Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage

Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget class is on the classpath, remote code execution. The fix disables ObjectMessage deserialization by default, with a configuration switch to re-enable it if needed. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

WordPress WPBruiser {no- Captcha anti-Spam} plugin <= 3.1.43 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions.

WordPress 69 Clothing theme <= 1.2.11.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions.

WordPress A.Williams theme <= 1.3.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions.

WordPress Ajax Search Lite plugin <= 4.14.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.

WordPress Accalia theme <= 1.5.3 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions.

WordPress AI ANN theme <= 1.29.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions.

WordPress Agricola theme <= 1.21.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions.

C-CURE 9000 and Victor application server - Deserialization of Untrusted Data

Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application Server allows capec-586. This issue affects victor: before 8.0; CCure 9000: before 3.2; Victor Application Server: before 4.1.

WordPress Advice theme <= 1.18.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions.

WordPress Jeg Elementor Kit plugin <= 3.2.10 - PHP Object Injection vulnerability

Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions.

WordPress Adrena theme <= 1.2.14 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions.

WordPress Abogado theme <= 1.18 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Abogado <= 1.18 versions.

kotaemon 0.12.0 Unauthenticated Remote Code Execution via Insecure Deserialization

kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a __type__ field. Attackers can exploit this to override the __type__ field with subprocess.check_output and arbitrary arguments, achieving remote code execution with application process privileges.

ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant

Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.

.NET Framework Remote Code Execution Vulnerability

Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.

Deserialization Vulnerability in NVIDIA Dynamo for Linux Leading to Denial of Service and Data Tampering

NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to denial of service and data tampering.

.NET Remote Code Execution Vulnerability

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

ASoC: codecs: wcd938x: fix incorrect used of portid

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd938x: fix incorrect used of portid Mixer controls have the channel id in mixer->reg, which is not same as port id. port id should be derived from chan_info array. So fix this. Without this, its possible that we could corrupt struct wcd938x_sdw_priv by accessing port_map array out of range with channel id instead of port id.