Magento 2.0.6 Unserialize Remote Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Magento 2.0.6 Unserialize Remote Code Execution', 'Description' = %q This module exploits a PHP object injection vulnerability ...

Concrete5 CMS: source code security analysis report

Several vulnerabilities were discovered in Portland Labs 'Concrete5 CMS' software: File System Path Manipulation Using Global Variables Incorrect User Input Filtration when Using the unserialize Function Using Insufficiently Random Generators in Cryptography HttpOnly Cookies Incorrect Permissions...

Magento < 2.0.6 - Unauthenticated Arbitrary Unserialize -> Arbitrary Write File

Exploit for php platform in category web applications arbitrary write file // Date: 18/05/206 // Exploit Author: agix discovered by NETANEL RUBIN // Vendor Homepage: https://magento.com // Version: /shipping-information // in the response check the payment method it may vary from checkmo // // If...

WordPress CMS: source code security analysis report

Several vulnerabilities were discovered in Wordpress Foundation 'WordPress CMS' software: File System Path Manipulation Using Global Variables Incorrect User Input Filtration when Using the unserialize Function Using Insufficiently Random Generators in Cryptography HttpOnly Cookies Incorrect User...

MODX Revolution: source code security analysis report

Several vulnerabilities were discovered in MODX 'MODX Revolution' software: Incorrect User Input Filtration when Connecting to External Files File System Path Manipulation Using Global Variables Incorrect User Input Filtration when Using the unserialize Function Using Insufficiently Random...

Joomla!: source code security analysis report

Several vulnerabilities were discovered in Open Source Matters, Inc. 'Joomla!' software: Using Global Variables Incorrect User Input Filtration when Using the unserialize Function Using Insufficiently Random Generators in Cryptography Incorrect Permissions for External Entities During XML...

BigTree 4.2.8 Object Injection / Improper Filename Sanitization

Security Advisory - Curesec Research Team 1. Introduction Affected Product: BigTree 4.2.8 Fixed in: BigTree 4.2.9 Fixed Version Link: https://www.bigtreecms.org/download/ Vendor Website: https://www.bigtreecms.org/ Vulnerability Type: Object Injection & Improper Filename Sanitation Remote...

Amazon Linux AMI : php54 (ALAS-2016-670)

A NULL pointer dereference flaw was found in the XSLTProcessor class in PHP. An attacker could use this flaw to cause a PHP application to crash if it performed Extensible Stylesheet Language XSL transformations using untrusted XSLT files and allowed the use of PHP functions to be used as XSLT...

php: SOAP serialize_function_call() type confusion

A flaw was discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize function could cause a PHP application to crash or, possibly, execute arbitrary code...

php: Use After Free Vulnerability in unserialize()

A flaw was discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize function could cause a PHP application to crash or, possibly, execute arbitrary code...

Multiple vulnerabilities in extension "Fe user statistic" (festat)

It has been discovered that the extension "Fe user statistic" festat is susceptible to Cross-Site Scripting, Insecure Unserialize and Information Disclosure. Release Date: March 03, 2016 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affecte...

DOKEOS SSO Authentication Bypass Vulnerability

Dokeos is an open source online education and course management system. A security vulnerability exists in DOKEOS. The vulnerability is caused by a variable type obfuscation error when comparing passwords to unserializable strings during authentication, SSO authentication is not possible...

Internet Bug Bounty: Use-after-free vulnerability in SPL(SplObjectStorage, unserialize)

https://bugs.php.net/bug.php?id=71313...

Internet Bug Bounty: Use-after-free vulnerability in SPL(ArrayObject, unserialize)

https://bugs.php.net/bug.php?id=71311...

CVE-2015-6832

Use-after-free vulnerability in the SPL unserialize implementation in ext/spl/splarray.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to execute arbitrary code via crafted serialized data that triggers misuse of an array field...

CVE-2015-6832

CVE-2015-6832 is a use-after-free vulnerability in the SPL unserialize path (ext/spl/spl_array.c) of PHP. A crafted serialized payload can trigger misuse of an array field, allowing remote attackers to execute arbitrary code. Affected PHP versions: before 5.4.44, 5.5.x before 5.5.28, and 5.6.x be...

SSO Authentication Bypass and Website Takeover in DOKEOS

High-Tech Bridge Security Research Lab discovered a high-risk vulnerability in a popular e-learning software DOKEOS. A remote unauthenticated attacker can bypass authentication process and login to the vulnerable website with an arbitrary account including administrator's one. Successful...

Joomla 3.4.6 版本 unserialize 使用不当导致的代码执行

No description provided by source...

PHP process_nested_data 函数释放后重用漏洞

A while ago the function "processnesteddata" was changed to better handle object properties. Before it was possible to create numeric object properties which would cause trouble down the road. So the following code was added: if !objprops ... else / object properties should include no integers /...

Immunity Canvas: JOOMLA_SESSION_UNSERIALIZE

Name| joomlasessionunserialize ---|--- CVE| CVE-2015-8562 Exploit Pack| CANVAS Description| Joomla session unserialize 1.5 to 3.4.5 Notes| Repeatability: Infinite VENDOR: Joomla CVE Url: https://vulners.com/cve/CVE-2015-8562 CVE Name: CVE-2015-8562...