CVE & Exploit Intelligence Database

CVE-2015-5164 7.2 HIGH EPSS 0.02

The Qpid server on Red Hat Satellite 6 does not properly restrict message types, which allows remote authenticated users with administrative access on a managed content host to execute arbitrary code via a crafted message, related to a pickle processing problem in pulp.

CWE-502 Oct 18, 2017

CVE-2016-8736 9.8 CRITICAL EPSS 0.06

Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack.

CWE-502 Oct 12, 2017

CVE-2017-0903 9.8 CRITICAL 1 Writeup EPSS 0.05

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.

CWE-502 Oct 11, 2017

CVE-2017-12149 9.8 CRITICAL KEV RANSOMWARE 12 PoCs Analysis NUCLEI EPSS 0.94

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.

CWE-502 Oct 04, 2017

CVE-2017-0806 7.8 HIGH 1 PoC Analysis EPSS 0.01

An elevation of privilege vulnerability in the Android framework (gatekeeperresponse). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62998805.

CWE-502 Oct 04, 2017

CVE-2017-14702 9.8 CRITICAL 1 PoC Analysis EPSS 0.12

ERS Data System 1.8.1.0 allows remote attackers to execute arbitrary code, related to "com.branaghgroup.ecers.update.UpdateRequest" object deserialization.

CWE-502 Sep 30, 2017

CVE-2017-10932 9.8 CRITICAL EPSS 0.14

All versions prior to V12.17.20 of the ZTE Microwave NR8000 series products - NR8120, NR8120A, NR8120, NR8150, NR8250, NR8000 TR and NR8950 are the applications of C/S architecture using the Java RMI service in which the servers use the Apache Commons Collections (ACC) library that may result in Java deserialization vulnerabilities. An unauthenticated remote attacker can exploit the vulnerabilities by sending a crafted RMI request to execute arbitrary code on the target host.

CWE-502 Sep 28, 2017

CVE-2017-14141 7.2 HIGH 1 Writeup EPSS 0.02

The wiki_decode Developer System Helper function in the admin panel in Kaltura before 13.2.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object.

CWE-502 Sep 19, 2017

CVE-2017-9805 8.1 HIGH KEV RANSOMWARE 27 PoCs Analysis NUCLEI EPSS 0.94

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

CWE-502 Sep 15, 2017

CVE-2017-12612 7.8 HIGH EPSS 0.00

In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with access to any user account on the local machine. It does not affect apps run by spark-submit or spark-shell. The attacker would be able to execute code as the user that ran the Spark application. Users are encouraged to update to version 2.2.0 or later.

CWE-502 Sep 13, 2017

CVE-2016-8744 8.8 HIGH 1 PoC Analysis EPSS 0.00

Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs. SnakeYAML allows the use of YAML tags to indicate that SnakeYAML should unmarshal data to a Java type. In the default configuration in Brooklyn before 0.10.0, SnakeYAML will allow unmarshalling to any Java type available on the classpath. This could provide an authenticated user with a means to cause the JVM running Brooklyn to load and run Java code without detection by Brooklyn. Such code would have the privileges of the Java process running Brooklyn, including the ability to open files and network connections, and execute system commands. There is known to be a proof-of-concept exploit using this vulnerability.

CWE-502 Sep 13, 2017

CVE-2017-14035 9.8 CRITICAL EPSS 0.01

CrushFTP 8.x before 8.2.0 has a serialization vulnerability.

CWE-502 Aug 30, 2017

CVE-2017-11153 9.8 CRITICAL 1 PoC Analysis EPSS 0.15

Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to gain administrator privileges via a crafted serialized payload.

CWE-502 Aug 08, 2017

CVE-2017-9785 9.8 CRITICAL EPSS 0.02

Csrf.cs in NancyFX Nancy before 1.4.4 and 2.x before 2.0-dangermouse has Remote Code Execution via Deserialization of JSON data in a CSRF Cookie.

CWE-502 Jul 20, 2017

CVE-2017-1000053 8.1 HIGH EPSS 0.01

Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of Plug.Session.

CWE-502 Jul 17, 2017

CVE-2017-1000034 8.1 HIGH EPSS 0.10

Akka versions <=2.4.16 and 2.5-M1 are vulnerable to a java deserialization attack in its Remoting component resulting in remote code execution in the context of the ActorSystem.

CWE-502 Jul 17, 2017

CVE-2016-6793 9.1 CRITICAL EPSS 0.05

The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and delete files with the permissions of DiskFileItem, and if running on a Java VM before 1.3.1, execute arbitrary code via a crafted serialized Java object.

CWE-502 Jul 17, 2017

CVE-2017-9844 7.5 HIGH EXPLOITED EPSS 0.02

SAP NetWeaver 7400.12.21.30308 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object in a request to metadatauploader, aka SAP Security Note 2399804. NOTE: The vendor states that the devserver package of Visual Composer deserializes a malicious object that may cause legitimate users accessing a service, either by crashing or flooding the service.

CWE-502 Jul 12, 2017

CVE-2017-11143 7.5 HIGH EPSS 0.12

In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to crash the PHP interpreter, related to an invalid free for an empty boolean element in ext/wddx/wddx.c.

CWE-502 Jul 10, 2017

CVE-2016-4000 9.8 CRITICAL EPSS 0.12

Jython before 2.7.1rc1 allows attackers to execute arbitrary code via a crafted serialized PyFunction object.

CWE-502 Jul 06, 2017