CVE-2014-6072: CSRF vulnerability in the Web Profiler

Affected Versions All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony WebProfiler bundle are affected by this security issue. This issue has been fixed in Symfony 2.3.19, 2.4.9, and 2.5.4. Note that no fixes are provided for Symfony 2.0, 2.1, and 2.2 as they are not maintaine...

Fedora 20 : php-5.5.14-1.fc20 (2014-7765)

26 Jun 2014, PHP 5.5.14 Core : - Fixed BC break introduced by patch for bug 67072. Anatol, Stas - Fixed bug 66622 Closures do not correctly capture the late bound class static:: in some cases. Levi Morrison - Fixed bug 67390 insecure temporary file use in the configure script. CVE-2014-3981 Remi ...

PHPSHE B2C商城系统 sql注入

简要描述： sql注入，可获取数据库任意信息 详细说明： sql注入，可获取数据库任意信息 漏洞触发位置，已经触发函数 构造一个关联数组，键就是sql语句，用serialize序列化 将序列化之后的值作为cookie 漏洞证明： 访问以下...

Security fix for the ALT Linux 10 package glpi version 0.83.9.1-alt1

July 21, 2013 Pavel Zilke 0.83.9.1-alt1 - Security fixes: + CVE-2013-2225 + CVE-2013-2227 : Security fix serialize + filter classname for autoload ALT 29189...

CVE-2013-0277

ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML...

PT-2013-2210

Name of the Vulnerable Software and Affected Versions Ruby on Rails versions prior to 2.3.17 Ruby on Rails versions 3.x prior to 3.1.0 Description The issue allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the serialize...

CVE-2013-0277 rubygem-activerecord: Serialized Attributes YAML Vulnerability with Rails 2.3 and 3.0

ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML...

Mozilla: Use-after-free in serializeToStream (MFSA 2013-16)

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before...

PHP source code in the unserialize function throws a vulnerability analysis-vulnerability warning-the black bar safety net

0×0 1 unserialize function concept First look at the official given explanation: unserialize on single serialized variable operation, convert back to PHP values. The return is after the conversion the value can be integer, float, string, array or object. If the passed string cannot be serialized,...

SuSE 11.1 Security Update : Linux kernel (SAT Patch Number 5732)

The SUSE Linux Enterprise 11 SP1 kernel was updated to 2.6.32.54, fixing lots of bugs and security issues. The following security issues have been fixed : - A potential hypervisor escape by issuing SGIO commands to partitiondevices was fixed by restricting access to these commands. CVE-2011-4127 ...

[pdf] PHP serialize, session and dynamics

Презентация с семинара ВМиК МГУ secsem.ru 2010 года. http://onsec.ru/php-unserialize.pdf Информация актуальная...

Heap overflow

Heap-based buffer overflow in the CDrawPoly::Serialize function in fxscover.exe in Microsoft Windows Fax Services Cover Page Editor 5.2 r2 in Windows XP Professional SP3, Server 2003 R2 Enterprise Edition SP2, and Windows 7 Professional allows remote attackers to execute arbitrary code via a long...

Apple WebCore XMLHttpRequest fails to properly serialize headers into an HTTP request

Overview Apple WebCore fails to properly serialize headers into an HTTP request, which can cause a cross-domain security violation. Description Apple WebCore is one of the components of the WebKit web browser engine that is used by Safari, Dashboard, Mail, and other applications. WebCore provides...