379957 matches found
Deserialization of Untrusted Data
Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the EditAction process of the comments plugin when the cb parameter is base64-decoded and passed to unserialize without restricting allowed classes. An attacker can execute arbitrary code or write...
UBUNTU-CVE-2026-57223
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Surica...
CVE-2026-57223
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Surica...
DEBIAN-CVE-2026-57223
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Surica...
CVE-2026-57223
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Surica...
CVE-2026-57223 Suricata windows: unquoted LocalSystem service ImagePath can allow local privilege escalation
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Surica...
EUVD-2026-83396
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Surica...
CVE-2026-57223
Suricata (OISF network IDS/IPS engine) prior to 7.0.17 and 8.0.6 contains a local privilege escalation vulnerability in its Windows service installation logic (src/win32-service.c). The service ImagePath is passed unquoted to CreateServiceA; if Suricata is installed under a path containing spaces...
CVE-2026-57223
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Surica...
CVE-2026-57223 Suricata windows: unquoted LocalSystem service ImagePath can allow local privilege escalation
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Surica...
CVE-2026-57223
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Surica...
CVE-2026-57223 Suricata windows: unquoted LocalSystem service ImagePath can allow local privilege escalation
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Surica...
CVE-2026-93872
Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize without allowedclasses restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file write or code execution through gadget chain...
CVE-2026-81937
IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the import remotelogconfig file CLI command. A highly privileged authenticated user can inject shell commands through the filename parameter, potentially resulting in arbitrary command execution with root...
CVE-2017-20284
Caucho Resin contains a path traversal vulnerability in the documentation webapp resin-doc that allows remote unauthenticated attackers to read arbitrary files by supplying a relative path through the inputFile request parameter of the jndi-appconfig tutorial servlet. Attackers can craft requests...
CVE-2026-93872 Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter
Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize without allowedclasses restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file write or code execution through gadget chain...
CVE-2026-93872 Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter
Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize without allowedclasses restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file write or code execution through gadget chain...
CVE-2026-93872 Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter
Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize without allowedclasses restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file write or code execution through gadget chain...
EUVD-2026-83369
Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize without allowedclasses restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file write or code execution through gadget chain...
CVE-2026-93872
Cotonti 1.0.0 is affected by a PHP object injection vulnerability in the comments plugin EditAction . The base64-decoded cb parameter is passed directly to unserialize() without an allowed_classes restriction, allowing registered users with comment write permissions to instantiate arbitrary PHP o...