CVE & Exploit Intelligence Database

CVE-2023-26326 9.8 CRITICAL 2 PoCs Analysis EPSS 0.45

The BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated insecure deserialization issue. An unauthenticated attacker could leverage this issue to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present.

CWE-502 Feb 23, 2023

CVE-2023-0960 4.7 MEDIUM EPSS 0.01

A vulnerability was found in SeaCMS 11.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /data/config.ftp.php of the component Picture Management. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-221630 is the identifier assigned to this vulnerability.

CWE-502 Feb 22, 2023

CVE-2022-48282 6.6 MEDIUM EPSS 0.01

Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C#. This affects all MongoDB .NET/C# Driver versions prior to and including v2.18.0 Following configuration must be true for the vulnerability to be applicable: * Application must written in C# taking arbitrary data from users and serializing data using _t without any validation AND * Application must be running on a Windows host using the full .NET Framework, not .NET Core AND * Application must have domain model class with a property/field explicitly of type System.Object or a collection of type System.Object (against MongoDB best practice) AND * Malicious attacker must have unrestricted insert access to target database to add a _t discriminator."Following configuration must be true for the vulnerability to be applicable

CWE-502 Feb 21, 2023

CVE-2023-26234 6.6 MEDIUM EPSS 0.00

JD-GUI 1.6.6 allows deserialization via UIMainWindowPreferencesProvider.singleInstance.

CWE-502 Feb 21, 2023

CVE-2022-47986 9.8 CRITICAL KEV RANSOMWARE 6 PoCs Analysis NUCLEI EPSS 0.94

IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.

CWE-502 Feb 17, 2023

CVE-2023-23836 7.2 HIGH EPSS 0.67

SolarWinds Platform version 2022.4.1 was found to be susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to the SolarWinds Web Console to execute arbitrary commands.

CWE-502 Feb 15, 2023

CVE-2022-47507 7.2 HIGH EPSS 0.11

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.

CWE-502 Feb 15, 2023

CVE-2022-47504 7.2 HIGH EPSS 0.07

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.

CWE-502 Feb 15, 2023

CVE-2022-47503 7.2 HIGH EPSS 0.11

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.

CWE-502 Feb 15, 2023

CVE-2022-38111 7.2 HIGH EPSS 0.17

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.

CWE-502 Feb 15, 2023

CVE-2023-21713 8.8 HIGH EPSS 0.02

Microsoft SQL Server Remote Code Execution Vulnerability

CWE-502 Feb 14, 2023

CVE-2023-21710 7.2 HIGH EPSS 0.05

Microsoft Exchange Server Remote Code Execution Vulnerability

CWE-502 Feb 14, 2023

CVE-2023-21707 8.8 HIGH 1 PoC Analysis EPSS 0.71

Microsoft Exchange Server Remote Code Execution Vulnerability

CWE-502 Feb 14, 2023

CVE-2023-21706 8.8 HIGH EPSS 0.01

Microsoft Exchange Server Remote Code Execution Vulnerability

CWE-502 Feb 14, 2023

CVE-2023-21703 6.5 MEDIUM EPSS 0.02

Azure Data Box Gateway Remote Code Execution Vulnerability

CWE-502 Feb 14, 2023

CVE-2023-21568 7.3 HIGH EPSS 0.01

Microsoft SQL Server Integration Service (VS extension) Remote Code Execution Vulnerability

CWE-502 Feb 14, 2023

CVE-2023-21529 8.8 HIGH 1 PoC EPSS 0.37

Microsoft Exchange Server Remote Code Execution Vulnerability

CWE-502 Feb 14, 2023

CVE-2023-25558 7.5 HIGH 1 Writeup EPSS 0.05

DataHub is an open-source metadata platform. When the DataHub frontend is configured to authenticate via SSO, it will leverage the pac4j library. The processing of the `id_token` is done in an unsafe manner which is not properly accounted for by the DataHub frontend. Specifically, if any of the id_token claims value start with the {#sb64} prefix, pac4j considers the value to be a serialized Java object and will deserialize it. This issue may lead to Remote Code Execution (RCE) in the worst case. Although a `RestrictedObjectInputStream` is in place, that puts some restriction on what classes can be deserialized, it still allows a broad range of java packages and potentially exploitable with different gadget chains. Users are advised to upgrade. There are no known workarounds. This vulnerability was discovered and reported by the GitHub Security lab and is tracked as GHSL-2022-086.

CWE-502 Feb 11, 2023

CVE-2022-45982 9.8 CRITICAL EPSS 0.05

thinkphp 6.0.0~6.0.13 and 6.1.0~6.1.1 contains a deserialization vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload.

CWE-502 Feb 08, 2023

CVE-2023-25194 8.8 HIGH EXPLOITED 6 PoCs Analysis NUCLEI EPSS 0.94

A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, which has been possible on Kafka Connect clusters since Apache Kafka Connect 2.3.0. When configuring the connector via the Kafka Connect REST API, an authenticated operator can set the `sasl.jaas.config` property for any of the connector's Kafka clients to "com.sun.security.auth.module.JndiLoginModule", which can be done via the `producer.override.sasl.jaas.config`, `consumer.override.sasl.jaas.config`, or `admin.override.sasl.jaas.config` properties. This will allow the server to connect to the attacker's LDAP server and deserialize the LDAP response, which the attacker can use to execute java deserialization gadget chains on the Kafka connect server. Attacker can cause unrestricted deserialization of untrusted data (or) RCE vulnerability when there are gadgets in the classpath. Since Apache Kafka 3.0.0, users are allowed to specify these properties in connector configurations for Kafka Connect clusters running with out-of-the-box configurations. Before Apache Kafka 3.0.0, users may not specify these properties unless the Kafka Connect cluster has been reconfigured with a connector client override policy that permits them. Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka Connect 3.4.0. We advise the Kafka Connect users to validate connector configurations and only allow trusted JNDI configurations. Also examine connector dependencies for vulnerable versions and either upgrade their connectors, upgrading that specific dependency, or removing the connectors as options for remediation. Finally, in addition to leveraging the "org.apache.kafka.disallowed.login.modules" system property, Kafka Connect users can also implement their own connector client config override policy, which can be used to control which Kafka client properties can be overridden directly in a connector config and which cannot.

CWE-502 Feb 07, 2023