deserialization vulnerabilities and exploits

(subscribe to this query)

Multiple unspecified API endpoints in Jenkins prior to 1.650 and LTS prior to 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.

Jenkins Jenkins Redhat Openshift 3.1

2 EDB exploits2 Metasploit modules4 Github repositories

OpenMRS prior to 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body.

Openmrs Openmrs

1 EDB exploit1 Github repository

IBM QRadar SIEM 7.3 and 7.4 could allow a remote malicious user to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization function. By sending a malicious serialized Java object, an attacker could exploit ...

Ibm Qradar Security Information And Event Manager Ibm Qradar Security Information And Event Manager 7.3.3

The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user.

1 Metasploit module1 Github repository

Secure/SAService.rem in Deltek Ajera Timesheets 9.10.16 and prior are vulnerable to remote code execution via deserialization of untrusted user input from an authenticated user. The executed code will run as the IIS Application Pool that is running the application.

1 EDB exploit

ERS Data System 1.8.1.0 allows remote malicious users to execute arbitrary code, related to "com.branaghgroup.ecers.update.UpdateRequest" object deserialization.

Branaghgroup Ers Data System 1.8.1.0

1 EDB exploit

A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found.

Hp Intelligent Management Center 7.3

1 EDB exploit

Sitecore Experience Platform (XP) before 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863. An authenticated user with necessary permissions is able to remotely execute OS commands by sending a crafted serialized object.

Sitecore Experience Platform

1 EDB exploit

SuiteCRM up to and including 7.11.11 allows PHAR Deserialization.

Salesagility Suitecrm

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote malicious users to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core....

Oracle Virtual Desktop Infrastructure Oracle Weblogic Server 12.2.1.0.0 Oracle Weblogic Server 12.1.3.0.0 Oracle Weblogic Server 10.3.6.0.0 Oracle Weblogic Server 12.1.2.0.0 Oracle Storagetek Tape Analytics Sw Tool 2.3

2 EDB exploits13 Github repositories

1 2 3 4 5 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook