Remote Code Execution (RCE)

Overview studio-42/elfinder is an open-source file manager for web, written in JavaScript using jQuery UI. Affected versions of this package are vulnerable to Remote Code Execution RCE via execution of PHP code in a .phar file. NOTE: This only applies if the server is configured to parse .phar...

CVE-2021-32098

Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization...

CVE-2021-32098

Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization...

Deserialization of untrusted data

Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization...

CVE-2021-32098

Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization...

CVE-2021-32098

Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization...

CVE-2021-32098

CVE-2021-32098 affects Artica Pandora FMS 742. Connected documents corroborate a deserialization vulnerability in Phar deserialization that allows unauthenticated access. The vulnerability details (affected version, root cause, impact) are consistently described across sources; no explicit fix or...

Artica Pandora FMS 代码问题漏洞

Artica Pandora FMS is a monitoring system from the Spanish company Artica. The system monitors networks, servers, virtual infrastructures, applications, etc. in a visual way. Artica Pandora FMS version 742 suffers from a deserialization vulnerability that can be exploited by an attacker to perfor...

PHPMailer 6.1.8 < 6.4.1 Object Injection Vulnerability

PHPMailer contains an object injection vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Chamilo 输入验证错误漏洞

Chamilo LMS is an open source online learning and collaboration system from the Chamilo Association. The system supports the creation of instructional content, distance training, and online question and answer sessions. A security vulnerability exists in Chamilo version 1.11.14 and prior versions...

Object injection via local phar file

This is a security release. SECURITY Fixes CVE-2020-36326, a regression of CVE-2018-19296 object injection introduced in 6.1.8, see SECURITY.md for details Reject more file paths that look like URLs, matching RFC3986 spec, blocking URLS using schemes such as ssh2 Ensure method signature consisten...

Arbitrary Code Execution

phpmailer/phpmailer is vulnerable to arbitrary code execution. An attacker is able to exploit the vulnerability by injecting malicious code via the Phar Deserialization via addAttachment with a UNC pathname...

Deserialization of Untrusted Data

Overview jakubpas/suitecrm is a composer fork of SuiteCRM - the open source alternative to SalesForce, Microsoft Dynamics and SugarCRM Professiona Affected versions of this package are vulnerable to Deserialization of Untrusted Data. Phar Deserialization is possible due to insufficient checks...

DEBIAN-CVE-2020-36326

PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in...

CVE-2020-36326

PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in...

CVE-2020-36326

PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in...

CVE-2020-36326

PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in...

Deserialization of untrusted data

PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in...

UBUNTU-CVE-2020-36326

PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in...

CVE-2020-36326

PHPMailer is affected in versions 6.1.8–6.4.0 by an object-injection vulnerability via Phar deserialization when using addAttachment with a UNC pathname. The issue arose after 6.1.8 fixed a UNC-path readability problem, unintentionally removing a block that previously prevented exploitation. Mult...