Total
2016 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-49772 | 1 Phpbits | 1 Genesis Simple Love | 2024-11-21 | N/A | 10.0 CRITICAL |
| Deserialization of Untrusted Data vulnerability in Phpbits Creative Studio Genesis Simple Love.This issue affects Genesis Simple Love: from n/a through 2.0. | |||||
| CVE-2023-49297 | 1 Iterative | 1 Pydrive2 | 2024-11-21 | N/A | 3.3 LOW |
| PyDrive2 is a wrapper library of google-api-python-client that simplifies many common Google Drive API V2 tasks. Unsafe YAML deserilization will result in arbitrary code execution. A maliciously crafted YAML file can cause arbitrary code execution if PyDrive2 is run in the same directory as it, or if it is loaded in via `LoadSettingsFile`. This is a deserilization attack that will affect any user who initializes GoogleAuth from this package while a malicious yaml file is present in the same directory. This vulnerability does not require the file to be directly loaded through the code, only present. This issue has been addressed in commit `c57355dc` which is included in release version `1.16.2`. Users are advised to upgrade. There are no known workarounds for this vulnerability. | |||||
| CVE-2023-48967 | 1 Noear | 1 Solon | 2024-11-21 | N/A | 9.8 CRITICAL |
| Ssolon <= 2.6.0 and <=2.5.12 is vulnerable to Deserialization of Untrusted Data. | |||||
| CVE-2023-48952 | 1 Openlinksw | 1 Virtuoso | 2024-11-21 | N/A | 7.5 HIGH |
| An issue in the box_deserialize_reusing function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement. | |||||
| CVE-2023-48887 | 1 Fengjiachun | 1 Jupiter | 2024-11-21 | N/A | 9.8 CRITICAL |
| A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request. | |||||
| CVE-2023-48886 | 1 Luxiaoxun | 1 Nettyrpc | 2024-11-21 | N/A | 9.8 CRITICAL |
| A deserialization vulnerability in NettyRpc v1.2 allows attackers to execute arbitrary commands via sending a crafted RPC request. | |||||
| CVE-2023-47507 | 1 Averta | 1 Master Slider Pro | 2024-11-21 | N/A | 7.1 HIGH |
| Deserialization of Untrusted Data vulnerability in Master Slider Master Slider Pro.This issue affects Master Slider Pro: from n/a through 3.6.5. | |||||
| CVE-2023-47207 | 1 Deltaww | 1 Infrasuite Device Master | 2024-11-21 | N/A | 9.8 CRITICAL |
| In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an unauthenticated attacker to execute code with local administrator privileges. | |||||
| CVE-2023-47204 | 1 Toumorokoshi | 1 Transmute-core | 2024-11-21 | N/A | 9.8 CRITICAL |
| Unsafe YAML deserialization in yaml.Loader in transmute-core before 1.13.5 allows attackers to execute arbitrary Python code. | |||||
| CVE-2023-47174 | 1 Thorntech | 2 Sftp Gateway, Sftp Gateway Firmware | 2024-11-21 | N/A | 9.8 CRITICAL |
| Thorn SFTP gateway 3.4.x before 3.4.4 uses Pivotal Spring Framework for Java deserialization of untrusted data, which is not supported by Pivotal, a related issue to CVE-2016-1000027. Also, within the specific context of Thorn SFTP gateway, this leads to remote code execution. | |||||
| CVE-2023-46990 | 1 Publiccms | 1 Publiccms | 2024-11-21 | N/A | 9.8 CRITICAL |
| Deserialization of Untrusted Data in PublicCMS v.4.0.202302.e allows a remote attacker to execute arbitrary code via a crafted script to the writeReplace function. | |||||
| CVE-2023-46817 | 1 Phpfox | 1 Phpfox | 2024-11-21 | N/A | 9.8 CRITICAL |
| An issue was discovered in phpFox before 4.8.14. The url request parameter passed to the /core/redirect route is not properly sanitized before being used in a call to the unserialize() PHP function. This can be exploited by remote, unauthenticated attackers to inject arbitrary PHP objects into the application scope, allowing them to perform a variety of attacks, such as executing arbitrary PHP code. | |||||
| CVE-2023-46801 | 1 Apache | 1 Linkis | 2024-11-21 | N/A | 8.8 HIGH |
| In Apache Linkis <= 1.5.0, data source management module, when adding Mysql data source, exists remote code execution vulnerability for java version < 1.8.0_241. The deserialization vulnerability exploited through jrmp can inject malicious files into the server and execute them. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. We recommend that users upgrade the java version to >= 1.8.0_241. Or users upgrade Linkis to version 1.6.0. | |||||
| CVE-2023-46674 | 1 Elastic | 1 Elasticsearch | 2024-11-21 | N/A | 6.0 MEDIUM |
| An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for reporting this issue. | |||||
| CVE-2023-46615 | 1 Kallidan | 1 Kd Coming Soon | 2024-11-21 | N/A | 5.4 MEDIUM |
| Deserialization of Untrusted Data vulnerability in Kalli Dan. KD Coming Soon.This issue affects KD Coming Soon: from n/a through 1.7. | |||||
| CVE-2023-46227 | 1 Apache | 1 Inlong | 2024-11-21 | N/A | 7.5 HIGH |
| Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can use \t to bypass. Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/8814 | |||||
| CVE-2023-46154 | 1 E2pdf | 1 E2pdf | 2024-11-21 | N/A | 6.6 MEDIUM |
| Deserialization of Untrusted Data vulnerability in E2Pdf.Com E2Pdf – Export To Pdf Tool for WordPress.This issue affects E2Pdf – Export To Pdf Tool for WordPress: from n/a through 1.20.18. | |||||
| CVE-2023-46147 | 1 Themify | 1 Ultra | 2024-11-21 | N/A | 7.4 HIGH |
| Deserialization of Untrusted Data vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5. | |||||
| CVE-2023-45672 | 1 Frigate | 1 Frigate | 2024-11-21 | N/A | 7.5 HIGH |
| Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, an unsafe deserialization vulnerability was identified in the endpoints used to save configurations for Frigate. This can lead to unauthenticated remote code execution. This can be performed through the UI at `/config` or through a direct call to `/api/config/save`. Exploiting this vulnerability requires the attacker to both know very specific information about a user's Frigate server and requires an authenticated user to be tricked into clicking a specially crafted link to their Frigate instance. This vulnerability could exploited by an attacker under the following circumstances: Frigate publicly exposed to the internet (even with authentication); attacker knows the address of a user's Frigate instance; attacker crafts a specialized page which links to the user's Frigate instance; attacker finds a way to get an authenticated user to visit their specialized page and click the button/link. Input is initially accepted through `http.py`. The user-provided input is then parsed and loaded by `load_config_with_no_duplicates`. However, `load_config_with_no_duplicates` does not sanitize this input by merit of using `yaml.loader.Loader` which can instantiate custom constructors. A provided payload will be executed directly at `frigate/util/builtin.py:110`. This issue may lead to pre-authenticated Remote Code Execution. Version 0.13.0 Beta 3 contains a patch. | |||||
| CVE-2023-45146 | 1 Xxl-rpc Project | 1 Xxl-rpc | 2024-11-21 | N/A | 9.0 CRITICAL |
| XXL-RPC is a high performance, distributed RPC framework. With it, a TCP server can be set up using the Netty framework and the Hessian serialization mechanism. When such a configuration is used, attackers may be able to connect to the server and provide malicious serialized objects that, once deserialized, force it to execute arbitrary code. This can be abused to take control of the machine the server is running by way of remote code execution. This issue has not been fixed. | |||||