MessagePack allows untrusted data to lead to DoS attack due to hash collisions and stack overflow

Impact When this library is used to deserialize messagepack data from an untrusted source, there is a risk of a denial of service attack by an attacker that sends data contrived to produce hash collisions, leading to large CPU consumption disproportionate to the size of the data being deserialize...

GHSA-4QM4-8HG2-G2XM MessagePack allows untrusted data to lead to DoS attack due to hash collisions and stack overflow

Impact When this library is used to deserialize messagepack data from an untrusted source, there is a risk of a denial of service attack by an attacker that sends data contrived to produce hash collisions, leading to large CPU consumption disproportionate to the size of the data being deserialize...

CVE-2024-49318

CVE-2024-49318 affects the WordPress My Reading Library plugin (versions

CVE-2024-49318 WordPress My Reading Library plugin <= 1.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Scott My Reading Library my-reading-library allows Object Injection.This issue affects My Reading Library: from n/a through = 1.0...

WordPress plugin My Reading Library 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

PT-2024-33272 · Unknown · Messagepack-Csharp

Name of the Vulnerable Software and Affected Versions: MessagePack-CSharp versions prior to 2.5.187 and 3.0.214 Description: The vulnerability occurs when the library is used to deserialize messagepack data from an untrusted source, leading to a risk of a denial of service attack by an attacker...

MessagePack for C# 安全漏洞

MessagePack for C is a MessagePack serializer from the MessagePack-CSharp open source. A security vulnerability exists in MessagePack for C versions prior to 2.5.187 and versions prior to 2.6.95-alpha through 3.0.214-rc.1, which stems from a disproportionately large amount of CPU consumption duri...

CVE-2024-49227

Deserialization of Untrusted Data vulnerability in foter Free Stock Photos Foter free-stock-photos-foter allows Object Injection.This issue affects Free Stock Photos Foter: from n/a through = 1.5.4...

CVE-2024-48026 WordPress Disc Golf Manager plugin <= 1.0.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in GMRobbins Disc Golf Manager disc-golf-manager allows Object Injection.This issue affects Disc Golf Manager: from n/a through = 1.0.0...

CVE-2024-48030

CVE-2024-48030 describes a PHP object deserialization vulnerability in the WordPress plugin Telecash Ricaricaweb (versions

CVE-2024-49218 WordPress Recently plugin <= 1.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Al Imran Akash Recently recently-viewed-most-viewed-and-sold-products-for-woocommerce allows Object Injection.This issue affects Recently: from n/a through = 1.1...

CVE-2024-49218 WordPress Recently plugin <= 1.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Al Imran Akash Recently recently-viewed-most-viewed-and-sold-products-for-woocommerce allows Object Injection.This issue affects Recently: from n/a through = 1.1...

CVE-2024-49226

CVE-2024-49226 affects TAKETIN To WP Membership (WordPress plugin) up to version 2.8.0. It is a PHP Object Injection (Deserialization of Untrusted Data) vulnerability that can enable arbitrary object injection. Impact is described as high in CVSS (8.8, HIGH) with potential for full compromise of ...

CVE-2024-49226 WordPress TAKETIN To WP Membership plugin <= 2.8.17 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in taketin TAKETIN To WP Membership taketin-to-wp-membership allows Object Injection.This issue affects TAKETIN To WP Membership: from n/a through = 2.8.17...

CVE-2024-49227 WordPress Free Stock Photos Foter plugin <= 1.5.4 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in foter Free Stock Photos Foter free-stock-photos-foter allows Object Injection.This issue affects Free Stock Photos Foter: from n/a through = 1.5.4...

Exploit for Deserialization of Untrusted Data in Apache Activemq

CVE-2023-46604 !imagehttps://github.com/user-attachments/ass...

PT-2024-33362 · WordPress · Taketin To Wp Membership

Name of the Vulnerable Software and Affected Versions: TAKETIN To WP Membership versions 2.8.0 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. This can lead to potential security risks. Recommendations: For versions 2.8.0 and...

PT-2024-33363 · Innovaweb Sp. Z O.O. · Foter

Name of the Vulnerable Software and Affected Versions: Innovaweb Sp. Z o.O. Free Stock Photos Foter versions 1.5.4 and earlier Description: The issue is related to Deserialization of Untrusted Data, which leads to Object Injection. This allows for potential exploitation. Recommendations: For...

Microsoft Exchange SerializationTypeConverter Deserialization of Untrusted Data NTLM Relay Vulnerability

This vulnerability allows remote attackers to relay NTLM credentials on affected installations of Microsoft Exchange. Authentication is required to exploit this vulnerability. The specific flaw exists within the SerializationTypeConverter class. The issue results from the lack of proper validatio...

PT-2024-32948 · Gabriele Valenti · Telecash Ricaricaweb

Name of the Vulnerable Software and Affected Versions: Telecash Ricaricaweb versions n/a through 2.2 Description: A Deserialization of Untrusted Data vulnerability is present in Gabriele Valenti's Telecash Ricaricaweb, allowing Object Injection. This issue affects the specified versions of Teleca...