CVE-2022-29528

An issue was discovered in MISP before 2.4.158. PHAR deserialization can occur...

CVE-2022-29528

An issue was discovered in MISP before 2.4.158. PHAR deserialization can occur...

CVE-2022-29528

An issue was discovered in MISP before 2.4.158. PHAR deserialization can occur...

PT-2022-19678 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP versions prior to 2.4.158 Description: An issue was discovered in MISP where PHAR deserialization can occur. Recommendations: For versions prior to 2.4.158, update to version 2.4.158 or later to resolve the issue...

MISP 代码问题漏洞

MISP is an open source software solution. The product is used to collect, store, distribute, and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A security vulnerability previously existed in MISP version 2.4.158, which stemmed from...

CVE-2021-45899

SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows PHAR deserialization that can lead to remote code execution...

CVE-2021-45899

SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows PHAR deserialization that can lead to remote code execution...

CVE-2021-45899

SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows PHAR deserialization that can lead to remote code execution...

Remote code execution

SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows PHAR deserialization that can lead to remote code execution...

CVE-2021-45899

SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows PHAR deserialization that can lead to remote code execution...

Concrete CMS arbitrary file deletion vulnerability

Concrete CMS is an open source content management system for teams.Concrete CMS 8.5.5 and earlier versions are vulnerable to arbitrary file deletion. An attacker could exploit the vulnerability to delete arbitrary files via PHAR deserialization in isdir...

CVE-2021-40102

An issue was discovered in Concrete CMS through 8.5.5. Arbitrary File deletion can occur via PHAR deserialization in isdir PHP Object Injection associated with the wakeup magic method...

CVE-2021-40102

An issue was discovered in Concrete CMS through 8.5.5. Arbitrary File deletion can occur via PHAR deserialization in isdir PHP Object Injection associated with the wakeup magic method...

Arbitrary file deletion

An issue was discovered in Concrete CMS through 8.5.5. Arbitrary File deletion can occur via PHAR deserialization in isdir PHP Object Injection associated with the wakeup magic method...

CVE-2021-40102

Concrete CMS up to 8.5.5 is affected by CVE-2021-40102 via PHAR deserialization in is_dir, enabling arbitrary file deletion. Root cause: PHP Object Injection through __wakeup in PHAR context. Exploitation chain observed includes uploading a PHAR payload and triggering deserialization via phar:// ...

CVE-2021-40102

An issue was discovered in Concrete CMS through 8.5.5. Arbitrary File deletion can occur via PHAR deserialization in isdir PHP Object Injection associated with the wakeup magic method...

in dompdf/dompdf

Description DomPDF is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the filegetcontents function. If an attacker can upload files of any type to the server he can pass in the phar:// protocol to unserialize the uploaded file and instantiate...

Concrete5 <= 8.5.5 Phar Deserialization Vulnerability

Concrete5 is prone to a deserialization vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:concretecms:concretecms"; ...

CiviCRM 5.22.0 - Code Execution Vulnerability Chain Explained

During our vulnerability research on the largest CMS systems we came across CiviCRM last year. It’s an open source CRM plugin for the most popular CMS systems like Wordpress, Joomla, Drupal, and Backdrop. CiviCRM is specifically designed for the needs of non-profit, non-governmental, and advocacy...

PHPMailer code issue vulnerability

PHPMailer is a PHP class library for sending emails. PHPMailer is vulnerable to a code issue that allows object injection via addAttachment with a UNC pathname via Phar deserialization. No details of the vulnerability are currently available...