Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,809 results · page 21 of 37
Jan 14, 2025MSFM before v2025.01.01 was discovered to contain a deserialization vulnerability via the pom.xml configuration file.CVE-2024-57762 · Other software · Wangl1989 · reported by MITREHigh 7.5
MSFM before v2025.01.01 was discovered to contain a deserialization vulnerability via the pom.xml configuration file.
- Product
- Mysiteforme
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Deserialization of untrusted data in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthentCVE-2024-13163 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 7.8
Deserialization of untrusted data in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code execution. Local user interaction is required.
- Product
- Endpoint Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025GiveWP: Deserialization of Untrusted DataCVE-2025-22777 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give allows Object Injection.This issue affects GiveWP: from n/a through <= 3.19.3.
- Product
- GiveWP
- Affected
- up to 3.19.3
- What to do
- Affects up to 3.19.3. Update GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comsecurityonline.info
Jan 9, 2025Deserialization of Untrusted Data vulnerability in Drupal Eloqua allows Object Injection.This issue affects Eloqua: from 7.X-* before 7.X-1.15.CVE-2024-13297 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.6
Deserialization of Untrusted Data vulnerability in Drupal Eloqua allows Object Injection.This issue affects Eloqua: from 7.X-* before 7.X-1.15.
- Product
- Eloqua
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Deserialization of Untrusted Data vulnerability in Drupal Mailjet allows Object Injection.This issue affects Mailjet: from 0.0.0 before 4.0.1.CVE-2024-13296 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.6
Deserialization of Untrusted Data vulnerability in Drupal Mailjet allows Object Injection.This issue affects Mailjet: from 0.0.0 before 4.0.1.
- Product
- Mailjet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Deserialization of Untrusted Data vulnerability in Drupal Node export allows Object Injection.This issue affects Node export: from 7.X-* before 7.X-3.3.CVE-2024-13295 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.6
Deserialization of Untrusted Data vulnerability in Drupal Node export allows Object Injection.This issue affects Node export: from 7.X-* before 7.X-3.3.
- Product
- Node export
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Deserialization of Untrusted Data vulnerability in Drupal Monster Menus allows Object Injection.This issue affects Monster Menus: from 0.0.0 before 9.3.4, from CVE-2024-13288 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 4.3
Deserialization of Untrusted Data vulnerability in Drupal Monster Menus allows Object Injection.This issue affects Monster Menus: from 0.0.0 before 9.3.4, from 9.4.0 before 9.4.2.
- Product
- Monster Menus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025WC Price History for Omnibus: Deserialization of Untrusted DataCVE-2025-22510 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in kkarpieszuk WC Price History for Omnibus wc-price-history allows Object Injection.This issue affects WC Price History for Omnibus: from n/a through <= 2.1.4.
- Product
- WC Price History for Omnibus
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update WC Price History for Omnibus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2025There is a deserialization of untrusted data vulnerability in the Kredis JSON deserialization codeCVE-2023-27531 · Other software · Rails · reported by support@hackerone.comMedium 5.3
There is a deserialization of untrusted data vulnerability in the Kredis JSON deserialization code
- Product
- Kredis JSON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.rubyonrails.org
Jan 7, 2025PlainInventory: Deserialization of Untrusted DataCVE-2024-56291 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in plainware PlainInventory z-inventory-manager allows Object Injection.This issue affects PlainInventory: from n/a through <= 3.1.6.
- Product
- PlainInventory
- Affected
- up to 3.1.6
- What to do
- Affects up to 3.1.6. Update PlainInventory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Locatoraid Store Locator: Deserialization of Untrusted DataCVE-2024-56283 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in plainware Locatoraid Store Locator locatoraid allows Object Injection.This issue affects Locatoraid Store Locator: from n/a through <= 3.9.50.
- Product
- Locatoraid Store Locator
- Affected
- up to 3.9.50
- What to do
- Affects up to 3.9.50. Update Locatoraid Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WPGuppy: Deserialization of Untrusted DataCVE-2024-49222 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Object Injection.This issue affects WPGuppy: from n/a through <= 1.1.0.
- Product
- WPGuppy
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update WPGuppy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WP SuperBackup: Deserialization of Untrusted DataCVE-2024-56068 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Deserialization of Untrusted Data vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
- Product
- WP SuperBackup
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 25, 2024The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process incoming serialized data but lacks the necessary security cCVE-2024-52046 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 10
The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process incoming serialized data but lacks the necessary security checks and defenses. This vulnerability allows attackers to exploit the deserialization process by sending specially crafted malicious serialized data, potentially leading to remote code execution (RCE) attacks. This issue affects MINA core versions 2.0.X, 2.1.X and 2.2.X, and will be fixed by the releases 2.0.27, 2.1.10 and 2.2.4. It's also important to note that an application using MINA core library will only be affected if the IoBuffer#getObject() method is called, and this specific method is potentially called when adding a ProtocolCodecFilter instance using the ObjectSerializationCodecFactory class in the filter chain. If your application is specifically using those classes, you have to upgrade to the latest version of MINA core library. Upgrading will not be enough: you also need to explicitly allow the classes the decoder will accept in the ObjectSerializationDecoder instance, using one of the three new methods: /** * Accept class names where the supplied ClassNam
- Product
- Apache MINA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Dec 18, 2024A deserialization of untrusted data vulnerability exists in NI DAQExpress that may result in remote code execution.CVE-2024-12741 · Other software · NI · reported by security@ni.comHigh 8.4
A deserialization of untrusted data vulnerability exists in NI DAQExpress that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects DAQExpress 5.1 and prior versions. Please note that DAQExpress is an EOL product and will not receive any updates.
- Product
- DAQExpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024VRPConnector: Deserialization of Untrusted DataCVE-2024-56058 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in denniskravetstns VRPConnector vrpconnector allows Object Injection.This issue affects VRPConnector: from n/a through <= 2.0.1.
- Product
- VRPConnector
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update VRPConnector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Deserialization of Untrusted Data vulnerability in PlexTrac (Runbooks modules) which allows Object Injection and arbitrary file writes.CVE-2024-12687 · Other software · PlexTrac · reported by 5fea7123-217b-4b2d-ada8-8892719b43cdHigh 8.6
Deserialization of Untrusted Data vulnerability in PlexTrac (Runbooks modules) which allows Object Injection and arbitrary file writes. This issue affects PlexTrac: from 1.61.3 before 2.8.1.
- Product
- PlexTrac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2024In Progress Telerik UI for WPF versions prior to 2024 Q4 (2024.4.1213), a code execution attack is possible through an insecure deserialization vulnerability.CVE-2024-10095 · Other software · Progress Software · reported by security@progress.comHigh 8.4
In Progress Telerik UI for WPF versions prior to 2024 Q4 (2024.4.1213), a code execution attack is possible through an insecure deserialization vulnerability.
- Product
- Telerik UI for WPF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2024ForumWP: Deserialization of Untrusted DataCVE-2024-54367 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Ultimate Member ForumWP forumwp allows Object Injection.This issue affects ForumWP: from n/a through <= 2.1.0.
- Product
- ForumWP
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update ForumWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024WP Mega Menu: Deserialization of Untrusted DataCVE-2024-54282 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Themeum WP Mega Menu wp-megamenu allows Object Injection.This issue affects WP Mega Menu: from n/a through <= 1.4.2.
- Product
- WP Mega Menu
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update WP Mega Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Mail Picker: Deserialization of Untrusted DataCVE-2024-54273 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in PickPlugins Mail Picker mail-picker allows Object Injection.This issue affects Mail Picker: from n/a through <= 1.0.14.
- Product
- Mail Picker
- Affected
- up to 1.0.14
- What to do
- Affects up to 1.0.14. Update Mail Picker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Deserialization of Untrusted Data vulnerability in PlexTrac (Runbooks modules) which allows Object Injection and arbitrary file writes.This issue affects PlexTrCVE-2024-11839 · Other software · PlexTrac · reported by 5fea7123-217b-4b2d-ada8-8892719b43cdHigh 8.6
Deserialization of Untrusted Data vulnerability in PlexTrac (Runbooks modules) which allows Object Injection and arbitrary file writes.This issue affects PlexTrac: from 1.61.3 before 2.8.1.
- Product
- PlexTrac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Deserialization of untrusted data in Microsoft Update Catalog allows an unauthorized attacker to elevate privileges on the website’s webserver.CVE-2024-49147 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.3
Deserialization of untrusted data in Microsoft Update Catalog allows an unauthorized attacker to elevate privileges on the website’s webserver.
- Product
- Microsoft Update Catalog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024GFI Archiver Store Service Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2024-11949 · Other software · GFI · reported by zdi-disclosures@trendmicro.comHigh 8.8
GFI Archiver Store Service Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Authentication is required to exploit this vulnerability. The specific flaw exists within the Store Service, which listens on TCP port 8018 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-24331.
- Product
- Archiver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024GFI Archiver Core Service Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2024-11947 · Other software · GFI · reported by zdi-disclosures@trendmicro.comHigh 8.8
GFI Archiver Core Service Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Authentication is required to exploit this vulnerability. The specific flaw exists within the Core Service, which listens on TCP port 8017 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-24029.
- Product
- Archiver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before CVE-2024-55638 · Websites & servers · Drupal · reported by mlhess@drupal.orgCritical 9.8
Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9. Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called gadget chain presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability.
- Product
- Drupal Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 beCVE-2024-55637 · Websites & servers · Drupal · reported by mlhess@drupal.orgCritical 9.8
Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called gadget chain presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability.
- Product
- Drupal Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 beCVE-2024-55636 · Websites & servers · Drupal · reported by mlhess@drupal.orgCritical 9.8
Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so called gadget chain presents no direct threat, but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability.
- Product
- Drupal Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2024Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and caCVE-2022-41137 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.3
Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and can lead to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data. In real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments.
- Product
- Apache Hive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024A vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting services and exploit insecure deserialization by sending a serCVE-2024-42455 · Other software · Veeam · reported by support@hackerone.comHigh 8.1
A vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting services and exploit insecure deserialization by sending a serialized temporary file collection. This exploit allows the attacker to delete any file on the system with service account privileges. The vulnerability is caused by an insufficient blacklist during the deserialization process.
- Product
- Backup & Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024Insecure deserialization in Hodoku v2.3.0 to v2.3.2 allows attackers to execute arbitrary code.CVE-2024-51363 · Other software · reported by MITRECritical 9.8
Insecure deserialization in Hodoku v2.3.0 to v2.3.2 allows attackers to execute arbitrary code.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2024JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.javaCVE-2024-53477 · Other software · Jflyfox · reported by MITRECritical 9.8
JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java
- Product
- Jfinal CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 28, 2024Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution.CVE-2024-52338 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example, user-supplied input files). This vulnerability only affects the arrow R package, not other Apache Arrow implementations or bindings unless those bindings are specifically used via the R package (for example, an R application that embeds a Python interpreter and uses PyArrow to read files from untrusted sources is still vulnerable if the arrow R package is an affected version). It is recommended that users of the arrow R package upgrade to 17.0.0 or later. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to arrow 17.0.0 or later. If using an affected version of the package, untrusted data can read into a Table and its internal to_data_frame() method can be used as a workaround (e.g., read_parquet(..., as_data_frame = FALSE)$to_data_frame()). This issue affects the Apache Arrow R package: from 4.0.0 through 16.1.0. Users are recommended to upgrade to version 17.0.0, whi
- Product
- Apache Arrow R package
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Nov 26, 2024A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute code.CVE-2024-53673 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8.1
A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute code.
- Product
- Insight Remote Support
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2024Valor Apps Easy Folder Listing Pro has a deserialization vulnerability that allows an unauthenticated, remote attacker to execute arbitrary code with the privilCVE-2024-11145 · Other software · Valor Apps · reported by 9119a7d8-5eab-497f-8521-727c672e3725Critical 9.3
Valor Apps Easy Folder Listing Pro has a deserialization vulnerability that allows an unauthenticated, remote attacker to execute arbitrary code with the privileges of the Joomla! application. Fixed in versions 3.8 and 4.5.
- Product
- Easy Folder Listing Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvalorapps.com
Nov 22, 2024Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2024-11394 · Other software · Hugging Face · reported by zdi-disclosures@trendmicro.comHigh 8.8
Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of model files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25012.
- Product
- Transformers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2024-11393 · Other software · Hugging Face · reported by zdi-disclosures@trendmicro.comHigh 8.8
Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of model files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25191.
- Product
- Transformers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2024-11392 · Other software · Hugging Face · reported by zdi-disclosures@trendmicro.comHigh 8.8
Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of configuration files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-24322.
- Product
- Transformers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Allegra loadFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2024-5580 · Other software · Allegra · reported by zdi-disclosures@trendmicro.comHigh 7.2
Allegra loadFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is required to exploit this vulnerability. The specific flaw exists within the loadFieldMatch method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-23452.
- Product
- Allegra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordalltena.comzerodayinitiative.com
Nov 22, 2024Allegra renderFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2024-5579 · Other software · Allegra · reported by zdi-disclosures@trendmicro.comHigh 7.2
Allegra renderFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is required to exploit this vulnerability. The specific flaw exists within the renderFieldMatch method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-23451.
- Product
- Allegra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordalltena.comzerodayinitiative.com
Nov 22, 2024Allegra loadFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2023-51642 · Other software · Allegra · reported by zdi-disclosures@trendmicro.comMedium 6.3
Allegra loadFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, product implements a registration mechanism that can be used to create a user with a sufficient privilege level. The specific flaw exists within the loadFieldMatch method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22506.
- Product
- Allegra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrackplus.comzerodayinitiative.com
Nov 22, 2024Allegra renderFieldMatch Deserialization of Unstrusted Data Remote Code Execution Vulnerability.CVE-2023-51641 · Other software · Allegra · reported by zdi-disclosures@trendmicro.comMedium 6.3
Allegra renderFieldMatch Deserialization of Unstrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, product implements a registration mechanism that can be used to create a user with a sufficient privilege level. The specific flaw exists within the renderFieldMatch method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22505.
- Product
- Allegra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrackplus.comzerodayinitiative.com
Nov 20, 2024In writeToParcel of MediaPlayer.java, there is a possible serialization/deserialization mismatch due to improper input validation.CVE-2018-9474 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In writeToParcel of MediaPlayer.java, there is a possible serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2024In the deserialization constructor of NanoAppFilter.java, there is a possible loss of data due to type confusion.CVE-2018-9471 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In the deserialization constructor of NanoAppFilter.java, there is a possible loss of data due to type confusion. This could lead to local escalation of privilege in the system server with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2024QRMenu Restaurant QR Menu Lite: Deserialization of Untrusted DataCVE-2024-52445 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in ModelTheme QRMenu Restaurant QR Menu Lite qrmenu-lite allows Object Injection.This issue affects QRMenu Restaurant QR Menu Lite: from n/a through <= 1.0.4.
- Product
- QRMenu Restaurant QR Menu Lite
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update QRMenu Restaurant QR Menu Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024Geolocator: Deserialization of Untrusted DataCVE-2024-52443 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in masikonis Geolocator geolocator allows Object Injection.This issue affects Geolocator: from n/a through <= 1.1.
- Product
- Geolocator
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Geolocator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024Xpresslane Fast Checkout: Deserialization of Untrusted DataCVE-2024-52440 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in xpresslane Xpresslane Fast Checkout xpresslane-integration-for-woocommerce allows Object Injection.This issue affects Xpresslane Fast Checkout: from n/a through <= 1.0.0.
- Product
- Xpresslane Fast Checkout
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Xpresslane Fast Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024Team Rosters: Deserialization of Untrusted DataCVE-2024-52439 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Mark O'Donnell Team Rosters team-rosters allows Object Injection.This issue affects Team Rosters: from n/a through <= 4.8.2.
- Product
- Team Rosters
- Affected
- up to 4.8.2
- What to do
- Affects up to 4.8.2. Update Team Rosters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024Popup by Supsystic: Deserialization of Untrusted DataCVE-2024-52434 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Deserialization of Untrusted Data vulnerability in supsystic Popup by Supsystic popup-by-supsystic allows Command Injection.This issue affects Popup by Supsystic: from n/a through <= 1.10.29.
- Product
- Popup by Supsystic
- Affected
- up to 1.10.29
- What to do
- Affects up to 1.10.29. Update Popup by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024My Geo Posts Free: Deserialization of Untrusted DataCVE-2024-52433 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Mindstien Technologies My Geo Posts Free my-geo-posts-free allows Object Injection.This issue affects My Geo Posts Free: from n/a through <= 1.2.
- Product
- My Geo Posts Free
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update My Geo Posts Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.