Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,809 results · page 31 of 37
Sep 7, 2021kaml is an open source implementation of the YAML format with support for kotlinx.serialization.CVE-2021-39194 · Other software · charleskorn · reported by GitHubMedium 4.3
kaml is an open source implementation of the YAML format with support for kotlinx.serialization. In affected versions attackers that could provide arbitrary YAML input to an application that uses kaml could cause the application to endlessly loop while parsing the input. This could result in resource starvation and denial of service. This only affects applications that use polymorphic serialization with the default tagged polymorphism style. Applications using the property polymorphism style are not affected. YAML input for a polymorphic type that provided a tag but no value for the object would trigger the issue. Version 0.35.3 or later contain the fix for this issue.
- Product
- kaml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2021mrdoc is vulnerable to Deserialization of Untrusted DataCVE-2021-32568 · Other software · zmister2016 · reported by security@huntr.devHigh 7.8
mrdoc is vulnerable to Deserialization of Untrusted Data
- Product
- zmister2016/mrdoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2021Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution.CVE-2021-35218 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 8.9
Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. An unauthorized attacker who has network access to the Orion Patch Manager Web Console could potentially exploit this and compromise the server
- Product
- Patch Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Sep 1, 2021Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module.CVE-2021-35216 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 8.9
Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module. An Authenticated Attacker with network access via HTTP can compromise this vulnerability can result in Remote Code Execution.
- Product
- Patch Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Sep 1, 2021Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5.CVE-2021-35215 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 8.9
Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5. Authentication is required to exploit this vulnerability.
- Product
- Orion Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.codocumentation.solarwinds.com
Aug 31, 2021Deserialization of untrusted data in multiple functions in MIK.starlight 7.9.5.24363 allows authenticated remote attackers to execute operating system commands CVE-2021-36231 · Other software · Unit4 · reported by MITREHigh 8.8
Deserialization of untrusted data in multiple functions in MIK.starlight 7.9.5.24363 allows authenticated remote attackers to execute operating system commands by crafting serialized objects.
- Product
- Mik.starlight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2021Jenkins Code Coverage API Plugin 1.4.0 and earlier does not apply Jenkins JEP-200 deserialization protection to Java objects it deserializes from disk, resultinCVE-2021-21677 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins Code Coverage API Plugin 1.4.0 and earlier does not apply Jenkins JEP-200 deserialization protection to Java objects it deserializes from disk, resulting in a remote code execution vulnerability.
- Product
- Jenkins Code Coverage API Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Aug 31, 2021In the server in SerNet verinice before 1.22.2, insecure Java deserialization allows remote authenticated attackers to execute arbitrary code.CVE-2021-36981 · Other software · Sernet · reported by MITREHigh 8.8
In the server in SerNet verinice before 1.22.2, insecure Java deserialization allows remote authenticated attackers to execute arbitrary code.
- Product
- Verinice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2021An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.CVE-2021-21869 · Other software · Codesys · reported by talos-cna@cisco.comHigh 7.8
An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- Codesys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comtalosintelligence.com
Aug 18, 2021An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.get_MissingTypes() functionality of CODESYS GmbH CODESYS Development System 3CVE-2021-21868 · Other software · Codesys · reported by talos-cna@cisco.comHigh 7.8
An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.get_MissingTypes() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- Codesys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comtalosintelligence.com
Aug 18, 2021An unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream.ProfileByteArray functionality of CODESYS GmbH CODESYS Development SysteCVE-2021-21867 · Other software · Codesys · reported by talos-cna@cisco.comHigh 7.8
An unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream.ProfileByteArray functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- Codesys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comtalosintelligence.com
Aug 11, 2021The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).CVE-2021-38585 · Websites & servers · Cpanel · reported by MITREHigh 7.2
The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cpanel.netdocs.cpanel.net
Aug 6, 2021In JetBrains TeamCity before 2020.2.4, there was an insecure deserialization.CVE-2021-37544 · Other software · Jetbrains · reported by MITRECritical 9.8
In JetBrains TeamCity before 2020.2.4, there was an insecure deserialization.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Aug 5, 2021A unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.1CVE-2021-21863 · Other software · Codesys · reported by talos-cna@cisco.comHigh 7.8
A unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- Development System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcustomers.codesys.com
Aug 4, 2021DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization.CVE-2021-36483 · Other software · Devexpress · reported by MITREHigh 8.8
DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization.
- Product
- Devexpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comsupportcenter.devexpress.com
Aug 2, 2021A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality of CODESYS GmbH CODESYS Development SysteCVE-2021-21866 · Other software · Codesys · reported by talos-cna@cisco.comHigh 7.8
A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- Development System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comtalosintelligence.com
Aug 2, 2021A unsafe deserialization vulnerability exists in the PackageManagement.plugin ExtensionMethods.Clone() functionality of CODESYS GmbH CODESYS Development System CVE-2021-21865 · Other software · Codesys · reported by talos-cna@cisco.comHigh 7.8
A unsafe deserialization vulnerability exists in the PackageManagement.plugin ExtensionMethods.Clone() functionality of CODESYS GmbH CODESYS Development System 3.5.16. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- Development System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comtalosintelligence.com
Aug 2, 2021A unsafe deserialization vulnerability exists in the ComponentModel ComponentManager.StartupCultureSettings functionality of CODESYS GmbH CODESYS Development SyCVE-2021-21864 · Other software · Codesys · reported by talos-cna@cisco.comHigh 7.8
A unsafe deserialization vulnerability exists in the ComponentModel ComponentManager.StartupCultureSettings functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- Development System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comtalosintelligence.com
Jul 30, 2021IBM Partner Engagement Manager 2.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw.CVE-2021-29781 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM Partner Engagement Manager 2.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 203091.
- Product
- Partner Engagement Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 27, 2021Deserialization of Untrusted Data Vulnerability Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2, 19.1 and 19.2 and Dell EMC Integrated Data ProtectionCVE-2020-5341 · Other software · Dell · reported by security_alert@emc.comCritical 9.8
Deserialization of Untrusted Data Vulnerability Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2, 19.1 and 19.2 and Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 and 2.4.1 contain a Deserialization of Untrusted Data Vulnerability. A remote unauthenticated attacker could exploit this vulnerability to send a serialized payload that would execute code on the system.
- Product
- Avamar Virtual Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2021A CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause code execution by opening a malicious project file.CVE-2021-22777 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause code execution by opening a malicious project file.
- Product
- Sosafe Configurable
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Jul 8, 2021A remote insecure deserialization vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9.CVE-2021-29150 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 7.2
A remote insecure deserialization vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
- Product
- Clearpass Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Jun 30, 2021Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserialization during Microsoft .NET remoting.CVE-2021-35971 · Other software · Veeam · reported by MITRECritical 9.8
Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserialization during Microsoft .NET remoting.
- Product
- Veeam Backup & Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2021There is a deserialization vulnerability in Huawei AnyOffice V200R006C10.CVE-2021-22439 · Other software · Huawei · reported by psirt@huawei.comHigh 8.1
There is a deserialization vulnerability in Huawei AnyOffice V200R006C10. An attacker can construct a specific request to exploit this vulnerability. Successfully exploiting this vulnerability, the attacker can execute remote malicious code injection and to control the device.
- Product
- Anyoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2021In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerable to remote code executeCVE-2021-31649 · Other software · Jfinal · reported by MITRECritical 9.8
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerable to remote code execute
- Product
- Jfinal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.youdao.comnote.youdao.com
Jun 16, 2021A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.CVE-2020-9493 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.
- Product
- Apache Chainsaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Jun 10, 2021An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file.CVE-2021-3040 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comMedium 6.7
An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This issue impacts Checkov 2.0 versions earlier than Checkov 2.0.139. Checkov 1.0 versions are not impacted.
- Product
- Bridgecrew Checkov
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.comsecurity.paloaltonetworks.com
Jun 2, 2021Deserialization of untrusted data vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote authenticated attacker to create a reverse shCVE-2021-23895 · Other software · McAfee,LLC · reported by trellixpsirt@trellix.comCritical 9
Deserialization of untrusted data vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote authenticated attacker to create a reverse shell with administrator privileges on the DBSec server via carefully constructed Java serialized object sent to the DBSec server.
- Product
- McAfee Database Security (DBSec)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkc.mcafee.comkc.mcafee.com
Jun 2, 2021Deserialization of untrusted data vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote unauthenticated attacker to create a reverse CVE-2021-23894 · Other software · McAfee,LLC · reported by trellixpsirt@trellix.comCritical 9.6
Deserialization of untrusted data vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote unauthenticated attacker to create a reverse shell with administrator privileges on the DBSec server via carefully constructed Java serialized object sent to the DBSec server.
- Product
- McAfee Database Security (DBSec)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkc.mcafee.comkc.mcafee.com
Jun 1, 2021Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on.CVE-2021-25641 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte preamble flags, aka, not following the server's instruction. This means that if a weak deserializer such as the Kryo and FST are somehow in code scope (e.g. if Kryo is somehow a part of a dependency), a remote unauthenticated attacker can tell the Provider to use the weak deserializer, and then proceed to exploit it.
- Product
- Apache Dubbo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
May 27, 2021Checkbox Survey Deserialization of Untrusted Data VulnerabilityCVE-2021-27852 · Other software · Checkbox · reported by cret@cert.orgExploitedCritical 9.8
Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code.
- Product
- Checkbox Survey
- On CISA’s list since
- Apr 11, 2022 (federal fix deadline May 2, 2022)
- What to do
- Attackers are using this now. Install Checkbox’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogkb.cert.orgkb.cert.org
May 24, 2021Re-Logic Terraria before 1.4.2.3 performs Insecure Deserialization.CVE-2021-32075 · Other software · Re-logic · reported by MITRECritical 9.8
Re-Logic Terraria before 1.4.2.3 performs Insecure Deserialization.
- Product
- Terraria
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstore.steampowered.comterraria.fandom.com
May 13, 2021The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation.CVE-2021-33026 · Other software · flask-caching_project · reported by MITRECritical 9.8
The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage (e.g., filesystem, Memcached, Redis, etc.), they can construct a crafted payload, poison the cache, and execute Python code. NOTE: a third party indicates that exploitation is extremely unlikely unless the machine is already compromised; in other cases, the attacker would be unable to write their payload to the cache and generate the required collision
- Product
- flask-caching
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2021Due to how Wire handles type information in its serialization format, malicious payloads can be passed to a deserializer.CVE-2021-29508 · Other software · AsynkronIT · reported by GitHubCritical 9.1
Due to how Wire handles type information in its serialization format, malicious payloads can be passed to a deserializer. e.g. using a surrogate on the sender end, an attacker can pass information about a different type for the receiving end. And by doing so allowing the serializer to create any type on the deserializing end. This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300?view=vs-2019. This also applies to the fork of Wire.
- Product
- Wire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2021Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization.CVE-2021-32098 · Other software · Artica · reported by MITRECritical 9.8
Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sonarsource.compandorafms.com
Apr 28, 2021A remote insecure deserialization vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1.CVE-2021-25152 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 7.2
A remote insecure deserialization vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave Management Platform that address this security vulnerability.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Apr 28, 2021A remote insecure deserialization vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1.CVE-2021-25151 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 8.8
A remote insecure deserialization vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave Management Platform that address this security vulnerability.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Apr 27, 2021PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname.CVE-2020-36326 · Websites & servers · Phpmailer Project · reported by MITRECritical 9.8
PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment exploitation.
- Product
- Phpmailer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Apr 27, 2021Apache OFBiz has unsafe deserialization prior to 17.12.07 versionCVE-2021-30128 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache OFBiz has unsafe deserialization prior to 17.12.07 version
- Product
- Apache OFBiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Apr 27, 2021Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attackCVE-2021-29200 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack
- Product
- Apache OFBiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Apr 23, 2021By launching the drb_remote_codeexec exploit, a Metasploit Framework user will inadvertently expose Metasploit to the same deserialization issue that is exploitCVE-2020-7385 · Other software · Rapid7 · reported by cve@rapid7.comHigh 8.1
By launching the drb_remote_codeexec exploit, a Metasploit Framework user will inadvertently expose Metasploit to the same deserialization issue that is exploited by that module, due to the reliance on the vulnerable Distributed Ruby class functions. Since Metasploit Framework typically runs with elevated privileges, this can lead to a system compromise on the Metasploit workstation. Note that an attacker would have to lie in wait and entice the Metasploit user to run the affected module against a malicious endpoint in a "hack-back" type of attack. Metasploit is only vulnerable when the drb_remote_codeexec module is running. In most cases, this cannot happen automatically.
- Product
- Metasploit Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2021Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class.CVE-2021-3287 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class.
- Product
- Manageengine Opmanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.commanageengine.com
Apr 20, 2021An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file.CVE-2021-3035 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comMedium 6.7
An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This issue impacts Checkov 2.0 versions earlier than Checkov 2.0.26. Checkov 1.0 versions are not impacted.
- Product
- Bridgecrew Checkov
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.comsecurity.paloaltonetworks.com
Apr 14, 2021AjaxSearchPro before 4.20.8 allows Deserialization of Untrusted Data (in the import database feature of the administration panel), leading to Remote Code executCVE-2021-29654 · Other software · Stackpath · reported by MITREHigh 7.2
AjaxSearchPro before 4.20.8 allows Deserialization of Untrusted Data (in the import database feature of the administration panel), leading to Remote Code execution.
- Product
- Ajaxsearchpro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynacktiv.comsynacktiv.com
Apr 13, 2021An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code execution or other undesirable effects.CVE-2021-24028 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code execution or other undesirable effects. This issue affects Facebook Thrift prior to v2021.02.22.00.
- Product
- Facebook Thrift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comfacebook.com
Apr 12, 2021Dell SRM versions prior to 4.5.0.1 and Dell SMR versions prior to 4.5.0.1 contain an Untrusted Deserialization Vulnerability.CVE-2021-21524 · Other software · Dell · reported by security_alert@emc.comCritical 9.8
Dell SRM versions prior to 4.5.0.1 and Dell SMR versions prior to 4.5.0.1 contain an Untrusted Deserialization Vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability, leading to arbitrary privileged code execution on the vulnerable application. The severity is Critical as this may lead to system compromise by unauthenticated attackers.
- Product
- Dell EMC Storage Monitoring and Reporting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2021Apache OFBiz has unsafe deserialization prior to 17.12.06.CVE-2021-26295 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.
- Product
- Apache OFBiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comlists.apache.org
Mar 11, 2021JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessaCVE-2020-36282 · Other software · Rabbitmq · reported by MITRECritical 9.8
JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.
- Product
- JMS Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2021The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization.CVE-2020-1899 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization. This type code allowed arbitrary memory addresses to be accessed as if they were static StringData objects. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
- Product
- HHVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2021The fb_unserialize function did not impose a depth limit for nested deserialization.CVE-2020-1898 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
- Product
- HHVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.