CVE-2023-27372

SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1...

PT-2023-20173 · Unknown · Api Platform Core

Name of the Vulnerable Software and Affected Versions: API Platform Core versions 2.7 through 2.7.9 API Platform Core versions 3.0 through 3.0.11 API Platform Core versions 3.0.12 is not affected, versions 3.1 through 3.1.2 Description: Resource properties secured with the security option of the...

CVE-2023-27372

SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1...

CVE-2023-25575: Placement of User into Incorrect Group

API Platform Core is the server component of API Platform: hypermedia and GraphQL APIs. Resource properties secured with the security option of the ApiPlatform\Metadata\ApiProperty attribute can be disclosed to unauthorized users. The problem affects most serialization formats, including raw JSON...

CVE-2023-27372

SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1...

api-platform/core's secured properties may be accessible within collections

API Platform Core is the server component of API Platform: hypermedia and GraphQL APIs. Resource properties secured with the security option of the ApiPlatform\Metadata\ApiProperty attribute can be disclosed to unauthorized users. The problem affects most serialization formats, including raw JSON...

CVE-2023-27372

The SPIP CMS is vulnerable to Remote Code Execution (RCE) in versions prior to 4.2.1 (specifically branches 3.2, 4.0, 4.1, and 4.2). The root cause is a deserialization flaw in the protege_champ() function, which fails to properly validate serialized strings before calling unserialize(). This can...

CVE-2023-27372

SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1...

API Platform security vulnerabilities

API Platform is an open source web framework for creating API-first projects. A security vulnerability exists in API Platform Core that stems from a serialization formatting error, which can be exploited by an attacker to disclose data...

SPIP security vulnerabilities

SPIP is a freeware program from SPIP for creating Internet sites. A security vulnerability exists in SPIP versions prior to 4.2.1, which stems from improper serialization handling and can be exploited by an attacker to remotely execute code...

PT-2023-6830

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.2.1 SPIP versions 3.2.18 through 4.0.10 SPIP versions 4.1.8 through 4.2.1 SPIP version 3.2.11-3+deb11u7 Description SPIP is susceptible to a flaw related to the improper handling of untrusted data during memory...

Amazon Linux 2 : java-11-openjdk (ALASJAVA-OPENJDK11-2023-003)

The version of java-11-openjdk installed on the remote host is prior to 11.0.18.0.10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2JAVA-OPENJDK11-2023-003 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java ...

Medium: java-11-openjdk

Issue Overview: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Serialization. Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Difficult to...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2023-1963)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.362.b08-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1963 advisory. Improve CORBA communication: CORBA deserialization can result in outbound network connections with data passed i...

K25893729: Apache Dubbo vulnerability CVE-2021-25641

Security Advisory Description Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte preamb...

K77535578: Multiple Java SE client-side vulnerabilities

Security Advisory Description CVE-2016-0636 Unspecified vulnerability in Oracle Java SE 7u97, 8u73, and 8u74 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to the Hotspot sub-component. CVE-2016-0686 Unspecified vulnerability in Oracle...

CVE-2022-48282

Under very specific circumstances see Required configuration section below, a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C. This affects all MongoDB .NET/C Driver versions prior to and...

Design/Logic Flaw

Under very specific circumstances see Required configuration section below, a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C. This affects all MongoDB .NET/C Driver versions prior to and...

K64928095: Java SE vulnerability CVE-2019-2983

Security Advisory Description Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Serialization. Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attack...

K62701550: Multiple Java vulnerabilities

Security Advisory Description CVE-2022-21248 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Serialization. Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4...