CVE-2019-20572

An issue was discovered on Samsung mobile devices with O8.1 and P9.0 Exynos chipsets software. loadkernel has a buffer overflow via untrusted data. The Samsung ID is SVE-2019-14939 September 2019...

CVE-2019-20572

CVE-2019-20572 describes a buffer overflow in the load_kernel path on Samsung mobile devices with Exynos chips running O(8.1) and P(9.0). The issue is triggered by untrusted data and is documented across multiple feeds (NVD entry and Red Hat/CVE references) under the Samsung ID SVE-2019-14939. Th...

CVE-2020-6967

CVE-2020-6967 affects Rockwell FactoryTalk Diagnostics, a component of the FactoryTalk Services Platform. The vulnerability stems from insecure deserialization via a .NET Remoting endpoint exposed by RNADiagnosticsSrv.exe on TCP/8082, enabling untrusted data to be deserialized. According to ICS a...

Deserialization of untrusted data

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services JSONWS...

CVE-2020-7961

The CVE-2020-7961 issue affects Liferay Portal’s JSONWS deserialization of untrusted data, enabling unauthenticated remote code execution. Vulnerable software is Liferay Portal prior to 7.2.1 CE GA2, where the root cause is unsafe deserialization in JSONWebServiceActionParameters processed via JS...

Remote Code Execution (RCE)

jackson-databind is vulnerable to remote code execution RCE through deserialization of untrusted data. It is possible because the untrusted class, com.caucho.config.types.ResourceRef , was not filtered by default from the interaction between serialization gadgets and polymorphinc typing...

Remote Code Execution

jackson-databind is vulnerable to deserialization of untrusted data that can lead to remote code execution. The gadget org.apache.aries.transaction.jms is not validated and filtered by default from the interaction between serialization gadgets and polymorphic typing, allowing for injection of sai...

Remote Code Execution (RCE)

jackson-databind is vulnerable to deserialization of untrusted data that can lead to remote code execution. It is possible because untrusted classes org.apache.shiro.realm.jndi.JndiRealmFactory and org.apache.shiro.jndi.JndiObjectFactory were not filtered by default from the interaction between...

CVE-2020-6202

SAP NetWeaver Application Server Java User Management Engine, versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; does not sufficiently validate the LDAP data source configuration XML document accepted from an untrusted source, leading to Missing XML Validation...

Deserialization of untrusted data

In HPE Storage Essentials 9.5.0.142, there is Unauthenticated Java Deserialization with remote code execution via OS commands in a request to invoker/JMXInvokerServlet, aka PSRT110461...

Deserialization of untrusted data

Lexmark Markvision Enterprise before 2.3.0 misuses the Apache Commons Collections Library, leading to remote code execution because of Java deserialization...

CVE-2020-5327

Dell Security Management Server versions prior to 10.2.10 contain a Java RMI Deserialization of Untrusted Data vulnerability. When the server is exposed to the internet and Windows Firewall is disabled, a remote unauthenticated attacker may exploit this vulnerability by sending a crafted RMI...

Remote code execution

Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets...

ManageEngine Desktop Central Deserialization / Remote Code Execution

!/usr/bin/python3 """ ManageEngine Desktop Central FileStorage getChartImage Deserialization of Untrusted Data Remote Code Execution Vulnerability Download: https://www.manageengine.com/products/desktop-central/download-free.html File ...: ManageEngineDesktopCentral64bit.exe SHA1 ...:...

CVE-2020-10189

Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets. Recent assessments: J3rryBl4nks at March 13, 2020 9:41pm...

GHSA-4W82-R329-3Q67 Deserialization of Untrusted Data in jackson-databind

FasterXML jackson-databind 2.x before 2.6.7.4, 2.7.x before 2.7.9.7, 2.8.x before 2.8.11.5 and 2.9.x before 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter...

Deserialization of Untrusted Data in jackson-databind

FasterXML jackson-databind 2.x before 2.6.7.4, 2.7.x before 2.7.9.7, 2.8.x before 2.8.11.5, and 2.9.x before 2.9.10.2 lacks certain net.sf.ehcache blocking...

GHSA-GWW7-P5W4-WRFV Deserialization of Untrusted Data in jackson-databind

FasterXML jackson-databind 2.x before 2.6.7.4, 2.7.x before 2.7.9.7, 2.8.x before 2.8.11.5, and 2.9.x before 2.9.10.2 lacks certain net.sf.ehcache blocking...

CVE-2020-5327

Dell Security Management Server versions prior to 10.2.10 contain a Java RMI Deserialization of Untrusted Data vulnerability. When the server is exposed to the internet and Windows Firewall is disabled, a remote unauthenticated attacker may exploit this vulnerability by sending a crafted RMI...

Deserialization Of Untrusted Object

jackson-databind is vulnerable to deserialization of untrusted data. It is possible because untrusted class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig aka shaded hikari-config was not filtered by default from the interaction between serialization gadgets and polymorphic typing...