Total
1809 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2016-6814 | 2 Apache, Redhat | 7 Groovy, Enterprise Linux, Enterprise Linux Server and 4 more | 2024-11-21 | N/A |
| When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability. | ||||
| CVE-2016-4405 | 1 Hp | 1 Business Service Management | 2024-11-21 | N/A |
| A remote code execution vulnerability was identified in HP Business Service Management (BSM) using Apache Commons Collection Java Deserialization versions v9.20-v9.26 | ||||
| CVE-2016-4398 | 1 Hp | 1 Network Node Manager I | 2024-11-21 | N/A |
| A remote arbitrary code execution vulnerability was identified in HP Network Node Manager i (NNMi) Software 10.00, 10.01 (patch1), 10.01 (patch 2), 10.10 using Java Deserialization. | ||||
| CVE-2016-3957 | 1 Web2py | 1 Web2py | 2024-11-21 | N/A |
| The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session information stored in cookies, which might allow remote attackers to execute arbitrary code by leveraging knowledge of encryption_key. | ||||
| CVE-2016-1487 | 1 Lexmark | 1 Markvision Enterprise | 2024-11-21 | 8.8 High |
| Lexmark Markvision Enterprise before 2.3.0 misuses the Apache Commons Collections Library, leading to remote code execution because of Java deserialization. | ||||
| CVE-2016-10753 | 1 E107 | 1 E107 | 2024-11-21 | N/A |
| e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC. | ||||
| CVE-2016-10750 | 2 Hazelcast, Redhat | 2 Hazelcast, Jboss Fuse | 2024-11-21 | N/A |
| In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reach a listening Hazelcast instance with a crafted JoinRequest, and vulnerable classes exist in the classpath, the attacker can run arbitrary code. | ||||
| CVE-2016-1000027 | 1 Vmware | 1 Spring Framework | 2024-11-21 | 9.8 Critical |
| Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data. | ||||
| CVE-2016-0750 | 2 Infinispan, Redhat | 3 Infinispan, Jboss Data Grid, Jboss Single Sign On | 2024-11-21 | N/A |
| The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks. | ||||
| CVE-2015-2020 | 1 Myscript | 1 Myscript | 2024-11-21 | N/A |
| The MyScript SDK before 1.3 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function. | ||||
| CVE-2014-3699 | 1 Redhat | 2 Edeploy, Jboss Enterprise Web Server | 2024-11-21 | 9.8 Critical |
| eDeploy has RCE via cPickle deserialization of untrusted data | ||||
| CVE-2014-1860 | 1 Contao | 1 Contao Cms | 2024-11-21 | 9.8 Critical |
| Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities | ||||
| CVE-2014-1420 | 1 Canonical | 1 Ubuntu-ui-toolkit | 2024-11-21 | 3.8 Low |
| On desktop, Ubuntu UI Toolkit's StateSaver would serialise data on tmp/ files which an attacker could use to expose potentially sensitive data. StateSaver would also open files without the O_EXCL flag. An attacker could exploit this to launch a symlink attack, though this is partially mitigated by symlink and hardlink restrictions in Ubuntu. Fixed in 1.1.1188+14.10.20140813.4-0ubuntu1. | ||||
| CVE-2013-7489 | 1 Beakerbrowser | 1 Beaker | 2024-11-21 | 6.8 Medium |
| The Beaker library through 1.11.0 for Python is affected by deserialization of untrusted data, which could lead to arbitrary code execution. | ||||
| CVE-2013-4521 | 1 Nuxeo | 1 Nuxeo | 2024-11-21 | 9.8 Critical |
| RichFaces implementation in Nuxeo Platform 5.6.0 before HF27 and 5.8.0 before HF-01 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data. NOTE: this vulnerability may overlap CVE-2013-2165. | ||||
| CVE-2024-52430 | 1 Lis | 1 Video Gallery | 2024-11-20 | 9.8 Critical |
| Deserialization of Untrusted Data vulnerability in Lis Lis Video Gallery allows Object Injection.This issue affects Lis Video Gallery: from n/a through 0.2.1. | ||||
| CVE-2024-52432 | 2 Nix Solutions, Nixsolutions | 2 Nix Anti-spam Light, Nix Anti-spam Light | 2024-11-20 | 9.8 Critical |
| Deserialization of Untrusted Data vulnerability in NIX Solutions Ltd NIX Anti-Spam Light allows Object Injection.This issue affects NIX Anti-Spam Light: from n/a through 0.0.4. | ||||
| CVE-2024-52433 | 1 Mindstien | 1 My Geo Posts Free | 2024-11-20 | 9.8 Critical |
| Deserialization of Untrusted Data vulnerability in Mindstien Technologies My Geo Posts Free allows Object Injection.This issue affects My Geo Posts Free: from n/a through 1.2. | ||||
| CVE-2024-10828 | 1 Algolplus | 2 Advanced Order Export, Advanced Order Export For Woocommerce | 2024-11-19 | 8.1 High |
| The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.5 via deserialization of untrusted input during Order export when the "Try to convert serialized values" option is enabled. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). | ||||
| CVE-2021-3838 | 2 Dompdf, Dompdf Project | 2 Dompdf, Dompdf | 2024-11-19 | 9.8 Critical |
| DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() function. An attacker who can upload files of any type to the server can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution, especially when DOMPdf is used with frameworks with documented POP chains like Laravel or vulnerable developer code. | ||||