CVE-2019-12630 Cisco Security Manager Java Deserialization Vulnerability

A vulnerability in the Java deserialization function used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An...

CVE-2019-15321

The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled...

CVE-2019-15321

The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled...

CVE-2019-15321

CVE-2019-15321 applies to the WordPress plugin “Option Tree” prior to version 2.7.3, where an Object Injection vulnerability arises from mishandled serialized classes. The entry is documented across multiple sources (NVD description: “option-tree plugin before 2.7.3 for WordPress has Object Injec...

PT-2019-14050

Name of the Vulnerable Software and Affected Versions option-tree plugin versions prior to 2.7.3 Description The issue is related to Object Injection due to the mishandling of serialized classes. Recommendations For versions prior to 2.7.3, update to version 2.7.3 or later to resolve the issue...

NewStart CGSL MAIN 4.05 : xmlrpc3 Vulnerability (NS-SA-2019-0136)

The remote NewStart CGSL host, running version MAIN 4.05, has xmlrpc3 packages installed that are affected by a vulnerability: - A flaw was discovered in the Apache XML-RPC ws-xmlrpc library that deserializes untrusted data when enabledForExtensions setting is enabled. A remote attacker could use...

NewStart CGSL CORE 5.04 / MAIN 5.04 : xmlrpc Vulnerability (NS-SA-2019-0037)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has xmlrpc packages installed that are affected by a vulnerability: - A flaw was discovered in the Apache XML-RPC ws-xmlrpc library that deserializes untrusted data when enabledForExtensions setting is enabled. A remote attacke...

OpenMRS Platform Insecure Deserialization (CVE-2018-19276)

An Insecure Deserialization vulnerability exists in OpenMRS platform. A remote attacker can exploit this vulnerability by sending a specially crafted serialized object. Successful exploitation can result in arbitrary code execution in the effected system...

Arbitrary Code Execution

Apache Commons Collections ACC library is vulnerable to Arbitrary Code Execution. The vulnerability is possible because it directly uses ACC, or contains ACC, in the classpath, which allows an attacker to gain read access to unnecessary information in debug messages by sending modified requests...

Security Bulletin: Remote code execution in WebSphere Application Server ND (CVE-2019-4279)

Summary There is a remote code execution vulnerability in WebSphere Application Server Network Deployment. Vulnerability Details CVEID: CVE-2019-4279 DESCRIPTION: IBM WebSphere Application Server ND could allow a remote attacker to execute arbitrary code on the system with a specially-crafted...

Remote Code Execution (RCE)

hessian is remote code execution RCE vulnerability. It misses the blacklisting of Resin Gadget due to improper handling of com.caucho.naming.QName and com.sun.org.apache.xpath.internal.objects.XString when the attacker sends malicious serialized Hessian object...

IBM WebSphere Application Server Remote Code Execution Vulnerability (CVE-2018-1904)

The IBM WebSphere Application Server running on the remote host is version 7.0.0.0 through 7.0.0.45, 8.0.0.0 through 8.0.0.15, 8.5.x prior to 8.5.5.15, or 9.0.0.x prior to 9.0.0.10. It is, therefore, affected by a remote code execution vulnerability that allows remote attackers to execute arbitra...

PT-2019-12168

Name of the Vulnerable Software and Affected Versions Sitecore Experience Platform XP versions prior to 9.1.1 Description The issue allows remote code execution via deserialization. An authenticated user with necessary permissions can remotely execute OS commands by sending a crafted serialized...

CVE-2019-11080: Deserialization of Untrusted Data

Sitecore Experience Platform XP prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS 293863. An authenticated user with necessary permissions is able to remotely execute OS commands by sending a crafted serialized object...

PT-2019-19909 · Sitecore · Sitecore

Name of the Vulnerable Software and Affected Versions: Sitecore versions prior to 9.1 Description: The issue allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter, due to the deserialization of untrusted data in the anti CSRF...

CVE-2019-4279

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 160445...

CVE-2019-4279

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 160445...

Code injection

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 160445...

CVE-2019-4279 - IBM WebSphere Application Server

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 160445. – nvd.nist.gov description Recent assessments: jrobles-r7 at May 29, 2019 4:00...

Use After Free

PHP is vulnerable to use after free vulnerability. This exists in ext/standard/var.c which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data...