Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,809 results · page 28 of 37
May 16, 2023An XML Deserialization vulnerability in glazedlists v1.11.0 allows an attacker to execute arbitrary code via the BeanXMLByteCoder.decode() parameter.CVE-2023-31890 · Other software · Glazedlists · reported by MITRECritical 9.8
An XML Deserialization vulnerability in glazedlists v1.11.0 allows an attacker to execute arbitrary code via the BeanXMLByteCoder.decode() parameter.
- Product
- Glazed Lists
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2023VMware Aria Operations contains a deserialization vulnerability.CVE-2023-20878 · Other software · VMware · reported by security@vmware.comHigh 7.2
VMware Aria Operations contains a deserialization vulnerability. A malicious actor with administrative privileges can execute arbitrary commands and disrupt the system.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2023aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ asynchronized message process.CVE-2023-20853 · Other software · aEnrich · reported by twcert@cert.org.twCritical 9.8
aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ asynchronized message process. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands to perform arbitrary system operation or disrupt service.
- Product
- a+HRD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Apr 26, 2023aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ interpreter.CVE-2023-20852 · Other software · aEnrich · reported by twcert@cert.org.twCritical 9.8
aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ interpreter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands to perform arbitrary system operation or disrupt service.
- Product
- a+HRD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Apr 21, 2023An unsafe .NET object deserialization in DELMIA Apriso Release 2017 through Release 2022 could lead to post-authentication remote code execution.CVE-2023-2141 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 8.5
An unsafe .NET object deserialization in DELMIA Apriso Release 2017 through Release 2022 could lead to post-authentication remote code execution.
- Product
- DELMIA Apriso
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2023VMware Aria Operations for Logs contains a deserialization vulnerability.CVE-2023-20864 · Other software · VMware · reported by security@vmware.comCritical 9.8
VMware Aria Operations for Logs contains a deserialization vulnerability. An unauthenticated, malicious actor with network access to VMware Aria Operations for Logs may be able to execute arbitrary code as root.
- Product
- Aria Operations For Logs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2023A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands.CVE-2021-28254 · Other software · Laravel · reported by MITRECritical 9.8
A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands.
- Product
- Laravel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD records1mple-top.github.ios1mple-top.github.io
Apr 11, 2023ToolboxST prior to version 7.10 is affected by a deserialization vulnerability.CVE-2023-1552 · Other software · GE Gas Power · reported by GEPowerCVD@ge.comMedium 6.4
ToolboxST prior to version 7.10 is affected by a deserialization vulnerability. An attacker with local access to an HMI or who has conducted a social engineering attack on an authorized operator could execute code in a Toolbox user's context through the deserialization of an untrusted configuration file. Two CVSS scores have been provided to capture the differences between the two aforementioned attack vectors. Customers are advised to update to ToolboxST 7.10 which can be found in ControlST 7.10. If unable to update at this time customers should ensure they are following the guidance laid out in GE Gas Power's Secure Deployment Guide (GEH-6839). Customers should ensure they are not running ToolboxST as an Administrative user.
- Product
- ToolboxST
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2023Novi Survey Insecure Deserialization VulnerabilityCVE-2023-29492 · Other software · Novi Survey · reported by MITREExploitedCritical 9.8
Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context of the service account.
- Product
- Novi Survey
- On CISA’s list since
- Apr 13, 2023 (federal fix deadline May 4, 2023)
- What to do
- Attackers are using this now. Install Novi Survey’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalognovisurvey.netnovisurvey.net
Apr 6, 2023A Java insecure deserialization vulnerability in Adobe LiveCycle ES4 version 11.0 and earlier allows unauthenticated remote attackers to gain operating system cCVE-2023-28500 · Other software · Adobe · reported by MITRECritical 9.8
A Java insecure deserialization vulnerability in Adobe LiveCycle ES4 version 11.0 and earlier allows unauthenticated remote attackers to gain operating system code execution by submitting specially crafted Java serialized objects to a specific URL. Adobe LiveCycle ES4 version 11.0.1 and later may be vulnerable if the application is installed with Java environment 7u21 and earlier. Exploitation of the vulnerability depends on two factors: insecure deserialization methods used in the Adobe LiveCycle application, and the use of Java environments 7u21 and earlier. The code execution is performed in the context of the account that is running the Adobe LiveCycle application. If the account is privileged, exploitation provides privileged access to the operating system. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Livecycle Es4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcoastalsecurity.gitbook.iocoastalsecurity.gitbook.io
Mar 27, 2023The pgmng module has a vulnerability in serialization/deserialization.CVE-2023-26548 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The pgmng module has a vulnerability in serialization/deserialization. Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Mar 27, 2023The InputMethod module has a vulnerability of serialization/deserialization mismatch.CVE-2023-26547 · Other software · Huawei · reported by psirt@huawei.comHigh 7.8
The InputMethod module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Mar 27, 2023 N6854A Geolocation Server versions 2.4.2 are vulnerable to untrusted data deserialization, which may allow a malicious actor to escalate privileges in the affeCVE-2023-1399 · Other software · Keysight Technologies · reported by ics-cert@hq.dhs.govHigh 7.8
N6854A Geolocation Server versions 2.4.2 are vulnerable to untrusted data deserialization, which may allow a malicious actor to escalate privileges in the affected device’s default configuration and achieve remote code execution.
- Product
- N6854A Geolocation Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.CVE-2023-27296 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong. It could be triggered by authenticated users of InLong, you could refer to [1] to know more about this vulnerability. This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick [2] to solve it. [1] https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html [2] https://github.com/apache/inlong/pull/7422 https://github.com/apache/inlong/pull/7422
- Product
- Apache InLong
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Mar 27, 2023 Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-DataCollect serviCVE-2023-1145 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 7.8
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-DataCollect service, which could allow deserialization of requests prior to authentication, resulting in remote code execution.
- Product
- InfraSuite Device Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-gateway service, which cCVE-2023-1139 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-gateway service, which could allow deserialization of requests prior to authentication, resulting in remote code execution.
- Product
- InfraSuite Device Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast deserialization times aCVE-2023-28448 · Other software · firecracker-microvm · reported by GitHubMedium 5.7
Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast deserialization times and minimal size overhead. An issue was discovered in the ‘Versionize::deserialize’ implementation provided by the ‘versionize’ crate for ‘vmm_sys_utils::fam::FamStructWrapper', which can lead to out of bounds memory accesses. The impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise.
- Product
- versionize
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2023Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityCVE-2023-26360 · Websites & servers · Adobe · reported by AdobeExploitedHigh 8.6
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution.
- Product
- ColdFusion
- On CISA’s list since
- Mar 15, 2023 (federal fix deadline Apr 5, 2023)
- What to do
- Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comhelpx.adobe.com
Mar 23, 2023Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityCVE-2023-26359 · Websites & servers · Adobe · reported by AdobeExploitedCritical 9.8
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user.
- Product
- ColdFusion
- On CISA’s list since
- Aug 21, 2023 (federal fix deadline Sep 11, 2023)
- What to do
- Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloghelpx.adobe.comhelpx.adobe.com
Mar 22, 2023The Lead Generated WordPress Plugin, version <= 1.23, was affected by an unauthenticated insecure deserialization issue.CVE-2023-28667 · WordPress plugins & themes · reported by vulnreport@tenable.comCritical 9.8
The Lead Generated WordPress Plugin, version <= 1.23, was affected by an unauthenticated insecure deserialization issue. The tve_labels parameter of the tve_api_form_submit action is passed to the PHP unserialize() function without being sanitized or verified, and as a result could lead to PHP object injection, which when combined with certain class implementations / gadget chains could be leveraged to perform a variety of malicious actions granted a POP chain is also present.
- Affected
- up to 1.23
- What to do
- Affects up to 1.23. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtenable.comtenable.com
Mar 21, 2023A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentiaCVE-2023-27978 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.8
A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentially leading to remote code execution when an attacker gets the user to open a malicious file. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior).
- Product
- IGSS Data Server(IGSSdataServer.exe)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Mar 20, 2023kaml provides YAML support for kotlinx.serialization.CVE-2023-28118 · Other software · charleskorn · reported by GitHubHigh 7.5
kaml provides YAML support for kotlinx.serialization. Prior to version 0.53.0, applications that use kaml to parse untrusted input containing anchors and aliases may consume excessive memory and crash. Version 0.53.0 and later default to refusing to parse YAML documents containing anchors and aliases. There are no known workarounds.
- Product
- kaml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2023A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution.CVE-2023-23638 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5
A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions.
- Product
- Apache Dubbo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Mar 3, 2023CleverStupidDog yf-exam v 1.8.0 is vulnerable to Deserialization which can lead to remote code execution (RCE).CVE-2023-26779 · Other software · Yf-exam Project · reported by MITRECritical 9.8
CleverStupidDog yf-exam v 1.8.0 is vulnerable to Deserialization which can lead to remote code execution (RCE).
- Product
- Yf-exam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023Unauthenticated Java deserialization vulnerability in Serviceguard Manager CVE-2022-37936 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
Unauthenticated Java deserialization vulnerability in Serviceguard Manager
- Product
- HPE Serviceguard for Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Feb 28, 2023SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled.CVE-2023-27372 · Other software · Spip · reported by MITRECritical 9.8
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.
- Product
- Spip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Feb 28, 2023In run of ChooseTypeAndAccountActivity.java, there is a possible escalation of privilege due to unsafe deserialization.CVE-2023-20944 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In run of ChooseTypeAndAccountActivity.java, there is a possible escalation of privilege due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-244154558
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Feb 23, 2023The BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated insecure deserialization issue.CVE-2023-26326 · WordPress plugins & themes · reported by vulnreport@tenable.comCritical 9.8
The BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated insecure deserialization issue. An unauthenticated attacker could leverage this issue to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present.
- Fixed in
- 2.7.8
- What to do
- Update the plugin to 2.7.8 or newer.
Full record and what to do →NVD recordtenable.comtenable.com
Feb 20, 2023JD-GUI 1.6.6 allows deserialization via UIMainWindowPreferencesProvider.singleInstance.CVE-2023-26234 · Other software · Jd-gui Project · reported by MITREMedium 6.6
JD-GUI 1.6.6 allows deserialization via UIMainWindowPreferencesProvider.singleInstance.
- Product
- Jd-gui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2023SolarWinds Platform version 2022.4.1 was found to be susceptible to the Deserialization of Untrusted Data.CVE-2023-23836 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 7.2
SolarWinds Platform version 2022.4.1 was found to be susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to the SolarWinds Web Console to execute arbitrary commands.
- Product
- SolarWinds Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Feb 15, 2023SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.CVE-2022-47507 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 7.2
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
- Product
- SolarWinds Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Feb 15, 2023SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.CVE-2022-47504 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 7.2
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
- Product
- SolarWinds Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Feb 15, 2023SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.CVE-2022-47503 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 7.2
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
- Product
- SolarWinds Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Feb 15, 2023SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.CVE-2022-38111 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 7.2
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
- Product
- SolarWinds Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Feb 14, 2023Microsoft Exchange Server Deserialization of Untrusted Data VulnerabilityCVE-2023-21529 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8.8
Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution.
- Product
- Exchange Server
- On CISA’s list since
- Apr 13, 2026 (federal fix deadline Apr 27, 2026)
- What to do
- Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.commsrc.microsoft.com
Feb 9, 2023ImageMagick Engine: Deserialization of untrusted inputCVE-2022-3568 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The ImageMagick Engine plugin for WordPress is vulnerable to deserialization of untrusted input via the 'cli_path' parameter in versions up to, and including 1.7.5. This makes it possible for unauthenticated users to call files using a PHAR wrapper, granted they can trick a site administrator into performing an action such as clicking on a link, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
- Product
- ImageMagick Engine
- Affected
- up to 1.7.5
- What to do
- Affects up to 1.7.5. Update ImageMagick Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 8, 2023thinkphp 6.0.0~6.0.13 and 6.1.0~6.1.1 contains a deserialization vulnerability.CVE-2022-45982 · Other software · Thinkphp · reported by MITRECritical 9.8
thinkphp 6.0.0~6.0.13 and 6.1.0~6.1.1 contains a deserialization vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Feb 3, 2023vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization.CVE-2023-25135 · Other software · Vbulletin · reported by MITRECritical 9.8
vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verify_serialized checks that a value is serialized by calling unserialize and then checking for errors. The fixed versions are 5.6.7 PL1, 5.6.8 PL1, and 5.6.9 PL1.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.vbulletin.comambionics.io
Feb 1, 2023Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0.CVE-2023-24997 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick https://github.com/apache/inlong/pull/7223 https://github.com/apache/inlong/pull/7223 to solve it.
- Product
- Apache InLong
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Jan 31, 2023Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to execute arbitrary code via the XmlUtil.readObjectFromXml parameter.CVE-2023-24162 · Other software · Hutool · reported by MITRECritical 9.8
Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to execute arbitrary code via the XmlUtil.readObjectFromXml parameter.
- Product
- Hutool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2023In Apache Linkis <=1.3.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attackeCVE-2022-44645 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
In Apache Linkis <=1.3.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures new datasource with a MySQL data source and malicious parameters. Therefore, the parameters in the jdbc url should be blacklisted. Versions of Apache Linkis <= 1.3.0 will be affected. We recommend users to upgrade the version of Linkis to version 1.3.1.
- Product
- Apache Linkis (incubating)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Jan 30, 2023A CWE 502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the server when unsafely deserialized data isCVE-2022-32521 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.1
A CWE 502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the server when unsafely deserialized data is posted to the web server. Affected Products: Data Center Expert (Versions prior to V7.9.0)
- Product
- Data Center Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Jan 26, 2023vRealize Log Insight contains a deserialization vulnerability.CVE-2022-31710 · Other software · VMware · reported by security@vmware.comHigh 7.5
vRealize Log Insight contains a deserialization vulnerability. An unauthenticated malicious actor can remotely trigger the deserialization of untrusted data which could result in a denial of service.
- Product
- Vrealize LOG Insight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization).CVE-2023-21830 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization). Supported versions that are affected are Oracle Java SE: 8u351, 8u351-perf; Oracle GraalVM Enterprise Edition: 20.3.8 and 21.3.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
- Product
- Java SE JDK and JRE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gentoo.orgoracle.com
Dec 26, 2022A deserialization flaw was discovered in jackson-databind through 2.9.10.4.CVE-2020-10650 · Other software · Debian · reported by MITREHigh 8.1
A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2022The system tool has inconsistent serialization and deserialization.CVE-2022-41596 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The system tool has inconsistent serialization and deserialization. Successful exploitation of this vulnerability will cause unauthorized startup of components.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Dec 16, 2022Deserialization issue discovered in Ruoyi before 4.6.1 allows remote attackers to run arbitrary code via weak cipher in Shiro framework.CVE-2021-38241 · Other software · Ruoyi · reported by MITRECritical 9.8
Deserialization issue discovered in Ruoyi before 4.6.1 allows remote attackers to run arbitrary code via weak cipher in Shiro framework.
- Product
- Ruoyi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2022A deserialization issue discovered in inikulin replicator before 1.0.4 allows remote attackers to run arbitrary code via the fromSerializable function in TypedACVE-2021-33420 · Other software · Replicator Project · reported by MITRECritical 9.8
A deserialization issue discovered in inikulin replicator before 1.0.4 allows remote attackers to run arbitrary code via the fromSerializable function in TypedArray object.
- Product
- Replicator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisory.checkmarx.netgithub.com
Dec 7, 2022Skycaiji v2.5.1 was discovered to contain a deserialization vulnerability via /SkycaijiApp/admin/controller/Mystore.php.CVE-2022-44351 · Other software · Skycaiji · reported by MITRECritical 9.8
Skycaiji v2.5.1 was discovered to contain a deserialization vulnerability via /SkycaijiApp/admin/controller/Mystore.php.
- Product
- Skycaiji
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2022hope-boot 1.0.0 has a deserialization vulnerability that can cause Remote Code Execution (RCE).CVE-2022-44371 · Other software · Hope-boot Project · reported by MITRECritical 9.8
hope-boot 1.0.0 has a deserialization vulnerability that can cause Remote Code Execution (RCE).
- Product
- Hope-boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.