Remote Code Execution (RCE) Via Deserialization Of Untrusted Data

amf-serializer is vulnerable to remote code execution RCE via deserialization of untrusted data. The vulnerability is possible because it has a flaw in AMF3 deserialization using AMF3Deserializer.readAMF3Object. This allows attackers to request a Remote Method Invocation RMI remote object from th...

Remote Code Execution (RCE) Via Deserialization Of Untrusted Data

flex-messaging-core is vulnerable to remote code execution RCE via deserialization of untrusted data. The vulnerability is possible because it has a flaw in AMF deserialization using Externalizable.readExternalObjectInput, allowing attackers to request a RMI remote object from the endpoint and...

Response Splitting

HTTP response splitting occurs when untrusted data is inserted into the response headers without any sanitisation. If successful, this allows cyber-criminals to essentially split the HTTP response in two. This is abused by cyber-criminals injecting CR Carriage Return -- /r and LF Line Feed -- \n...

DOM-based Cross-Site Scripting (XSS)

Client-side scripts are used extensively by modern web applications. They perform from simple functions such as the formatting of text up to full manipulation of client-side data and Operating System interaction. Unlike traditional Cross-Site Scripting XSS, where the client is able to inject...

HPE Operations Orchestration Insecure Deserialization (CVE-2016-8519)

An insecure deserialization vulnerability has been reported in HPE Operations Orchestration. The vulnerability is due to the deserialization of untrusted data in several servlets used for backwards compatibility with older API versions. A remote, unauthenticated attacker can exploit this...

Remote Code Execution (RCE)

Apache Camel is vulnerable to remote code execution RCE through Java object deserialization. The camel-jackson and camel-jacksonxml components allow to specify a type through the CamelJacksonUnmarshalType property. Deserializing untrusted data can lead to security flaws as demonstrated in various...

CVE-2017-5954

An issue was discovered in the serialize-to-js package 0.5.0 for Node.js. Untrusted data passed into the deserialize function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression IIFE...

Code injection

An issue was discovered in the serialize-to-js package 0.5.0 for Node.js. Untrusted data passed into the deserialize function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression IIFE...

CVE-2017-5954

An issue was discovered in the serialize-to-js package 0.5.0 for Node.js. Untrusted data passed into the deserialize function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression IIFE...

CVE-2017-5941

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression IIFE...

Deserialization of untrusted data

The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service CPU consumption via a long string, aka a "regular expression Denial of Service ReDoS."...

Deserialization of untrusted data

Extbase in TYPO3 4.3.0 before 6.2.24, 7.x before 7.6.8, and 8.1.1 allows remote attackers to obtain sensitive information or possibly execute arbitrary code via a crafted Extbase action...

Hewlett Packard Enterprise Operations Orchestration Backwards Compatibility Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Operations Orchestration. Authentication is not required to exploit this vulnerability. The specific flaw exists within the wsExecutionBridgeService servlet. The issue li...

OpenNMS RMI Java Object Deserialization

Vulnerability exists in OpenNMS RMI. This vulnerability is due to deserialization of untrusted data. A successful exploitation of this issue could allow an attacker to execute arbitrary code on the remote system...

OpenSSL: Fix memory issues in BIO_*printf functions

Several flaws were found in the way BIOprintf functions were implemented in OpenSSL. Applications which passed large amounts of untrusted data through these functions could crash or potentially execute code with the permissions of the user running such an application...

openssl: doapr_outch function does not verify that certain memory allocation succeeds

Several flaws were found in the way BIOprintf functions were implemented in OpenSSL. Applications which passed large amounts of untrusted data through these functions could crash or potentially execute code with the permissions of the user running such an application...

CVE-2016-7050

It was discovered that under certain conditions RESTEasy could be forced to parse a request with SerializableProvider, resulting in deserialization of potentially untrusted data. An attacker could possibly use this flaw execute arbitrary code with the permissions of the application using RESTEasy...

PHP FormMail Generator generates code with multiple vulnerabilities

Overview PHP FormMail Generator is a single-instance website that generates PHP code for standard web forms for inclusion into PHP or WordPress websites. The generated code is vulnerable to authentication bypass and unsafe deserialization of untrusted data. Description CWE-302: Authentication...

Debian Security Advisory DSA 3727-1 (hdf5 - security update)

Cisco Talos discovered that hdf5, a file format and library for storing scientific data, contained several vulnerabilities that could lead to arbitrary code execution when handling untrusted data. OpenVAS Vulnerability Test $Id: deb3727.nasl 6608 2017-07-07 12:05:05Z cfischer $ Auto-generated fro...

Hewlett Packard Enterprise Network Automation RPCServlet Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Network Automation. Authentication is not required to exploit this vulnerability. The specific flaw exists within the exposed RPCServlet. By sending a crafted request, th...