DRUPAL-CONTRIB-2024-052

This module enables you to group nodes within pages that have a highly-granular, distributed permissions structure. In certain cases the module doesn't sufficiently sanitize data before passing it to PHP's unserialize function, which can result in arbitrary code execution...

Monster Menus - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-052

This module enables you to group nodes within pages that have a highly-granular, distributed permissions structure. In certain cases the module doesn't sufficiently sanitize data before passing it to PHP's unserialize function, which can result in arbitrary code execution...

PT-2024-41103 · Ооо 'Аспро' · Аспро: Digital 2.0 +14

Уязвимость функции unserialize платформ управления содержимым сайта Аспро связана с недостатками механизма десериализации. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить произвольный код с помощью специально сформированного POST-запроса...

Magento XXE Unserialize Arbitrary File Read

This module exploits a XXE vulnerability in Magento 2.4.7-p1 and below which allows an attacker to read any file on the system. Module Options msf use auxiliary/gather/magento/xxecve202434102 msf undefinedxxecve202434102 show actions ...actions... msf undefinedxxecve202434102 set ACTION msf...

GHSA-M2HP-5X78-74MG Insecure Unserialize Vulnerability in FLOW3

Due to a missing signature HMAC for a request argument, an attacker could unserialize arbitrary objects within FLOW3. To our knowledge it is neither possible to inject code through this vulnerability, nor are there exploitable objects within the FLOW3 Base Distribution. However, there might be...

Insecure Unserialize Vulnerability in FLOW3

Due to a missing signature HMAC for a request argument, an attacker could unserialize arbitrary objects within FLOW3. To our knowledge it is neither possible to inject code through this vulnerability, nor are there exploitable objects within the FLOW3 Base Distribution. However, there might be...

GHSA-C7RJ-92XR-WPRG Insecure Unserialize in TYPO3 Backend

Failing to properly validate incoming data, the suggest wizard is susceptible to insecure unserialize. To exploit this vulnerability a valid backend user account is needed...

Insecure Unserialize in TYPO3 Backend

Failing to properly validate incoming data, the suggest wizard is susceptible to insecure unserialize. To exploit this vulnerability a valid backend user account is needed...

GHSA-XVCP-33RC-J8GQ Insecure Unserialize in TYPO3 Import/Export

Failing to properly validate incoming import data, the Import/Export component is susceptible to insecure unserialize. To exploit this vulnerability a valid backend user account is needed...

Insecure Unserialize in TYPO3 Import/Export

Failing to properly validate incoming import data, the Import/Export component is susceptible to insecure unserialize. To exploit this vulnerability a valid backend user account is needed...

PT-2024-40359

Name of the Vulnerable Software and Affected Versions FLOW3 affected versions not specified Description The issue is related to a missing signature HMAC for a request argument, which could allow an attacker to unserialize arbitrary objects within FLOW3. It is noted that code injection through thi...

PT-2024-40238

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The suggest wizard is susceptible to insecure unserialize due to failing to properly validate incoming data. A valid backend user account is needed to exploit this issue...

PT-2024-40537

Name of the Vulnerable Software and Affected Versions: Import/Export component affected versions not specified Description: The issue arises from the Import/Export component's failure to properly validate incoming import data, making it susceptible to insecure unserialize. A valid backend user...

Remote Code Execution (RCE)

titon/framework is vulnerable to remote code execution. The vulnerability is due to calling the unserialize method on unverified cyphertext, which allows an attacker to execute arbitrary code...

Remote Code Execution (RCE)

cart2quote/module-quotation-encoded is vulnerable to Remote Code Execution RCE. The vulnerability is due to the use of the unserialize function when processing data from a GET request, which can be exploited by attackers to execute arbitrary code remotely, particularly when custom file options ar...

Insecure deserialize Vulnerability in FLOW3

Due to a missing signature HMAC for a request argument, an attacker could unserialize arbitrary objects within FLOW3. To our knowledge it is neither possible to inject code through this vulnerability, nor are there exploitable objects within the FLOW3 Base Distribution. However, there might be...

GHSA-PGJ4-G5J4-CMFX Withdrawn Advisory: cart2quote/module-quotation-encoded Remote Code Execution via downloadCustomOptionAction

Withdrawn Advisory This advisory has been withdrawn because it is specific to the Magento 1 implementation of cart2quote and does not apply to cart2quote/module-quotation-encoded. Original Description cart2quote/module-quotation-encoded extension may expose a critical security vulnerability by...

Withdrawn Advisory: cart2quote/module-quotation-encoded Remote Code Execution via downloadCustomOptionAction

Withdrawn Advisory This advisory has been withdrawn because it is specific to the Magento 1 implementation of cart2quote and does not apply to cart2quote/module-quotation-encoded. Original Description cart2quote/module-quotation-encoded extension may expose a critical security vulnerability by...

PT-2024-40399

Name of the Vulnerable Software and Affected Versions cart2quote/module-quotation-encoded extension affected versions not specified Description The issue is related to the utilization of the unserialize function when processing data from a GET request, posing a significant risk of Remote Code...

RHEL 5 : squirrelmail (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - squirrelmail: Insufficient escaping of user-supplied data CVE-2017-7692 - squirrelmail: use of unserializ...