Facebook ParlAI 1.0.0 - Deserialization of Untrusted Data in parlai

Exploit Title: Facebook ParlAI 1.0.0 - Deserialization of Untrusted Data in parlai Date: 2021-09-11 Exploit Author: Abhiram V Vendor Homepage: https://parl.ai/ Software Link: https://github.com/facebookresearch/ParlAI Version: 1.1.0 Tested on: Linux CVE: CVE-2021-24040 References :...

Deserialization of untrusted data

parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable to YAML deserialization attack caused by unsafe loading which leads to Arbitary code execution. This security bug is patched by avoiding...

Deserialization of untrusted data

The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there's an exception that the attacker can use to skip the security check when enabled and reaching a deserialization operation with native jav...

Remote code execution

Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. An Authenticated Attacker could exploit it by executing WSAsyncExecuteTasks deserialization of untrusted data...

mrdoc code issue vulnerability

mrdoc is an online documentation system developed in python. mrdoc has a security vulnerability that can be exploited by attackers to deserialize untrusted data...

CVE-2021-32568

mrdoc is vulnerable to Deserialization of Untrusted Data...

CVE-2021-32568

mrdoc is vulnerable to Deserialization of Untrusted Data...

Deserialization of untrusted data

mrdoc is vulnerable to Deserialization of Untrusted Data...

CVE-2021-32568

mrdoc is vulnerable to Deserialization of Untrusted Data...

CVE-2021-32568

CVE-2021-32568 affects mrdoc, a Python-based online documentation system. The connected Huntr entry indicates the vulnerability can lead to remote code execution via YAML.load in the import function, with a PoC showing an RCE payload. No official patch/version is provided in the supplied material...

CVE-2021-32568 Deserialization of Untrusted Data in zmister2016/mrdoc

mrdoc is vulnerable to Deserialization of Untrusted Data...

mrdoc 代码问题漏洞

mrdoc is an online documentation system developed in python. mrdoc has a security vulnerability that can be exploited by attackers to deserialize untrusted data...

CVE-2021-35217

Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. An Authenticated Attacker could exploit it by executing WSAsyncExecuteTasks deserialization of untrusted data...

CVE-2021-35218

Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. An unauthorized attacker who has network access to the Orion Patch Manager Web Console could potentially exploit this and compromise the server...

Deserialization of untrusted data

Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. An unauthorized attacker who has network access to the Orion Patch Manager Web Console could potentially exploit this and compromise the server...

Deserialization of untrusted data

Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5. Authentication is required to exploit this vulnerability...

CVE-2021-35218 Chart Endpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability

Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. An unauthorized attacker who has network access to the Orion Patch Manager Web Console could potentially exploit this and compromise the server...

CVE-2021-35218

CVE-2021-35218 affects the SolarWinds Patch Manager Web Console Chart Endpoint. The root cause is deserialization of untrusted data, leading to remote code execution. An attacker with network access can exploit this (authentication is required in some advisories, but bypass is noted in at least o...

CVE-2021-36231

Deserialization of untrusted data in multiple functions in MIK.starlight 7.9.5.24363 allows authenticated remote attackers to execute operating system commands by crafting serialized objects...

Uncontrolled memory consumption in protobuf

Affected versions of this crate called Vec::reserve on user-supplied input. This allows an attacker to cause an Out of Memory condition while calling the vulnerable method on untrusted data...