CVE-2022-2903

The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import intentionally or not a malicious file and a suitable gadget chain is present on the blog...

Unserialized Pop Chain in Laravel

Withdrawn This advisory has been withdrawn because it is not a security issue and the CVE has been revoked. Original Description Laravel 9.1.8, when processing attacker-controlled data for deserialization, allows Remote Code Execution RCE via an unserialized pop chain in destruct in...

GHSA-VV7Q-MFPC-QGM5 Unserialized Pop Chain in Laravel

Withdrawn This advisory has been withdrawn because it is not a security issue and the CVE has been revoked. Original Description Laravel 9.1.8, when processing attacker-controlled data for deserialization, allows Remote Code Execution RCE via an unserialized pop chain in destruct in...

PT-2022-20661 · Laravel · Laravel

Name of the Vulnerable Software and Affected Versions: Laravel version 9.1.8 Description: The issue allows Remote Code Execution RCE via an unserialized pop chain in destruct in IlluminateBroadcastingPendingBroadcast.php and call in FakerGenerator.php when processing attacker-controlled data for...

Remote Code Execution

laravel/laravel is vulnerable to remote code execution. Improper deserialization in destruct in GuzzleHttp\Cookie\FileCookieJar.php allows an attacker to upload and execute malicious code via an unserialized pop chain...

EUVD-2014-3515

The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization, which allows remote attackers to execute arbitrary code via a crafted string that triggers use of a Hashtable destructor, relate...

The vulnerability of the `ext/standard/var_unserializer.re` component in the PHP programming language allows a perpetrator to cause a service failure or potentially have other adverse effects.

The vulnerability of the ext/standard/varunserializer.re component in the PHP programming language arises due to buffer overflow. Exploiting this vulnerability can allow an attacker to cause service failures or potentially have other effects through unserialized calls that reference partially...

TYPO3-CORE-SA-2020-004: Class destructors causing side-effects when being unserialized

More info at https://typo3.org/security/advisory/typo3-core-sa-2020-004...

TYPO3-CORE-SA-2020-004: Class destructors causing side-effects when being unserialized

More info at https://typo3.org/security/advisory/typo3-core-sa-2020-004...

Unsafe deserialization in SmtpTransport in CakePHP

An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction...

CVE-2019-18601

OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to denial of service from unserialized data access because remote attackers can make a series of VOTEDebug RPC calls to crash a database server within the SVOTEDebug RPC handler...

DEBIAN-CVE-2019-18601

OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to denial of service from unserialized data access because remote attackers can make a series of VOTEDebug RPC calls to crash a database server within the SVOTEDebug RPC handler...

Design/Logic Flaw

OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to denial of service from unserialized data access because remote attackers can make a series of VOTEDebug RPC calls to crash a database server within the SVOTEDebug RPC handler...

UBUNTU-CVE-2019-18601

OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to denial of service from unserialized data access because remote attackers can make a series of VOTEDebug RPC calls to crash a database server within the SVOTEDebug RPC handler...

CVE-2019-18601

OpenAFS (affected: OpenAFS before 1.6.24 and 1.8.x before 1.8.5) is vulnerable to denial of service via unserialized dataAccess: remote attackers can trigger VOTE_Debug RPC calls in SVOTE_Debug handler to crash the database server. Root cause: improper handling of unserialized data. Impact: avail...

CVE-2019-18601

OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to denial of service from unserialized data access because remote attackers can make a series of VOTEDebug RPC calls to crash a database server within the SVOTEDebug RPC handler...

CVE-2019-11458

An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction...

Remote Code Execution (RCE)

laravel/framework is vulnerable to remote code execution RCE. It can occur because there is an unserialized call on the potentially untrusted X-XSRF-TOKEN value. The attacker can execute arbitrary code when decrypting certain files if they have access to the application key...

Laravel framework remote code execution vulnerability

Laravel framework is a set of simple , elegant PHP Web development framework. A remote code execution vulnerability exists in Laravel framework versions 5.5.40 and earlier and versions 5.6.x through 5.6.29. The vulnerability stems from an unserialized call to an untrusted X-XSRF-TOKEN value. An...

JVN#47363774: WordPress plugin "Welcart e-Commerce" vulnerable to PHP object injection

WordPress plugin "Welcart e-Commerce" contains a PHP object injection vulnerability due to a flaw where untrusted POST values are unserialized. Impact A remote attacker may execute arbitrary PHP code. Solution Update the Software Update to the latest version according to the information provided ...