Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,809 results · page 29 of 37
Dec 2, 2022Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution.CVE-2022-46366 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, which applies the the (also unsupported) 4.x version line. NOTE: This vulnerability only affects Apache Tapestry version line 3.x, which is no longer supported by the maintainer. Users are recommended to upgrade to a supported version line of Apache Tapestry.
- Product
- Apache Tapestry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Dec 1, 2022SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization.CVE-2022-1471 · Other software · SnakeYAML · reported by cve-coordination@google.comHigh 8.3
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
- Product
- SnakeYAML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comopenwall.com
Nov 29, 2022SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.CVE-2022-36964 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 8.8
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to execute arbitrary commands.
- Product
- SolarWinds Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Nov 29, 2022An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of QEMU in the read_erst_record() and writeCVE-2022-4172 · Other software · Qemu · reported by Red HatMedium 6.5
An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of QEMU in the read_erst_record() and write_erst_record() functions. Both issues may allow the guest to overrun the host buffer allocated for the ERST memory device. A malicious guest could use these flaws to crash the QEMU process on the host.
- Product
- Qemu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2022Deserialization of Untrusted Data in GitHub repository librenms/librenms prior to 22.10.0.CVE-2022-3525 · Other software · librenms · reported by security@huntr.devHigh 8.8
Deserialization of Untrusted Data in GitHub repository librenms/librenms prior to 22.10.0.
- Product
- librenms/librenms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2022Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.securitCVE-2022-45047 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server.
- Product
- Apache MINA SSHD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.commail-archive.com
Nov 12, 2022A remote insecure deserialization vulnerability exixsts in VMWare Hyperic Agent 5.8.6.CVE-2022-38652 · Other software · VMware · reported by MITRECritical 9.9
A remote insecure deserialization vulnerability exixsts in VMWare Hyperic Agent 5.8.6. Exploitation of this vulnerability enables a malicious authenticated user to run arbitrary code or malware within a Hyperic Agent instance and its host operating system with the privileges of the Hyperic Agent process (often SYSTEM on Windows platforms). NOTE: prior exploitation of CVE-2022-38650 results in the disclosure of the authentication material required to exploit this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Hyperic Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyber.gov.aucyber.gov.au
Nov 12, 2022A remote unauthenticated insecure deserialization vulnerability exists in VMware Hyperic Server 5.8.6.CVE-2022-38650 · Other software · VMware · reported by MITRECritical 10
A remote unauthenticated insecure deserialization vulnerability exists in VMware Hyperic Server 5.8.6. Exploitation of this vulnerability enables a malicious party to run arbitrary code or malware within Hyperic Server and the host operating system with the privileges of the Hyperic server process. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Hyperic Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyber.gov.aucyber.gov.au
Nov 9, 2022The system framework layer has a vulnerability of serialization/deserialization mismatch.CVE-2022-44562 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
The system framework layer has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Nov 9, 2022The AMS module has a vulnerability of serialization/deserialization mismatch.CVE-2022-44559 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
The AMS module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Nov 9, 2022The AMS module has a vulnerability of serialization/deserialization mismatch.CVE-2022-44558 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
The AMS module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Nov 7, 2022Netwrix Auditor Insecure Object Deserialization VulnerabilityCVE-2022-31199 · Other software · Netwrix · reported by MITREExploitedRansomwareCritical 9.8
Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\SYSTEM user. Successful exploitation requires that the attacker is able to reach port 9004/TCP, which is commonly blocked by standard enterprise firewalling.
- Product
- Auditor
- On CISA’s list since
- Jul 11, 2023 (federal fix deadline Aug 1, 2023)
- What to do
- Attackers are using this now. Install Netwrix’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogbishopfox.combishopfox.com
Oct 26, 2022In Apache Linkis <=1.2.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attackeCVE-2022-39944 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
In Apache Linkis <=1.2.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures a JDBC EC with a MySQL data source and malicious parameters. Therefore, the parameters in the jdbc url should be blacklisted. Versions of Apache Linkis <= 1.2.0 will be affected, We recommend users to update to 1.3.0.
- Product
- Apache Linkis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Oct 20, 2022SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.CVE-2022-38108 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 7.2
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
- Product
- SolarWinds Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsolarwinds.com
Oct 20, 2022SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.CVE-2022-36958 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 8.8
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to execute arbitrary commands.
- Product
- SolarWinds Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsolarwinds.comzerodayinitiative.com
Oct 20, 2022SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.CVE-2022-36957 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 7.2
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
- Product
- SolarWinds Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsolarwinds.comzerodayinitiative.com
Oct 19, 2022A deserialization of untrusted data vulnerability was identified in GitHub Enterprise Server that could potentially lead to remote code execution on the SVNBridCVE-2022-23734 · Other software · GitHub · reported by product-cna@github.comHigh 8.8
A deserialization of untrusted data vulnerability was identified in GitHub Enterprise Server that could potentially lead to remote code execution on the SVNBridge. To exploit this vulnerability, an attacker would need to gain access via a server-side request forgery (SSRF) that would let an attacker control the data being deserialized. This vulnerability affected all versions of GitHub Enterprise Server prior to v3.6 and was fixed in versions 3.5.3, 3.4.6, 3.3.11, and 3.2.16. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- GitHub Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Oct 18, 2022A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution.CVE-2022-39198 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version 3.1.0 and prior versions.
- Product
- Apache Dubbo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Oct 18, 2022Phpok 6.1 has a deserialization vulnerability via framework/phpok_call.php.CVE-2022-40889 · Websites & servers · Phpok · reported by MITRECritical 9.8
Phpok 6.1 has a deserialization vulnerability via framework/phpok_call.php.
- Product
- Phpok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 17, 2022Serialization of sensitive data in GitLab EE affecting all versions from 14.9 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 can leak sensitiveCVE-2022-3291 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.5
Serialization of sensitive data in GitLab EE affecting all versions from 14.9 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 can leak sensitive information via cache
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2022dotPDN Paint.NET before 4.1.2 allows Deserialization of Untrusted Data (issue 2 of 2).CVE-2018-18447 · Other software · Dotpdn · reported by MITRECritical 9.8
dotPDN Paint.NET before 4.1.2 allows Deserialization of Untrusted Data (issue 2 of 2).
- Product
- Paint.net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.getpaint.netdotpdn.com
Oct 12, 2022dotPDN Paint.NET before 4.1.2 allows Deserialization of Untrusted Data (issue 1 of 2).CVE-2018-18446 · Other software · Dotpdn · reported by MITRECritical 9.8
dotPDN Paint.NET before 4.1.2 allows Deserialization of Untrusted Data (issue 1 of 2).
- Product
- Paint.net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.getpaint.netdotpdn.com
Sep 23, 2022Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file.CVE-2022-36944 · Other software · Scala-lang · reported by MITRECritical 9.8
Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.
- Product
- Scala
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.lightbend.comgithub.com
Sep 16, 2022The NFC module has bundle serialization/deserialization vulnerabilities.CVE-2022-39008 · Other software · Huawei · reported by psirt@huawei.comCritical 9.1
The NFC module has bundle serialization/deserialization vulnerabilities. Successful exploitation of this vulnerability may cause third-party apps to read and write files that are accessible only to system apps.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Sep 14, 2022ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache.CVE-2022-38352 · Other software · Thinkphp · reported by MITRECritical 9.8
ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2022Migration, Backup, Staging – WPvivid: Deserialization of untrusted inputCVE-2022-2442 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to deserialization of untrusted input via the 'path' parameter in versions up to, and including 0.9.74. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
- Product
- Migration, Backup, Staging – WPvivid
- Affected
- up to 0.9.74
- What to do
- Affects up to 0.9.74. Update Migration, Backup, Staging – WPvivid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 6, 2022Broken Link Checker: Deserialization of untrusted inputCVE-2022-2438 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted input via the '$log_file' value in versions up to, and including 1.11.16. This makes it possible for authenticated attackers with administrative privileges and above to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
- Product
- Broken Link Checker
- Affected
- up to 1.11.16
- What to do
- Affects up to 1.11.16. Update Broken Link Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 6, 2022Download Manager: Deserialization of untrusted inputCVE-2022-2436 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Download Manager plugin for WordPress is vulnerable to deserialization of untrusted input via the 'file[package_dir]' parameter in versions up to, and including 3.2.49. This makes it possible for authenticated attackers with contributor privileges and above to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
- Product
- Download Manager
- Affected
- up to 3.2.49
- What to do
- Affects up to 3.2.49. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 6, 2022String Locator: Deserialization of untrusted inputCVE-2022-2434 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The String Locator plugin for WordPress is vulnerable to deserialization of untrusted input via the 'string-locator-path' parameter in versions up to, and including 2.5.0. This makes it possible for unauthenticated users to call files using a PHAR wrapper, granted they can trick a site administrator into performing an action such as clicking on a link, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
- Product
- String Locator
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update String Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 6, 2022WordPress Infinite Scroll – Ajax Load More: Deserialization of untrusted inputCVE-2022-2433 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to deserialization of untrusted input via the 'alm_repeaters_export' parameter in versions up to, and including 5.5.3. This makes it possible for unauthenticated users to call files using a PHAR wrapper, granted they can trick a site administrator into performing an action such as clicking on a link, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
- Product
- WordPress Infinite Scroll – Ajax Load More
- Affected
- up to 5.5.3
- What to do
- Affects up to 5.5.3. Update WordPress Infinite Scroll – Ajax Load More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Sep 5, 2022Deserialization of Untrusted Data vulnerability in the message processing component of Bitdefender GravityZone Console allows an attacker to pass unsafe commandCVE-2022-2830 · Other software · Bitdefender · reported by cve-requests@bitdefender.comHigh 8.8
Deserialization of Untrusted Data vulnerability in the message processing component of Bitdefender GravityZone Console allows an attacker to pass unsafe commands to the environment. This issue affects: Bitdefender GravityZone Console On-Premise versions prior to 6.29.2-1. Bitdefender GravityZone Cloud Console versions prior to 6.27.2-2.
- Product
- GravityZone Console On-Premise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitdefender.combitdefender.com
Aug 31, 2022Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on Java 8 or Java 11.CVE-2022-37023 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on Java 8 or Java 11. Any user wishing to protect against deserialization attacks involving REST APIs should upgrade to Apache Geode 1.15 and follow the documentation for details on enabling "validate-serializable-objects=true" and specifying any user classes that may be serialized/deserialized with "serializable-object-filter". Enabling "validate-serializable-objects" may impact performance.
- Product
- Apache Geode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Aug 31, 2022Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 11.CVE-2022-37022 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 11. Any user wishing to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15. Use of 1.15 on Java 11 will automatically protect JMX over RMI against deserialization attacks. This should have no impact on performance since it only affects JMX/RMI which Gfsh uses to communicate with the JMX Manager which is hosted on a Locator.
- Product
- Apache Geode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Aug 31, 2022Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8.CVE-2022-37021 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8. Any user still on Java 8 who wishes to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15 and Java 11. If upgrading to Java 11 is not possible, then upgrade to Apache Geode 1.15 and specify "--J=-Dgeode.enableGlobalSerialFilter=true" when starting any Locators or Servers. Follow the documentation for details on specifying any user classes that may be serialized/deserialized with the "serializable-object-filter" configuration option. Using a global serial filter will impact performance.
- Product
- Apache Geode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Aug 28, 2022NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attackerCVE-2022-34668 · Other software · NVIDIA · reported by psirt@nvidia.comCritical 9.8
NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.
- Product
- NVIDIA FLARE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Aug 25, 2022Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Deserialization of Untrusted Data vulnerability.CVE-2022-2465 · Other software · Rockwell Automation · reported by ics-cert@hq.dhs.govHigh 8.6
Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Deserialization of Untrusted Data vulnerability. ISaGRAF Workbench does not limit the objects that can be deserialized. This vulnerability allows attackers to craft a malicious serialized object that, if opened by a local user in ISaGRAF Workbench, may result in remote code execution. This vulnerability requires user interaction to be successfully exploited.
- Product
- ISaGRAF Workbench
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2022A Java Deserialization vulnerability in the Fishbowl Server in Fishbowl Inventory before 2022.4.1 allows remote attackers to execute arbitrary code via a crafteCVE-2022-29805 · Other software · Fishbowlinventory · reported by MITRECritical 9.8
A Java Deserialization vulnerability in the Fishbowl Server in Fishbowl Inventory before 2022.4.1 allows remote attackers to execute arbitrary code via a crafted XML payload.
- Product
- Fishbowl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfishbowlinventory.comwhiteoaksecurity.com
Aug 2, 2022EasyUse MailHunter Ultimate’s cookie deserialization function has an inadequate validation vulnerability.CVE-2022-35223 · Other software · EasyUse · reported by twcert@cert.org.twCritical 9.8
EasyUse MailHunter Ultimate’s cookie deserialization function has an inadequate validation vulnerability. Deserializing a cookie containing malicious payload will trigger this insecure deserialization vulnerability, allowing an unauthenticated remote attacker to execute arbitrary code, manipulate system command or interrupt service.
- Product
- MailHunter Ultimate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchtsecurity.comtwcert.org.tw
Jul 20, 2022Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESICVE-2022-33320 · Other software · Mitsubishi Electric · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpHigh 7.8
Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a project configuration file including malicious XML codes.
- Product
- GENESIS64
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2022Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESICVE-2022-33318 · Other software · Mitsubishi Electric · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpCritical 9.8
Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric GENESIS32 versions 9.7 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.7 and prior, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows a remote unauthenticated attacker to execute an arbitrary malicious code by sending specially crafted packets to the GENESIS64, ICONICS Suite, GENESIS32, or MC Works64 server.
- Product
- GENESIS64
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2022Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESICVE-2022-33316 · Other software · Mitsubishi Electric · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpHigh 7.8
Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious XAML codes.
- Product
- GENESIS64
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2022Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESICVE-2022-33315 · Other software · Mitsubishi Electric · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpHigh 7.8
Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious XAML codes.
- Product
- GENESIS64
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2022A deserialization vulnerability in a .NET framework class used and not properly checked by Safety Designer all versions up to and including 1.11.0 allows an attCVE-2022-27580 · Other software · Sick · reported by psirt@sick.deHigh 7.8
A deserialization vulnerability in a .NET framework class used and not properly checked by Safety Designer all versions up to and including 1.11.0 allows an attacker to craft malicious project files. Opening/importing such a malicious project file would execute arbitrary code with the privileges of the current user when opened or imported by the Safety Designer. This compromises confidentiality integrity and availability. For the attack to succeed a user must manually open a malicious project file.
- Product
- Safety Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2022A deserialization vulnerability in a .NET framework class used and not properly checked by Flexi Soft Designer in all versions up to and including 1.9.4 SP1 allCVE-2022-27579 · Other software · Sick · reported by psirt@sick.deHigh 7.8
A deserialization vulnerability in a .NET framework class used and not properly checked by Flexi Soft Designer in all versions up to and including 1.9.4 SP1 allows an attacker to craft malicious project files. Opening/importing such a malicious project file would execute arbitrary code with the privileges of the current user when opened or imported by the Flexi Soft Designer. This compromises confidentiality integrity and availability. For the attack to succeed a user must manually open a malicious project file.
- Product
- Flexi Soft Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2022This issue affects: HYPR Windows WFA versions prior to 7.2; Unsafe Deserialization vulnerability in HYPR Workforce Access (WFA) before version 7.2 may allow locCVE-2022-1984 · Other software · HYPR · reported by security@hypr.comMedium 4.5
This issue affects: HYPR Windows WFA versions prior to 7.2; Unsafe Deserialization vulnerability in HYPR Workforce Access (WFA) before version 7.2 may allow local authenticated attackers to elevate privileges via a malicious serialized payload.
- Product
- HYPR Windows WFA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2022Visualizer: Tables and Charts Manager for: Deserialization of untrusted inputCVE-2022-2444 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to deserialization of untrusted input via the 'remote_data' parameter in versions up to, and including 3.7.9. This makes it possible for authenticated attackers with contributor privileges and above to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
- Product
- Visualizer: Tables and Charts Manager for
- Affected
- up to 3.7.9
- What to do
- Affects up to 3.7.9. Update Visualizer: Tables and Charts Manager for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 18, 2022Feed Them Social – for Twitter feed, Youtube and more: Deserialization of untrusted inputCVE-2022-2437 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Feed Them Social – for Twitter feed, Youtube and more plugin for WordPress is vulnerable to deserialization of untrusted input via the 'fts_url' parameter in versions up to, and including 2.9.8.5. This makes it possible for unauthenticated attackers to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
- Product
- Feed Them Social – for Twitter feed, Youtube and more
- Affected
- up to 2.9.8.5
- What to do
- Affects up to 2.9.8.5. Update Feed Them Social – for Twitter feed, Youtube and more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 17, 2022QVIS NVR DVR before 2021-12-13 is vulnerable to Remote Code Execution via Java deserialization.CVE-2021-41419 · Other software · Qvis · reported by MITRECritical 9.8
QVIS NVR DVR before 2021-12-13 is vulnerable to Remote Code Execution via Java deserialization.
- Product
- DVR Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 13, 2022kvf-admin through 2022-02-12 allows remote attackers to execute arbitrary code because deserialization is mishandled.CVE-2022-35857 · Other software · Kvf-admin Project · reported by MITRECritical 9.8
kvf-admin through 2022-02-12 allows remote attackers to execute arbitrary code because deserialization is mishandled. The rememberMe parameter is encrypted with a hardcoded key from the com.kalvin.kvf.common.shiro.ShiroConfig file.
- Product
- Kvf-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2022ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\AbstractCache.phCVE-2022-33107 · Other software · Thinkphp · reported by MITRECritical 9.8
ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\AbstractCache.php. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.