CVE & Exploit Intelligence Database

CVE-2021-33790 9.8 CRITICAL EPSS 0.05

The RebornCore library before 4.7.3 allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as part of reborncore.common.network.ExtendedPacketBuffer. An attacker can instantiate any class on the classpath with any data. A class usable for exploitation might or might not be present, depending on what Minecraft modifications are installed.

CWE-502 May 31, 2021

CVE-2021-29505 7.5 HIGH 3 PoCs Analysis NUCLEI EPSS 0.91

XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.

CWE-502 May 28, 2021

CVE-2021-27852 9.8 CRITICAL KEV EPSS 0.26

Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This issue affects: Checkbox Survey versions prior to 7.

CWE-502 May 27, 2021

CVE-2021-32075 9.8 CRITICAL EPSS 0.01

Re-Logic Terraria before 1.4.2.3 performs Insecure Deserialization.

CWE-502 May 24, 2021

CVE-2021-24307 8.8 HIGH 1 PoC Analysis EPSS 0.42

The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseo_tools_settings" privilege (most of the time admin) to execute arbitrary code on the underlying host. Users can restore plugin's configuration by uploading a backup .ini file in the section "Tool > Import/Export". However, the plugin attempts to unserialize values of the .ini file. Moreover, the plugin embeds Monolog library which can be used to craft a gadget chain and thus trigger system command execution.

CWE-502 May 24, 2021

CVE-2021-32634 7.2 HIGH 1 Writeup EPSS 0.03

Emissary is a distributed, peer-to-peer, data-driven workflow framework. Emissary 6.4.0 is vulnerable to Unsafe Deserialization of post-authenticated requests to the [`WorkSpaceClientEnqueue.action`](https://github.com/NationalSecurityAgency/emissary/blob/30c54ef16c6eb6ed09604a929939fb9f66868382/src/main/java/emissary/server/mvc/internal/WorkSpaceClientEnqueueAction.java) REST endpoint. This issue may lead to post-auth Remote Code Execution. This issue has been patched in version 6.5.0. As a workaround, one can disable network access to Emissary from untrusted sources.

CWE-502 May 21, 2021

CVE-2021-31474 9.8 CRITICAL EPSS 0.54

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Performance Monitor 2020.2.1. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SolarWinds.Serialization library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-12213.

CWE-502 May 21, 2021

CVE-2021-24280 8.8 HIGH EPSS 0.03

In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the import_from_debug AJAX action to inject PHP objects.

CWE-502 May 14, 2021

CVE-2021-33026 9.8 CRITICAL 2 PoCs Analysis EPSS 0.16

The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage (e.g., filesystem, Memcached, Redis, etc.), they can construct a crafted payload, poison the cache, and execute Python code. NOTE: a third party indicates that exploitation is extremely unlikely unless the machine is already compromised; in other cases, the attacker would be unable to write their payload to the cache and generate the required collision

CWE-502 May 13, 2021

CVE-2021-29508 9.1 CRITICAL EPSS 0.00

Due to how Wire handles type information in its serialization format, malicious payloads can be passed to a deserializer. e.g. using a surrogate on the sender end, an attacker can pass information about a different type for the receiving end. And by doing so allowing the serializer to create any type on the deserializing end. This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300?view=vs-2019. This also applies to the fork of Wire.

CWE-502 May 11, 2021

CVE-2021-32098 9.8 CRITICAL EPSS 0.03

Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization.

CWE-502 May 07, 2021

CVE-2021-25152 7.2 HIGH EPSS 0.01

A remote insecure deserialization vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave Management Platform that address this security vulnerability.

CWE-502 Apr 28, 2021

CVE-2021-25151 8.8 HIGH EPSS 0.06

A remote insecure deserialization vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave Management Platform that address this security vulnerability.

CWE-502 Apr 28, 2021

CVE-2020-36326 9.8 CRITICAL 1 Writeup EPSS 0.01

PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment exploitation.

CWE-502 Apr 28, 2021

CVE-2021-29476 9.8 CRITICAL EXPLOITED EPSS 0.02

Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.

CWE-502 Apr 27, 2021

CVE-2021-30128 9.8 CRITICAL 2 PoCs Analysis NUCLEI EPSS 0.94

Apache OFBiz has unsafe deserialization prior to 17.12.07 version

CWE-502 Apr 27, 2021

CVE-2021-29200 9.8 CRITICAL 2 PoCs Analysis NUCLEI EPSS 0.92

Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack

CWE-502 Apr 27, 2021

CVE-2020-7385 8.1 HIGH EPSS 0.01

By launching the drb_remote_codeexec exploit, a Metasploit Framework user will inadvertently expose Metasploit to the same deserialization issue that is exploited by that module, due to the reliance on the vulnerable Distributed Ruby class functions. Since Metasploit Framework typically runs with elevated privileges, this can lead to a system compromise on the Metasploit workstation. Note that an attacker would have to lie in wait and entice the Metasploit user to run the affected module against a malicious endpoint in a "hack-back" type of attack. Metasploit is only vulnerable when the drb_remote_codeexec module is running. In most cases, this cannot happen automatically.

CWE-502 Apr 23, 2021

CVE-2021-27277 7.8 HIGH EPSS 0.02

This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Orion Virtual Infrastructure Monitor 2020.2. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the OneTimeJobSchedulerEventsService WCF service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-11955.

CWE-502 Apr 22, 2021

CVE-2021-3287 9.8 CRITICAL EXPLOITED NUCLEI EPSS 0.86

Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class.

CWE-502 Apr 22, 2021