4517 matches found
Sun Java运行时环境多个远程权限提升漏洞
Sun的Java运行时环境（JRE）为JAVA应用程序提供可靠的运行环境。 Java运行时环境中存在两个序列化相关的漏洞，可能允许不可信任的Applet或应用程序提升权限。 Sun JRE = 5.0 Update 7 Sun SDK = 1.4.212 Sun已经为此发布了一个安全公告（Sun-Alert-102731）以及相应补丁: Sun-Alert-102731：Security Vulnerabilities Related to Serialization in the Java Runtime Environment may Allow Untrusted Applets ...
CVE-2006-6017
WordPress before 2.0.5 does not properly store a profile containing a string representation of a serialized object, which allows remote authenticated users to cause a denial of service application crash via a string that represents a 1 malformed or 2 large serialized object, because the object...
Sending multipart/form-data requests from Flash (with arbitrary headers)
Hello lists, In my original "Forging HTTP request headers with Flash" paper http://www.securityfocus.com/archive/1/441014, I mentioned forcing multipart/form-data input format to ensure that Flash's LoadVars isn't used to forge the request. However, there's a work-around for the attacker - using...
[Full-disclosure] ASP.NET RCP/Encoded Web service DOS
ASP.NET RCP/Encoded Web service DOS http://www.spidynamics.com/spilabs/advisories/aspRCP.html Release Date: July 11, 2005 Severity: High System Affected IIS Servers exposing ASP.NET Web services that consume arrays in RCP/Encoded mode Applications using System.Xml.Serialization to consume untrust...
CVE-2004-1068
A "missing serialization" error in the unixdgramrecvmsg function in Linux 2.4.27 and earlier, and 2.6.x up to 2.6.9, allows local users to gain privileges via a race condition...
CVE-2004-1068
A "missing serialization" error in the unixdgramrecvmsg function in Linux 2.4.27 and earlier, and 2.6.x up to 2.6.9, allows local users to gain privileges via a race condition...
security flaw
A "missing serialization" error in the unixdgramrecvmsg function in Linux 2.4.27 and earlier, and 2.6.x up to 2.6.9, allows local users to gain privileges via a race condition...
CVE-2004-1068
CVE-2004-1068 involves a missing serialization flaw in the unix_dgram_recvmsg path of Linux kernels 2.4.27 and earlier, and 2.6.x up to 2.6.9. The issue enables local users to potentially gain privileges due to a race condition. The description explicitly states the vulnerability is a local privi...
Python 1.5.2 Pickle - Unsafe eval() Code Execution
Python 1.5.2 Pickle - Unsafe eval Code Execution source: https://www.securityfocus.com/bid/5255/info Python is an open source, object oriented programming language. The Python Pickle module is provided to convert object variables into a serialized form "pickling", and later recover the data back...
Sendfile 1.x/2.1 - Forced Privilege Lowering Failure
source: https://www.securityfocus.com/bid/2652/info Sendfile is an implementation of the SAFT simple asynchronous file transfer protocol for UNIX systems. A serialization error exists in the Sendfile daemon, sendfiled. When used in conjunction with other problems found in the daemon, it may be...
Sendfile 1.x2.1 - Forced Privilege Lowering Failure
Sendfile 1.x2.1 - Forced Privilege Lowering Failure source: https://www.securityfocus.com/bid/2652/info Sendfile is an implementation of the SAFT simple asynchronous file transfer protocol for UNIX systems. A serialization error exists in the Sendfile daemon, sendfiled. When used in conjunction...
CVE-2022-40154
Removed by vendor...
CVE-2020-5220: Ability to define unintended serialisation groups via HTTP header which might lead to data exposure
Impact ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API. Anyone exposing an API with ResourceBundle's...
CVE-2019-18889: Forbid serializing AbstractAdapter and TagAwareAdapter instances
More info at https://symfony.com/cve-2019-18889...
Cookie serialization vulnerability
More info at https://laravel.com/docs/5.6/upgradeupgrade-5.6.30...