Products.CMFCore unauthenticated denial of service and crash via unchecked use of input with Python's marshal module

Impact The use of Python's marshal module to handle unchecked input in a public method on PortalFolder objects can lead to an unauthenticated denial of service and crash situation. The code in question is exposed by all portal software built on top of Products.CMFCore, such as Plone. All...

PYSEC-2023-113

Products.CMFCore are the key framework services for the Zope Content Management Framework CMF. The use of Python's marshal module to handle unchecked input in a public method on PortalFolder objects can lead to an unauthenticated denial of service and crash situation. The code in question is...

PYSEC-2023-113

Products.CMFCore are the key framework services for the Zope Content Management Framework CMF. The use of Python's marshal module to handle unchecked input in a public method on PortalFolder objects can lead to an unauthenticated denial of service and crash situation. The code in question is...

CVE-2023-36814

Affected product/component: Products.CMFCore (cmf/core for Zope CMF; PortalFolder public method). Vulnerability details: Unchecked input handled with Python’s marshal module can cause an unauthenticated denial of service and crash. The issue is exposed in portal software built on Products.CMFCore...

CVE-2023-36814 zopefoundation's Products.CMFCore vulnerable to unauthenticated denial of service and crash via unchecked use of input with Python's marshal module

Products.CMFCore are the key framework services for the Zope Content Management Framework CMF. The use of Python's marshal module to handle unchecked input in a public method on PortalFolder objects can lead to an unauthenticated denial of service and crash situation. The code in question is...

CVE-2023-36814 zopefoundation's Products.CMFCore vulnerable to unauthenticated denial of service and crash via unchecked use of input with Python's marshal module

Products.CMFCore are the key framework services for the Zope Content Management Framework CMF. The use of Python's marshal module to handle unchecked input in a public method on PortalFolder objects can lead to an unauthenticated denial of service and crash situation. The code in question is...

CVE-2023-36814 zopefoundation's Products.CMFCore vulnerable to unauthenticated denial of service and crash via unchecked use of input with Python's marshal module

Products.CMFCore are the key framework services for the Zope Content Management Framework CMF. The use of Python's marshal module to handle unchecked input in a public method on PortalFolder objects can lead to an unauthenticated denial of service and crash situation. The code in question is...

PT-2023-25705 · Python +3 · Python +3

Name of the Vulnerable Software and Affected Versions: Products.CMFCore versions prior to 3.2 Description: The use of Python's marshal module to handle unchecked input in a public method on PortalFolder objects can lead to an unauthenticated denial of service and crash situation. The code in...

Malicious code in fire-marshal-ebay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e514b2c29f7d622b664e41906ff14ed0ef411f12cd5feaca7177f2bb280fcb32 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3047 Malicious code in fire-marshal-ebay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e514b2c29f7d622b664e41906ff14ed0ef411f12cd5feaca7177f2bb280fcb32 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exploit for Command Injection in Rubyonrails Rails

PoC exploit for CVE-2019-5420, a Ruby deserialization vulnerabil...

Internet Bug Bounty: CVE-2022-28738: Double free in Regexp compilation

Due to a bug in the Regexp compilation process, creating a Regexp object with a crafted source string could cause the same memory to be freed twice. This is known as a “double free” vulnerability. Note that, in general, it is considered unsafe to create and use a Regexp object generated from...

MGASA-2021-0590 Updated libtpms/swtpm packages fix security vulnerability

CryptSym: fix AES output IV CVE-2021-3505. Fixed a context save and suspend/resume problem when public keys are loaded. Reset too large size indicators in TPM2B to avoid access beyond buffer CVE-2021-3623 Restore original value in buffer if unmarshalled one was illegal Fixed out-of-bounds access...

FreeBSD : Python -- multiple vulnerabilities (032643d7-0ba7-11ec-a689-080027e50e6d)

Python reports : bpo-42278: Replaced usage of tempfile.mktemp with TemporaryDirectory to avoid a potential race condition. bpo-41180: Add auditing events to the marshal module, and stop raising code.init events for every unmarshalled code object. Directly instantiated code objects will continue t...

Python -- multiple vulnerabilities

Python reports: bpo-42278: Replaced usage of tempfile.mktemp with TemporaryDirectory to avoid a potential race condition. bpo-41180: Add auditing events to the marshal module, and stop raising code.init events for every unmarshalled code object. Directly instantiated code objects will continue to...

Arbitrary Code Execution

Overview ruby-jss is a provides native ruby access to the REST APIs of Jamf Pro, an enterprise/education tool for managing Apple devices, from jamf.com. Affected versions of this package are vulnerable to Arbitrary Code Execution. This is due to the usage of the plist library, which has documente...

CVE-2021-33575

The Pixar ruby-jss gem before 1.6.0 allows remote attackers to execute arbitrary code because of the Plist gem's documented behavior of using Marshal.load during XML document processing...

Pixar ruby-jss 安全漏洞

ruby-jss is a Ruby framework for interacting with the JAMF Software Server JSS REST API. A security vulnerability in Pixar ruby-jss versions prior to 1.6.0, which stems from Marshal's documented behavior and is loaded during XML document processing, can be exploited by a remote attacker to execut...

RubyGems: Bundler's RCE with response using Marshal

A vulnerability was found in Bundler's dependency API endpoint, which uses Marshal serialization. This could allow for remote code execution if a client receives a specially crafted response. The impact is increased risk from specifying an untrusted source or man-in-the-middle attack...

@agoric/ertp (>=0.0.1, <=0.1.4), @agoric/marshal (>=0.0.1, <=0.1.0) +9 more potentially affected by unknown CVE via ses (>=0.0.1, <=0.5.3)

ses NPM version =0.0.1, =0.0.1, =0.0.1, =0.0.16, =0.0.0, =0.0.0, =0.0.0, =0.0.0, =0.0.4, =0.6.0, =0.0.0, =0.0.19 Source cves: unknown CVE Source advisory: OSV:GHSA-6JG8-7333-554W...