Design/Logic Flaw

The wikidecode Developer System Helper function in the admin panel in Kaltura before 13.2.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object...

CVE-2017-14141

The wikidecode Developer System Helper function in the admin panel in Kaltura before 13.2.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object...

CVE-2017-14141

The wikidecode Developer System Helper function in the admin panel in Kaltura before 13.2.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object...

CVE-2017-14141

The wikidecode Developer System Helper function in the admin panel in Kaltura before 13.2.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object...

CVE-2017-14141

CVE-2017-14141 affects Kaltura Server prior to 13.2.0. A vulnerability in the wiki_decode Developer System Helper in the admin panel allows remote attackers to perform PHP object injection and execute arbitrary PHP code via a specially crafted serialized object. Impact: arbitrary code execution w...

CVE-2017-14143

CVE-2017-14143 affects Kaltura prior to 13.2.0. The getUserzoneCookie function uses a hardcoded cookie secret to sign cookies, allowing remote attackers to bypass the intended protection and perform PHP object injection, resulting in arbitrary PHP code execution via a crafted userzone cookie. Pub...

CVE-2017-14141

The wikidecode Developer System Helper function in the admin panel in Kaltura before 13.2.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object...

CVE-2017-14143

The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote attackers to bypass an intended protection mechanism and consequently conduct PHP object injection attacks and execute arbitrary PHP code via a crafted userzon...

CVE-2017-14143

The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote attackers to bypass an intended protection mechanism and consequently conduct PHP object injection attacks and execute arbitrary PHP code via a crafted userzon...

PT-2017-6256

Name of the Vulnerable Software and Affected Versions CodeIgniter versions prior to 3.0 Kohana versions 3.2.3 and earlier Kohana versions 3.3.x through 3.3.2 Description The issue makes it easier for remote attackers to spoof session cookies and conduct PHP object injection attacks. This is...

CVE-2014-8684: Undefined Security Weakness

CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes...

PT-2017-13275

Name of the Vulnerable Software and Affected Versions Kaltura versions prior to 13.2.0 Description The issue concerns the wiki decode Developer System Helper function in the admin panel, which allows remote attackers to conduct PHP object injection attacks. This enables the execution of arbitrary...

CVE-2017-14143: Use of Hard-coded Credentials

The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote attackers to bypass an intended protection mechanism and consequently conduct PHP object injection attacks and execute arbitrary PHP code via a crafted userzon...

CVE-2017-14141: Deserialization of Untrusted Data

The wikidecode Developer System Helper function in the admin panel in Kaltura before 13.2.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object...

PT-2017-13277

Name of the Vulnerable Software and Affected Versions Kaltura versions prior to 13.2.0 Description The issue concerns the getUserzoneCookie function, which uses a hardcoded cookie secret to validate cookie signatures. This allows remote attackers to bypass an intended protection mechanism, conduc...

Exploit for Improper Input Validation in Joomla Joomla\!

JoomlaCVE-2015-8562 A proof of concept for Joomla's CVE-2015-...

Remote Code Execution (RCE)

Slim is vulnerable to Remote Code Execution RCE through PHP Object Injections. A malicious user can inject and execute arbitrary code when deserialising a SessionCookie object...

PHP Object Injection And Arbitrary Code Execution

anchorcms/anchor-cms is vulnerable to PHP object injection and arbitrary code execution. The vulnerability is possible because system/session/drivers/cookie.php does not filter malicious serialized objects in a cookie, allowing attackers to inject PHP objects and execute arbitrary PHP code...

Gravitate QA Tracker <= 1.2.1 - Unauthenticated PHP Object Injection

The plugin gravitate-qa-tracker insecurely trusts serialized data submitted over HTTP requests. This opens up the site to a PHP object injection vulnerability potential exploit vector. Attack is exploitable over HTTP requests to sites with the gravitate-qa-tracker Plugin. The original researcher...

Gravitate QA Tracker <= 1.2.1 - Unauthenticated PHP Object Injection

The plugin gravitate-qa-tracker insecurely trusts serialized data submitted over HTTP requests. This opens up the site to a PHP object injection vulnerability potential exploit vector. PoC Attack is exploitable over HTTP requests to sites with the gravitate-qa-tracker Plugin. The original...