5578 matches found
DEBIAN-CVE-2016-3154
The encodercontexteajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object...
CVE-2016-3154
The encodercontexteajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object...
CVE-2016-3154
The encodercontexteajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object...
Design/Logic Flaw
The encodercontexteajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object...
CVE-2016-3154
The encodercontexteajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object...
CVE-2016-3154
The encodercontexteajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object...
CVE-2016-3154
SPIP contains a PHP object injection vulnerability (CVE-2016-3154) in the encoder_contexte_ajax path (ecrire/inc/filtres.php). The issue affects SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1, where deserializing crafted object data can allow remote attackers to inject object...
CVE-2016-3154
The encodercontexteajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object...
CVE-2016-3154: Improper Control of Generation of Code
The encodercontexteajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object...
PT-2016-5386
Name of the Vulnerable Software and Affected Versions SPIP versions 2.x prior to 2.1.19 SPIP versions 3.0.x prior to 3.0.22 SPIP versions 3.1.x prior to 3.1.1 Description The issue allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted...
WordPress Easy Digital Downloads Plugin <= 2.5.7 - PHP Object Injection
Because of this vulnerability, attackers can execute arbitrary PHP code. Solution Upgrade the plugin...
Easy Digital Downloads <= 2.5.7 - PHP Object Injection
Easy Digital Downloads unserializes user-submitted data from cookies and other request parameters, allowing for object injection...
WordPress Ninja Forms Plugin <= 2.9.42.0 - PHP Object Injection
This vulnerability allows an attacker to conduct PHP object injection attacks via crafted serialized values in a POST request. Solution Update the plugin...
CVE-2015-8562
Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015...
CVE-2015-8562
Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015...
CVE-2015-8562
CVE-2015-8562 affects Joomla! 1.5.x, 2.x, and 3.x prior to 3.4.6. The vulnerability enables remote PHP object injection that can lead to arbitrary code execution, originally described as exploitable via the HTTP User-Agent header. Public PoCs and exploits exist (e.g., Exploit-DB entries for CVE-2...
PT-2015-7807
Name of the Vulnerable Software and Affected Versions Joomla! versions 1.5.x through 3.x before 3.4.6 Description The issue allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header. This has been exploited in the wild...
CVE-2015-8562: Improper Input Validation
Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015...
CVE-2015-7808
The vBApiHook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in the arguments parameter to ajax/api/hook/decodeArguments...
Design/Logic Flaw
The vBApiHook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in the arguments parameter to ajax/api/hook/decodeArguments...