CVE-2018-18628

An issue was discovered in Pippo 1.11.0. The function SerializationSessionDataTranscoder.decode calls ObjectInputStream.readObject to deserialize a SessionData object without checking the object types. An attacker can create a malicious object, base64 encode it, and place it in the PIPPOSESSION...

PT-2018-14546

Name of the Vulnerable Software and Affected Versions Pippo version 1.11.0 Description An issue was discovered where the SerializationSessionDataTranscoder.decode function calls ObjectInputStream.readObject to deserialize a SessionData object without checking the object types. This allows an...