CVE & Exploit Intelligence Database

CVE-2024-41874 9.8 CRITICAL EPSS 0.24

ColdFusion versions 2023.9, 2021.15 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability by providing crafted input to the application, which when deserialized, leads to execution of malicious code. Exploitation of this issue does not require user interaction.

CWE-502 Sep 13, 2024

CVE-2024-28991 9.0 CRITICAL EPSS 0.31

SolarWinds Access Rights Manager (ARM) was found to be susceptible to a remote code execution vulnerability. If exploited, this vulnerability would allow an authenticated user to abuse the service, resulting in remote code execution.

CWE-502 Sep 12, 2024

CVE-2024-45857 7.8 HIGH EPSS 0.00

Deserialization of untrusted data can occur in versions 2.4.0 or newer of the Cleanlab project, enabling a maliciously crafted datalab.pkl file to run arbitrary code on an end user’s system when the data directory is loaded.

CWE-502 Sep 12, 2024

CVE-2024-45855 7.1 HIGH EPSS 0.00

Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when using ‘finetune’ on it.

CWE-502 Sep 12, 2024

CVE-2024-45854 7.1 HIGH EPSS 0.00

Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when a ‘describe’ query is run on it.

CWE-502 Sep 12, 2024

CVE-2024-45853 7.1 HIGH EPSS 0.00

Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when used for a prediction.

CWE-502 Sep 12, 2024

CVE-2024-45852 8.8 HIGH EPSS 0.00

Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model to run arbitrary code on the server when interacted with.

CWE-502 Sep 12, 2024

CVE-2024-29847 9.8 CRITICAL 2 PoCs Analysis EPSS 0.67

Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.

CWE-502 Sep 12, 2024

CVE-2024-43466 6.5 MEDIUM EPSS 0.03

Microsoft SharePoint Server Denial of Service Vulnerability

CWE-502 Sep 10, 2024

CVE-2024-43464 7.2 HIGH EPSS 0.64

Microsoft SharePoint Server Remote Code Execution Vulnerability

CWE-502 Sep 10, 2024

CVE-2024-38018 8.8 HIGH EPSS 0.45

Microsoft SharePoint Server Remote Code Execution Vulnerability

CWE-502 Sep 10, 2024

CVE-2023-37227 9.8 CRITICAL EPSS 0.00

Loftware Spectrum before 4.6 HF13 Deserializes Untrusted Data.

CWE-502 Sep 10, 2024

CVE-2024-44902 9.8 CRITICAL EXPLOITED 2 PoCs Analysis EPSS 0.84

A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.

CWE-502 Sep 09, 2024

CVE-2024-37288 9.9 CRITICAL 1 PoC Analysis EPSS 0.02

A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic Security’s built-in AI tools https://www.elastic.co/guide/en/security/current/ai-for-security.html  and have configured an Amazon Bedrock connector https://www.elastic.co/guide/en/security/current/assistant-connect-to-bedrock.html .

CWE-502 Sep 09, 2024

CVE-2024-40711 9.8 CRITICAL KEV RANSOMWARE 2 PoCs Analysis NUCLEI EPSS 0.70

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).

CWE-502 Sep 07, 2024

CVE-2024-45758 9.1 CRITICAL EPSS 0.00

H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution. Exploitation can occur when an attacker has access to post to the ImportSQLTable URI with a JSON document containing a connection_url property with any typical JDBC Connection URL attack payload such as one that uses queryInterceptors.

CWE-502 Sep 06, 2024

CVE-2024-7435 8.8 HIGH EPSS 0.02

The Attire theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

CWE-502 Aug 31, 2024

CVE-2024-8016 9.1 CRITICAL EPSS 0.05

The Events Calendar Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.0.2 via deserialization of untrusted input from the 'filters' parameter in widgets. This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely. In certain configurations, this can be exploitable by lower level users. We confirmed that this plugin installed with Elementor makes it possible for users with contributor-level access and above to exploit this issue.

CWE-502 Aug 30, 2024

CVE-2024-2694 8.8 HIGH EPSS 0.02

The Betheme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 27.5.6 via deserialization of untrusted input of the 'mfn-page-items' post meta value. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

CWE-502 Aug 30, 2024

CVE-2024-8255 9.8 CRITICAL EPSS 0.06

Delta Electronics DTN Soft version 2.0.1 and prior are vulnerable to an attacker achieving remote code execution through a deserialization of untrusted data vulnerability.

CWE-502 Aug 29, 2024