PT-2020-10457

Name of the Vulnerable Software and Affected Versions Pydio Core versions prior to 8.2.4 Pydio Enterprise versions prior to 8.2.4 Description A PHP object injection issue is present in the page plugins/core.access/src/RecycleBinManager.php, allowing an authenticated user with basic privileges to...

CVE-2019-20453: Deserialization of Untrusted Data

A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/uploader.http/HttpDownload.php. An authenticated user with basic privileges can inject objects and achieve remote code execution...

PT-2020-10458

Name of the Vulnerable Software and Affected Versions Pydio Core versions prior to 8.2.4 Pydio Enterprise versions prior to 8.2.4 Description A PHP object injection issue is present in the page plugins/uploader.http/HttpDownload.php. This allows an authenticated user with basic privileges to inje...

CVE-2020-8800

SuiteCRM through 7.11.11 allows EmailsControllerActionGetFromFields PHP Object Injection...

CVE-2020-8800

SuiteCRM through 7.11.11 allows EmailsControllerActionGetFromFields PHP Object Injection...

SuiteCRM 7.11.11 Bean Manipulation

-------------------------------------------------------------------------- SuiteCRM = 7.11.11 actionsaveHTMLField Bean Manipulation Vulnerability -------------------------------------------------------------------------- - Software Link: https://suitecrm.com/ - Affected Versions: Version 7.11.11...

CVE-2020-8800: Improper Neutralization of Special Elements in Output Used by a Downstream Component

SuiteCRM through 7.11.11 allows EmailsControllerActionGetFromFields PHP Object Injection...

SuiteCRM 7.11.11 Phar Deserialization

----------------------------------------------------------------- SuiteCRM = 7.11.11 Multiple Phar Deserialization Vulnerabilities ----------------------------------------------------------------- - Software Link: https://suitecrm.com/ - Affected Versions: Version 7.11.11 and prior versions. -...

SuiteCRM 7.11.11 Second-Order PHP Object Injection

--------------------------------------------------------------------- SuiteCRM = 7.11.11 Second-Order PHP Object Injection Vulnerabilities --------------------------------------------------------------------- - Software Link: https://suitecrm.com/ - Affected Versions: Version 7.11.11 and prior...

CVE-2014-1860

Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities...

Design/Logic Flaw

Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities...

CVE-2014-1860

Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities...

CVE-2014-1860

Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities...

PT-2020-7610

Name of the Vulnerable Software and Affected Versions Contao CMS versions prior to 3.2.5 Description The issue concerns PHP Object Injection vulnerabilities. Recommendations For Contao CMS versions prior to 3.2.5, update to version 3.2.5 or later to resolve the issue...

CVE-2014-1860: Deserialization of Untrusted Data

Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities...

DEBIAN-CVE-2019-14466

The GOsaFilterSettings cookie in GONICUS GOsa 2.7.5.2 is vulnerable to PHP objection injection, which allows a remote authenticated attacker to perform file deletions in the context of the user account that runs the web server via a crafted cookie value, because unserialize is used to restore...

CVE-2019-14466

The GOsaFilterSettings cookie in GONICUS GOsa 2.7.5.2 is vulnerable to PHP objection injection, which allows a remote authenticated attacker to perform file deletions in the context of the user account that runs the web server via a crafted cookie value, because unserialize is used to restore...

CVE-2019-14466

The GOsaFilterSettings cookie in GONICUS GOsa 2.7.5.2 is vulnerable to PHP objection injection, which allows a remote authenticated attacker to perform file deletions in the context of the user account that runs the web server via a crafted cookie value, because unserialize is used to restore...

CVE-2019-14466: Deserialization of Untrusted Data

The GOsaFilterSettings cookie in GONICUS GOsa 2.7.5.2 is vulnerable to PHP objection injection, which allows a remote authenticated attacker to perform file deletions in the context of the user account that runs the web server via a crafted cookie value, because unserialize is used to restore...

CVE-2019-19826

The Views Dynamic Fields module through 7.x-1.0-alpha4 for Drupal makes insecure unserialize calls in handlers/viewshandlerfilterdynamicfields.inc, as demonstrated by PHP object injection, involving a fieldnames object and an ArchiveTar object, for file deletion. Code execution might also be...