RubyGems Remote Code Execution Vulnerability

RubyGems is a package manager for Ruby that provides a standard format for distributing Ruby programs and libraries called "gems", and is designed to make it easy to manage gem installations and the servers used to distribute them. A remote code execution vulnerability exists in RubyGems, which c...

Remote code execution

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution...

CVE-2017-0903

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution...

CVE-2017-0903

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution...

CVE-2017-12149

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code vi...

CVE-2017-12149

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code vi...

Elastic Elasticsearch ThrowableObjectInputStream Insecure Deserialization (CVE-2015-5377)

An insecure deserialization vulnerability exists in Elastic Elasticsearch. This vulnerability is due to the deserialization of untrusted ThrowableObjectInputStream data.A remote, unauthenticated attacker could exploit this vulnerability by sending crafted serialized data to the target application...

Kaltura PHP Object Injection Vulnerability (CNVD-2017-33583)

Kaltura is an open source online video platform from Kaltura Inc. wikidecode Developer System Helper is one of the helpers. A security vulnerability exists in the wikidecode Developer System Helper function in the admin panel of Kaltura versions prior to 13.2.0. The vulnerability can be exploited...

Design/Logic Flaw

The wikidecode Developer System Helper function in the admin panel in Kaltura before 13.2.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object...

Astaro Security Gateway 7 Remote Code Execution

!/usr/bin/python Astaro Security Gateway v7 - Unauthenticated Remote Code Execution Exploit Authors: Jakub Palaczynski and Maciej Grabiec Tested on versions: 7.500 and 7.506 Date: 13.12.2016 Vendor Homepage: https://www.sophos.com/ CVE: CVE-2017-6315 import socket import sys import os import...

Astaro Security Gateway 7 - Remote Code Execution

Astaro Security Gateway 7 - Remote Code Execution !/usr/bin/python Astaro Security Gateway v7 - Unauthenticated Remote Code Execution Exploit Authors: Jakub Palaczynski and Maciej Grabiec Tested on versions: 7.500 and 7.506 Date: 13.12.2016 Vendor Homepage: https://www.sophos.com/ CVE:...

Astaro Security Gateway 7 - Remote Code Execution

!/usr/bin/python Astaro Security Gateway v7 - Unauthenticated Remote Code Execution Exploit Authors: Jakub Palaczynski and Maciej Grabiec Tested on versions: 7.500 and 7.506 Date: 13.12.2016 Vendor Homepage: https://www.sophos.com/ CVE: CVE-2017-6315 import socket import sys import os import...

CVE-2017-11153

Deserialization vulnerability in synophotocsPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to gain administrator privileges via a crafted serialized payload...

SSRF, Memcached and other key-value injections in the wild

Back in 2012 we released SSRF a different techniques to exploit Memcached servers and other services with host-based authentication through SSRF. Two years after, in 2014, I presented a Memcached injection techniques at Black Hat USA . There I mentioned that it’s possible to exploit it as a Remot...

The vulnerability of the Jython software platform, related to the restoration of unreliable data in memory, allowing a hacker to execute arbitrary code.

The vulnerability of the Jython software platform lies in the possibility of restoring unreliable data in memory. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code using a specially created serialized object of type PyFunction...

PHP Object Injection

Moodle is vulnerable to PHP object injection and arbitrary code execution. The repositories component of Moodle contains a flaw which allows these attacks through serialized data containing objects defined in an add-on...

PHP Object Injection And Arbitrary Code Execution

anchorcms/anchor-cms is vulnerable to PHP object injection and arbitrary code execution. The vulnerability is possible because system/session/drivers/cookie.php does not filter malicious serialized objects in a cookie, allowing attackers to inject PHP objects and execute arbitrary PHP code...

Oracle Primavera P6 Enterprise Project Portfolio Management (EPPM) Multiple Vulnerabilities (July 2017 CPU)

According to its self-reported version number, the Oracle Primavera P6 Enterprise Project Portfolio Management EPPM installation running on the remote web server is 8.3.x prior to 8.3.15.4, 8.4.x prior to 8.4.15.2, 15.x prior to 15.2.15.1, or 16.x prior to 16.2.9.0. It is, therefore, affected by...

CVE-2016-6793

The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service infinite loop and write to, move, and delete files with the permissions of DiskFileItem, and if running on a Java VM before 1.3.1, execute arbitrary code via a...

SAP NetWeaver Denial of Service Vulnerability (CNVD-2017-23559)

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A security vulnerability exists in SAP NetWeaver. A remote attacker could exploit this vulnerability by sending ...