allow a malicious agent to execute arbitrary code in the Sync Server...

CVE-2023-46674

A flaw was found in elasticsearch-hadoop that allowed the unsafe deserialization of Java objects from Hadoop or spark configuration properties that could have been modified by authenticated users. Unsafe deserialization may impact integrity by allowing an attacker to modify unexpected objects or...