3853 matches found
CVE-2018-20987
The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection...
Design/Logic Flaw
The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection...
CVE-2018-20987
CVE-2018-20987 affects the Newsletters Lite WordPress plugin. The connected documents confirm a PHP object injection flaw in newsletters-lite before version 4.6.8.6, caused by an insecure deserialization condition in the plugin’s code path. This vulnerability can enable remote code execution or s...
CVE-2018-20987
The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection...
CVE-2017-18583
The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection...
CVE-2017-18583
The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection...
CVE-2017-18583
CVE-2017-18583 affects the WordPress plugin post-pay-counter (before 2.731) with a PHP Object Injection flaw. The advisory sources identify this as a high/critical issue: CVSS v2 base score 7.5 (HIGH) and CVSS v3.0 base score 9.8 (CRITICAL) with network attack vector, no user interaction, and imp...
Breaking Into Your Company's Internal Network - SuiteCRM 7.11.4
As part of our efforts to make the open source web application space more secure we scanned SuiteCRM 7.11.4 with our static code analysis tool RIPS and we detected multiple critical vulnerabilities. Among them is a SQL Injection that can be exploited as a normal user CVE-2019-12598, which can be...
Agent Tesla Panel Remote Code Execution
This module exploits a command injection vulnerability within the Agent Tesla control panel, in combination with an SQL injection vulnerability and a PHP object injection vulnerability, to gain remote code execution on affected hosts. Panel versions released prior to Sepetember 12, 2018 can be...
e107 < 2.1.3 SQL Injection Vulnerability
e107 is prone to an SQL injection vulnerability through object injection. Copyright C 2019 Greenbone Networks GmbH, https://www.greenbone.net SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public...
CVE-2016-10753
e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC...
Sql injection
e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC...
CVE-2016-10753
e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC...
CVE-2016-10753
CVE-2016-10753 affects e107 2.1.2. It enables a PHP Object Injection vulnerability via usersettings.php that calls unserialize without an HMAC, which leads to a subsequent SQL injection. The root cause is improper handling of unserialize data, enabling an attacker-controlled object to affect data...
CVE-2019-5434
An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize call on the "what" parameter in the "openads.spc" RPC method. Such vulnerability could be used to perform various types of attacks, e.g. exploit serialize-related PHP vulnerabilities...
Option Tree < 2.7.0 - PHP Object Injection
The OptionTree WordPress plugin was affected by a PHP Object Injection security vulnerability...
TCPDF 6.2.19 Deserialization / Remote Code Execution Exploit
TCPDF versions 6.2.19 and below suffer from a deserialization vulnerability that can allow for remote code execution. CVE-2018-17057: phar deserialization in TCPDF might lead to RCE --------------------------------------------------------------- Affected products ================= TCPDF While it ...
Security Bulletin: Public disclosed vulnerabilities from Jackson-databind affects IBM Spectrum LSF
Summary Public disclosed vulnerabilities from Jackson-databind affects IBM Spectrum LSF: CVE-2017-7525, CVE-2017-15095, CVE-2017-17485, CVE-2018-5968, CVE-2018-7489 Vulnerability Details CVE-2017-7525 Jackson-databind Also implemented in JBoss BPM Suite is vulnerable to remote code execution when...
[SECURITY] [DLA 1673-1] wordpress security update
Package : wordpress Version : 4.1.25+dfsg-1+deb8u1 CVE ID : CVE-2018-20147 CVE-2018-20148 CVE-2018-20149 CVE-2018-20150 CVE-2018-20151 CVE-2018-20152 CVE-2018-20153 Debian Bug : 916403 CVE-2018-20147 Authors could modify metadata to bypass intended restrictions on deleting files. CVE-2018-20148...