135 matches found
AgentScope Deserialization Vulnerability
A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution RCE via deserialization of untrusted data using the dill library. The issue occurs in the AgentServerServicer.createagent method, where serialized input is deserialized using...
CVE-2025-0994
Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services I...
CVE-2022-2446
The WP Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'currentthemeroot' parameter in versions up to, and including 1.2.9. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will...
CVE-2025-0841
CVE-2025-0841 affects Aridius XYZ up to 20240927 on OpenCart, impacting the News component’s loadMore function. The issue is a deserialization flaw that can be triggered remotely, potentially enabling an attacker to manipulate and execute partial impacts as described across multiple sources. Expl...
CVE-2024-55953 Dataease Mysql JDBC Connection Parameters Not Verified Leads to Deserialization and Arbitrary File Read Vulnerability
DataEase is an open source business analytics tool. Authenticated users can read and deserialize arbitrary files through the background JDBC connection. When constructing the jdbc connection string, the parameters are not filtered. This vulnerability has been fixed in v1.18.27. Users are advised ...
CVE-2024-52430 WordPress Lis Video Gallery plugin <= 0.2.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in bublick Lis Video Gallery lis-video-gallery allows Object Injection.This issue affects Lis Video Gallery: from n/a through = 0.2.1...
CVE-2024-49332 WordPress Giveaway Boost plugin <= 2.1.4 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Giveaway Boost allows Object Injection.This issue affects Giveaway Boost: from n/a through 2.1.4...
CVE-2024-7433 Empowerment <= 1.0.2 - Authenticated (Contributor+) PHP Object Injection
The Empowerment theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.2 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is...
PT-2024-31762 · Apache · Apache Lucene
Name of the Vulnerable Software and Affected Versions: Apache Lucene versions 4.4.0 through 9.11.0 Description: The issue is related to the deserialization of untrusted data in the Apache Lucene Replicator. It affects the deprecated org.apache.lucene.replicator.http package, but not the...
CVE-2024-34997
joblib v1.4.2 was discovered to contain a deserialization vulnerability via the component joblib.numpypickle::NumpyArrayWrapper.readarray. NOTE: this is disputed by the supplier because NumpyArrayWrapper is only used during caching of trusted content...
PT-2024-21429
Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.7.0 through 1.11.0 Description The issue is related to the deserialization of untrusted data, allowing attackers to bypass security using malicious parameters. Recommendations For Apache InLong versions 1.7.0 through...
nginxWebUI deserialization vulnerability
nginxWebUI is an nginx web configuration tool. A deserialization vulnerability exists in nginxWebUI version 3.9.9, which originates from the unsafe deserialization of the nginxExe parameter of the /adminPage/conf/reload file when receiving serialized data submitted by a user, and can be exploited...
PT-2024-23267 · Armember · Armember
Name of the Vulnerable Software and Affected Versions: ARMember versions 4.0.26 and earlier Description: The issue is related to the deserialization of untrusted data. This can potentially lead to security risks. There is no information provided about the estimated number of potentially affected...
PT-2024-18273 · Van Der Schaar · Van Der Schaar Lab Autoprognosis
Name of the Vulnerable Software and Affected Versions: van der Schaar LAB AutoPrognosis version 0.1.21 Description: A critical vulnerability was found in the function load model from file of the component Release Note Handler. The manipulation leads to deserialization. The attack can be initiated...
CVE-2017-20189
In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects...
CVE-2023-49826 WordPress Soledad Theme <= 8.4.1 is vulnerable to PHP Object Injection
Deserialization of Untrusted Data vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme.This issue affects Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme: from n/a through 8.4.1...
CVE-2022-47599 WordPress File Manager Plugin <= 5.2.7 is vulnerable to PHP Object Injection
Deserialization of Untrusted Data vulnerability in File Manager by Bit Form Team File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager.This issue affects File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager: from n/a...
PYSEC-2023-301
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36...
PyDrive2 suffers from a deserialization command execution vulnerability
PyDrive2 is Iterative open source a google-api-python-client wrapper library . PyDrive2 has a deserialization command execution vulnerability that can be exploited by an attacker to execute arbitrary commands...