PT-2019-7500

Name of the Vulnerable Software and Affected Versions hhvm versions prior to 3.12.11 Description The issue is related to a use-after-free in the serialize memoize param and ResourceBundle:: construct functions. Recommendations For versions prior to 3.12.11, update to version 3.12.11 or later to...

CVE-2019-16247

Delta DCISoft 1.21 has a User Mode Write AV starting at CommLib!CCommLib::SetSerializeData+0x000000000000001b...

PYSEC-2019-166

The Serialize.deserialize method in CoAPthon3 1.0 and 1.0.1 mishandles certain exceptions, leading to a denial of service in applications that use this library e.g., the standard CoAP server, CoAP client, example collect CoAP server and client when they receive crafted CoAP messages...

Denial of Service

Overview Versions of serialize-to-js prior to 2.0.0 are vulnerable to Denial of Service. User input is not properly validated, allowing attackers to provide inputs that lead the execution to loop indefinitely. Recommendation Upgrade to version 2.0.0 or later. References GitHub Advisory...

WS-2019-0517

OpenType Sanitizer in versions v7.0.0 to v7.1.8 is vulnerable to heap-buffer-overflow in ots::OpenTypeSTAT::Serialize on src/stat.cc...

harfbuzz/hb-subset-fuzzer: Heap-buffer-overflow in CFF::CFF2VariationStore::serialize

Project: https://github.com/harfbuzz/harfbuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5660711141769216 Project: harfbuzz Fuzzer: libFuzzerharfbuzzhb-subset-fuzzer Fuzz target binary: hb-subset-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: Heap-buffer-overflo...

CVE-2018-19395

ext/standard/var.c in PHP 5.x through 7.1.24 on Windows allows attackers to cause a denial of service NULL pointer dereference and application crash because com and comsafearrayproxy return NULL in compropertiesget in ext/comdotnet/comhandlers.c, as demonstrated by a serialize call on...

@contrast/loopback-test-bench (3.15.0), @contrast/test-bench-utils (>=2.7.0, <=3.39.0) +34 more potentially affected by CVE-2017-5941 via node-serialize (>=0.0.3, <=0.0.4)

node-serialize NPM version =0.0.3, =2.7.0, =1.1.0, =1.0.1, =1.0.0, =1.1.1, =1.0.0, =1.0.4, =1.0.0, =1.0.0, =0.0.1, =1.0.4 and more Source cves: CVE-2017-5941 Source advisory: OSV:GHSA-Q4V7-4RHW-9HQM...

GHSA-Q4V7-4RHW-9HQM Code Execution through IIFE in node-serialize

Affected versions of node-serialize can be abused to execute arbitrary code via an immediately invoked function expression IIFE if untrusted user input is passed into unserialize. Recommendation There is no direct patch for this issue. The package author has reviewed this advisory, and provided t...

Code Execution through IIFE in node-serialize

Affected versions of node-serialize can be abused to execute arbitrary code via an immediately invoked function expression IIFE if untrusted user input is passed into unserialize. Recommendation There is no direct patch for this issue. The package author has reviewed this advisory, and provided t...

@contrast/loopback-test-bench (3.15.0), @contrast/test-bench-utils (>=2.7.0, <=3.39.0) +34 more potentially affected by CVE-2017-5941 via node-serialize (>=0.0.3, <=0.0.4)

node-serialize NPM version =0.0.3, =2.7.0, =1.1.0, =1.0.1, =1.0.0, =1.1.1, =1.0.0, =1.0.4, =1.0.0, =1.0.0, =0.0.1, =1.0.4 and more Source cves: CVE-2017-5941 Source advisory: GHSA-Q4V7-4RHW-9HQM...

GHSA-MM62-WXC8-CF7M Code Execution Through IIFE in serialize-to-js

Affected versions of serialize-to-js may be vulnerable to arbitrary code execution through an Immediately Invoked Function Expression IIFE. Proof of Concept js var payload = "e: function eval'console.logexploited' " var serialize = require'serialize-to-js'; serialize.deserializepayload;...

Code Execution Through IIFE in serialize-to-js

Affected versions of serialize-to-js may be vulnerable to arbitrary code execution through an Immediately Invoked Function Expression IIFE. Proof of Concept js var payload = "e: function eval'console.logexploited' " var serialize = require'serialize-to-js'; serialize.deserializepayload;...

PT-2018-3787

Name of the Vulnerable Software and Affected Versions PHP versions 5.x through 7.1.24 Description The issue is related to errors in pointer dereferencing in the PHP interpreter, specifically in the ext/standard/var.c component. This can be exploited by a remote attacker to cause a denial of...

PJSIP PJSUA2 SDK for Android Arbitrary Code Execution Vulnerability

PJSIP PJSUA2 SDK for Android is an Android-based software development kit that provides APIs for building Session Initiation Protocol SIP multimedia user agent applications. A security vulnerability exists in versions of the PJSIP PJSUA2 SDK for Android prior to SVN Changeset 51322. The...

Design/Logic Flaw

DISPUTED The deserialize function in serialize-to-js through 1.1.1 allows attackers to cause a denial of service via vectors involving an Immediately Invoked Function Expression "function" substring, as demonstrated by a "functionconsole.log" call or a simple infinite loop. NOTE: the vendor agree...

CVE-2017-15871

The deserialize function in serialize-to-js through 1.1.1 allows attackers to cause a denial of service via vectors involving an Immediately Invoked Function Expression "function" substring, as demonstrated by a "functionconsole.log" call or a simple infinite loop. NOTE: the vendor agrees that...

CVE-2017-15871

The deserialize function in serialize-to-js through 1.1.1 allows attackers to cause a denial of service via vectors involving an Immediately Invoked Function Expression "function" substring, as demonstrated by a "functionconsole.log" call or a simple infinite loop. NOTE: the vendor agrees that...

CVE-2017-15871

The deserialize function in serialize-to-js through 1.1.1 allows attackers to cause a denial of service via vectors involving an Immediately Invoked Function Expression "function" substring, as demonstrated by a "functionconsole.log" call or a simple infinite loop. NOTE: the vendor agrees that...

CVE-2017-15871

The CVE-2017-15871 entry affects the deserialize function in serialize-to-js (versions ≤ 1.1.1). Affected input involving an Immediately Invoked Function Expression substring (e.g., function(){console.log(…)}) can cause a denial of service. The vendor acknowledges the DoS risk and states deserial...