9851 matches found
Exploit for Deserialization of Untrusted Data in Fasterxml Jackson-Databind
CVE-20...
Rockwellautomation Factorytalk Deserialization of Untrusted Data
In Rockwell Automation all versions of FactoryTalk Diagnostics software, a subsystem of the FactoryTalk Services Platform, FactoryTalk Diagnostics exposes a .NET Remoting endpoint via RNADiagnosticsSrv.exe at TCPtcp/8082, which can insecurely deserialize untrusted data. File data ot500365.nasl...
PT-2020-5645
Name of the Vulnerable Software and Affected Versions Ruby on Rails versions prior to 5.2.4.3 Ruby on Rails versions prior to 6.0.3.1 Description The issue is related to the deserialization of untrusted data in the MemCacheStore and RedisCacheStore components of Ruby on Rails. This can allow an...
CVE-2020-12390: Deserialization of Untrusted Data
Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks. This vulnerability affects Firefox 76...
Inductive Automation Ignition (Update B)
1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Inductive Automation Equipment: Ignition Vulnerabilities: Missing Authentication for Critical Function, Deserialization of Untrusted Data 2. UPDATE INFORMATION This updated advisory is a follow-up...
CVE-2020-10751: Acceptance of Extraneous Untrusted Data With Trusted Data
A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed that an skb would only contain a single netlink message. The hook would incorrectly only validate the first netlink message in the skb and allow or deny the rest of the messages...
Exploit for Deserialization of Untrusted Data in Liferay Liferay_Portal
CVE-2020-7961-payloads Deserialization of Untrusted Data in Li...
CVE-2018-21234
Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set...
CVE-2018-21234
Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set...
Deserialization of untrusted data
Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure by Bypassing Strong Parameters. Specifically the return value of each, or eachvalue, or eachpair will return the underlying "untrusted" hash of data that was read from the parameters. Remediation Upgrade actionpack ...
Deserialization of Untrusted Data
Overview activesupport is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the MemCacheStore and RedisCacheStore. when untrusted user input is written to the cache...
Debian DSA-4686-1 : apache-log4j1.2 - security update
It was discovered that the SocketServer class included in apache-log4j1.2, a logging library for java, is vulnerable to deserialization of untrusted data. An attacker can take advantage of this flaw to execute arbitrary code in the context of the logger application by sending a specially crafted...
DEBIAN-CVE-2020-13092
scikit-learn aka sklearn through 0.23.0 can unserialize and execute commands from an untrusted file that is passed to the joblib.load function, if reduce makes an os.system call. NOTE: third parties dispute this issue because the joblib.load function is documented as unsafe and it is the user's...
UBUNTU-CVE-2020-13092
DISPUTED scikit-learn aka sklearn through 0.23.0 can unserialize and execute commands from an untrusted file that is passed to the joblib.load function, if reduce makes an os.system call. NOTE: third parties dispute this issue because the joblib.load function is documented as unsafe and it is the...
UBUNTU-CVE-2020-13091
DISPUTED pandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed to the readpickle function, if reduce makes an os.system call. NOTE: third parties dispute this issue because the readpickle function is documented as unsafe and it is the user's responsibilit...
CVE-2020-11972: Deserialization of Untrusted Data
Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0...
CVE-2020-11067 Deserialization of Untrusted Data in TYPO3 CMS
In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings in $BEUSER-uc are vulnerable to insecure deserialization. In combination with vulnerabilities of third party components, this can lead to remote code execution. A valid backend user...
CVE-2019-16112: Deserialization of Untrusted Data
TylerTech Eagle 2018.3.11 deserializes untrusted user input, resulting in remote code execution via a crafted Java object to the recorder/ServiceManager?service=tyler.empire.settings.SettingManager URI...