Adobe ColdFusion untrustworthy data deserialization vulnerability (CNVD-2018-18737)

Adobe ColdFusion is a commercial rapid application development platform. An untrusted data deserialization vulnerability exists in Adobe ColdFusion. A remote user can exploit this vulnerability by sending specially crafted data to execute arbitrary code on the target system...

Adobe ColdFusion untrustworthy data deserialization vulnerability (CNVD-2018-18735)

Adobe ColdFusion is a commercial rapid application development platform. An untrusted data deserialization vulnerability exists in Adobe ColdFusion. A remote user can exploit this vulnerability by sending specially crafted data to execute arbitrary code on the target system...

CVE-2018-10513

A Deserialization of Untrusted Data Privilege Escalation vulnerability in Trend Micro Security 2018 Consumer products could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in...

CVE-2018-10513

The connected ZDI advisory ZDI-18-961 details a local privilege‑escalation vulnerability in Trend Micro products (e.g., Trend Micro Maximum Security) involving deserialization of untrusted data in ID_AMSP_MASTER requests. The flaw occurs in the coreServiceShell.exe service process when parsing re...

Deserialization of untrusted data

Insecure deserialization of a specially crafted serialized object, in CA Release Automation 6.5 and earlier, allows attackers to potentially execute arbitrary code...

PT-2018-9935

Name of the Vulnerable Software and Affected Versions: Trend Micro Security 2018 Consumer products Description: A Deserialization of Untrusted Data Privilege Escalation issue could allow a local attacker to escalate privileges on vulnerable installations. The attacker must first obtain the abilit...

CVE-2018-10513: Deserialization of Untrusted Data

A Deserialization of Untrusted Data Privilege Escalation vulnerability in Trend Micro Security 2018 Consumer products could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in...

Trend Micro Maximum Security ID_AMSP_MASTER Deserialization of Untrusted Data Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Trend Micro Maximum Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within...

Debian DLA-1480-1 : ruby2.1 security update

Several vulnerabilities were discovered in Ruby 2.1. CVE-2016-2337 Type confusion exists in canceleval Ruby's TclTkIp class method. Attacker passing different type of object than String as 'retval' argument can cause arbitrary code execution. CVE-2018-1000073 RubyGems contains a Directory Travers...

Unspecified Vulnerability in JetBrains dotPeek and ReSharper Ultimate

JetBrains dotPeek and ReSharper Ultimate are both products of the Czech company JetBrains. JetBrains dotPeek is a decompiler for the . ReSharper Ultimate is a code generation tool. A security vulnerability exists in JetBrains dotPeek versions prior to 2018.2 and ReSharper Ultimate versions prior ...

CVE-2018-8349: Deserialization of Untrusted Data

A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server...

CVE-2018-14878

JetBrains dotPeek before 2018.2 and ReSharper Ultimate before 2018.1.4 allow attackers to execute code by decompiling a compiled .NET object such as a DLL or EXE file with a specific file, because of Deserialization of Untrusted Data...

Deserialization of untrusted data

JetBrains dotPeek before 2018.2 and ReSharper Ultimate before 2018.1.4 allow attackers to execute code by decompiling a compiled .NET object such as a DLL or EXE file with a specific file, because of Deserialization of Untrusted Data...

CVE-2018-14878

JetBrains dotPeek before 2018.2 and ReSharper Ultimate before 2018.1.4 allow attackers to execute code by decompiling a compiled .NET object such as a DLL or EXE file with a specific file, because of Deserialization of Untrusted Data...

CVE-2018-14878: Deserialization of Untrusted Data

JetBrains dotPeek before 2018.2 and ReSharper Ultimate before 2018.1.4 allow attackers to execute code by decompiling a compiled .NET object such as a DLL or EXE file with a specific file, because of Deserialization of Untrusted Data...

Deserialization of untrusted data

A remote arbitrary code execution vulnerability was identified in HP Network Node Manager i NNMi Software 10.00, 10.01 patch1, 10.01 patch 2, 10.10 using Java Deserialization...

CVE-2016-4405: Deserialization of Untrusted Data

A remote code execution vulnerability was identified in HP Business Service Management BSM using Apache Commons Collection Java Deserialization versions v9.20-v9.26...

xmlrpc: Deserialization of untrusted Java object through <ex:serializable> tag

A flaw was discovered in the Apache XML-RPC ws-xmlrpc library that deserializes untrusted data when enabledForExtensions setting is enabled. A remote attacker could use this vulnerability to execute arbitrary code via a crafted serialized Java object in a element...

Deserialization of untrusted data

In Apache Ignite before 2.4.8 and 2.5.x before 2.5.3, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be...

CVE-2016-9483 PHP FormMail Generator generates PHP code for standard web forms, and the code generated is vulnerable to unsafe deserialization of untrusted data

The PHP form code generated by PHP FormMail Generator deserializes untrusted input as part of the phpfmgfilmandownload function. A remote unauthenticated attacker may be able to use this vulnerability to inject PHP code, or along with CVE-2016-9484 to perform local file inclusion attacks and obta...