CVE-2015-4034: Improper Access Control

The createFromParcel method in the com.absolute.android.persistence.MethodSpec class in Samsung Galaxy S5s allows remote attackers to execute arbitrary files via a crafted Parcelable object in a serialized MethodSpec object...

Sql injection

SQL injection vulnerability in Subrion CMS before 3.3.3 allows remote authenticated users to execute arbitrary SQL commands via modified serialized data in a salt cookie...

CVE-2015-4129

SQL injection vulnerability in Subrion CMS before 3.3.3 allows remote authenticated users to execute arbitrary SQL commands via modified serialized data in a salt cookie...

CVE-2015-4129

CVE-2015-4129 is a SQL injection vulnerability in Subrion CMS prior to 3.3.3. The issue arises from processing modified serialized data in a salt cookie, allowing remote authenticated users to execute arbitrary SQL commands. Affected software: Subrion CMS; vulnerable component: cookie serializati...

PT-2015-6422

Name of the Vulnerable Software and Affected Versions Subrion CMS versions prior to 3.3.3 Description The issue allows remote authenticated users to execute arbitrary SQL commands via modified serialized data in a salt cookie. Recommendations For versions prior to 3.3.3, update to version 3.3.3 o...

CVE-2015-4129: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Subrion CMS before 3.3.3 allows remote authenticated users to execute arbitrary SQL commands via modified serialized data in a salt cookie...

PHP 'do_soap_call' Sensitive Information Disclosure Vulnerability

PHP is a general-purpose programming language. The 'dosoapcall' function in PHP's ext/soap/soap.c file does not verify that the uri attribute is a string, allowing remote attackers to provide serialized data with the int data type to obtain sensitive information...

EUVD-2015-4172

The dosoapcall function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri property is a string, which allows remote attackers to obtain sensitive information by providing crafted serialized data with an int data type, related to a...

UBUNTU-CVE-2015-4148

The dosoapcall function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri property is a string, which allows remote attackers to obtain sensitive information by providing crafted serialized data with an int data type, related to a...

CVE-2015-4147

The SoapClient::call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that defaultheaders is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a...

CVE-2015-4147: Undefined Security Weakness

The SoapClient::call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that defaultheaders is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a...

CVE-2015-4084 - WordPress Free Counter Plugin [Stored XSS]

Exploit Title: WordPress Free Counter Plugin Stored XSS Date: 2015/05/25 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://www.free-counter.org Software Link: https://wordpress.org/plugins/free-counter/ Version: 1.1 Tested on: WordPress 4.2.2...

CVE-2015-4067: Undefined Security Weakness

Integer overflow in the libnv6 module in Dell NetVault Backup before 10.0.5 allows remote attackers to execute arbitrary code via crafted template string specifiers in a serialized object, which triggers a heap-based buffer overflow...

Dell NetVault Backup Heap Buffer Overflow Remote Code Execution Vulnerability

NetVault Backup is a cross-platform backup and recovery software solution that protects data and applications in physical and virtual environments. It is scalable and supports multiple server and application platforms across the enterprise. It has a single, intuitive interface that requires minim...

WordPress Plugin Free Counter 1.1 - Persistent Cross-Site Scripting

WordPress Plugin Free Counter 1.1 - Persistent Cross-Site Scripting Exploit Title: WordPress Free Counter Plugin Stored XSS Date: 2015/05/25 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://www.free-counter.org Software Link:...

Code injection

Bomgar Remote Support before 15.1.1 allows remote attackers to execute arbitrary PHP code via crafted serialized data to unspecified PHP scripts...

PT-2015-4983

Name of the Vulnerable Software and Affected Versions Bomgar Remote Support versions prior to 15.1.1 Description The issue allows remote attackers to execute arbitrary PHP code via crafted serialized data to unspecified PHP scripts. Recommendations For versions prior to 15.1.1, update to version...

CVE-2015-0935: Improper Control of Generation of Code

Bomgar Remote Support before 15.1.1 allows remote attackers to execute arbitrary PHP code via crafted serialized data to unspecified PHP scripts...

Laravel 'prepareForUnserialize()' function remote PHP object injection vulnerability

Laravel is a set of PHP development framework. A remote PHP object injection vulnerability exists in Laravel that allows remote attackers to submit specially crafted serialized objects, delete and read files, and execute arbitrary local script code...

PHP Core Unserialize Key Name Code Execution - Ver2 (CVE-2015-0231)

A code execution vulnerability has been reported in PHP core. The vulnerability is due to a use after free error when handling serialized objects with identical number key names within the unserialize function. An attacker could exploit this vulnerability by sending crafted serialized data to a w...