Skip to content
OpenAdvisories

Archive

23 October 2018

Vulnerabilities first published on this day (UTC), newest first.

← September 2018 2018 / October /23 November 2018 →
  1. 151
  2. 278
  3. 340
  4. 429
  5. 5134
  6. 62
  7. 76
  8. 848
  9. 958
  10. 10110
  11. 1116
  12. 12114
  13. 13 
  14. 144
  15. 1533
  16. 1625
  17. 17262
  18. 1862
  19. 1942
  20. 202
  21. 214
  22. 2214
  23. 2369
  24. 2435
  25. 257
  26. 2637
  27. 2715
  28. 2840
  29. 2954
  30. 3040
  31. 3142
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2018-18628

    Deserialization of Untrusted Data in Pippo

    An issue was discovered in Pippo 1.11.0. The function SerializationSessionDataTranscoder.decode() calls ObjectInputStream.readObject() to deserialize a SessionData object without checking the object types. An attacker can create a malicious object, base64 enc…

    ro.pippo:pippo-core Maven
  • Critical 9.8
    CVE-2017-18349 Public exploit Scanner template EPSS 39%

    Improper Input Validation in alilibaba:fastjson

    parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST…

    com.alibaba:fastjson ro.pippo:pippo-fastjson Maven