Ubuntu: Security Advisory (USN-6161-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-45982

thinkphp 6.0.06.0.13 and 6.1.06.1.1 contains a deserialization vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload...

CVE-2022-44371

hope-boot 1.0.0 has a deserialization vulnerability that can cause Remote Code Execution RCE...

CVE-2022-44351

Skycaiji v2.5.1 was discovered to contain a deserialization vulnerability via /SkycaijiApp/admin/controller/Mystore.php...

PT-2022-25610 · Phpok · Phpok

Name of the Vulnerable Software and Affected Versions: Phpok version 6.1 Description: The issue is related to a deserialization vulnerability. It affects the framework/phpok call.php file. Recommendations: For Phpok version 6.1, consider restricting access to the framework/phpok call.php file unt...

PT-2022-24879 · Melisplatform · Melis-Cms

Name of the Vulnerable Software and Affected Versions: melisplatform/melis-cms versions prior to 5.0.1 Description: The issue allows attackers to deserialize arbitrary data on affected versions of melisplatform/melis-cms, leading to the execution of arbitrary PHP code on the system. This attack...

CVE-2022-24282

A vulnerability has been identified in SINEC NMS All versions = V1.0.3 V2.0, SINEC NMS All versions V1.0.3, SINEMA Server V14 All versions. The affected system allows to upload JSON objects that are deserialized to Java objects. Due to insecure deserialization of user-supplied content by the...

XYHCMS has a deserialization vulnerability

Xing Yunhai CMS XYHCMS is a completely open source CMS content management system. XYHCMS has a deserialization vulnerability. Attackers can use this vulnerability to obtain server privileges...

CVE-2020-14060

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.5. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Mitigation The following conditions a...

CVE-2020-7610

All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type...

CVE-2020-7610

All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type...

Remote Code Execution (RCE)

jackson-databind is vulnerable to remote code execution RCE. The vulnerability exists as it does not stop classes from the p6spy package from being used as deserialization gadgets...

MGASA-2018-0138 Updated jackson-databind packages fix security vulnerability

A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending maliciously crafted input to the readValue method of ObjectMapper CVE-2017-17485. A flaw was found in FasterXML jackson-databind which allows unauthenticate...

CVE-2016-6814

When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized...

Deserialization of Untrusted Data

Description This affects the package codeception/codeception from 4.0.0 before 4.1.22 and before 3.1.3. The RunProcess class can be leveraged as a gadget to run arbitrary commands on a system that is deserializing user input without validation. References...