CVE & Exploit Intelligence Database

CVE-2020-36183 8.1 HIGH 2 PoCs Analysis EPSS 0.02

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.

CWE-502 Jan 07, 2021

CVE-2020-36182 8.1 HIGH 2 PoCs Analysis EPSS 0.03

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.

CWE-502 Jan 07, 2021

CVE-2020-36180 8.1 HIGH 3 PoCs Analysis EPSS 0.03

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.

CWE-502 Jan 07, 2021

CVE-2020-36179 8.1 HIGH 3 PoCs Analysis EPSS 0.60

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.

CWE-502 Jan 07, 2021

CVE-2020-36189 8.1 HIGH 2 PoCs Analysis EPSS 0.04

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.

CWE-502 Jan 06, 2021

CVE-2020-36188 8.1 HIGH 3 PoCs Analysis EPSS 0.09

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.

CWE-502 Jan 06, 2021

CVE-2020-36187 8.1 HIGH 2 PoCs Analysis EPSS 0.02

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.

CWE-502 Jan 06, 2021

CVE-2020-36186 8.1 HIGH 2 PoCs Analysis EPSS 0.02

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.

CWE-502 Jan 06, 2021

CVE-2020-36185 8.1 HIGH 2 PoCs Analysis EPSS 0.03

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.

CWE-502 Jan 06, 2021

CVE-2020-36184 8.1 HIGH 3 PoCs Analysis EPSS 0.07

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.

CWE-502 Jan 06, 2021

CVE-2020-36181 8.1 HIGH 2 PoCs Analysis EPSS 0.05

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS.

CWE-502 Jan 06, 2021

CVE-2020-8884 8.8 HIGH EPSS 0.11

rcdsvc in the Proofpoint Insider Threat Management Windows Agent (formerly ObserveIT Windows Agent) before 7.9 allows remote authenticated users to execute arbitrary code as SYSTEM because of improper deserialization over named pipes.

CWE-502 Jan 06, 2021

CVE-2020-10658 9.8 CRITICAL EPSS 0.07

The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteImage API. The vulnerability allows an anonymous remote attacker to execute arbitrary code with local administrator privileges. The vulnerability is caused by improper deserialization.

CWE-502 Jan 06, 2021

CVE-2020-10657 7.2 HIGH EPSS 0.05

The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM web console's ImportAlertRules feature. The vulnerability allows a remote attacker (with admin or config-admin privileges in the console) to execute arbitrary code with local administrator privileges. The vulnerability is caused by improper deserialization.

CWE-502 Jan 06, 2021

CVE-2020-10656 9.8 CRITICAL EPSS 0.07

The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteWindowMouseWithChunksV2 API. The vulnerability allows an anonymous remote attacker to execute arbitrary code with local administrator privileges. The vulnerability is caused by improper deserialization.

CWE-502 Jan 06, 2021

CVE-2020-10655 9.8 CRITICAL EPSS 0.07

The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteWindowMouse API. The vulnerability allows an anonymous remote attacker to execute arbitrary code with local administrator privileges. The vulnerability is caused by improper deserialization.

CWE-502 Jan 06, 2021

CVE-2020-35488 7.5 HIGH 3 PoCs Analysis EPSS 0.19

The fileop module of the NXLog service in NXLog Community Edition 2.10.2150 allows remote attackers to cause a denial of service (daemon crash) via a crafted Syslog payload to the Syslog service. This attack requires a specific configuration. Also, the name of the directory created must use a Syslog field. (For example, on Linux it is not possible to create a .. directory. On Windows, it is not possible to create a CON directory.)

CWE-502 Jan 05, 2021

CVE-2019-4728 8.8 HIGH EPSS 0.16

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of untrusted data. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code with SYSTEM privileges. IBM X-Force ID: 172452.

CWE-502 Jan 05, 2021

CVE-2021-3007 9.8 CRITICAL EXPLOITED 3 PoCs Analysis NUCLEI EPSS 0.90

Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a "vulnerability in the PHP language itself" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserialized

CWE-502 Jan 04, 2021

CVE-2020-35939 7.5 HIGH EPSS 0.01

PHP Object injection vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to team_import_xml_layouts.

CWE-502 Jan 01, 2021