Skip to content

Breaking

Attackers Hijack Staples and Dell Order Notifications for Voice Phishing
aiohttp multipart requests cause unbounded file descriptor retention in versions up to 3.14.3
Eclipse ioFog WebSocket Authentication Bypass Leaves Admin Control Unprotected in Unpatched Versions
Argo CD JSONnet Flaw Risks Server Crash and File Read for Low-Priv Users Up to 3.6.0
Argo CD Kustomize Injection Bug Lets Read-Only Users Run Code on Repo Servers
PHP Remote Code Execution Flaws Rated 9.2 Trigger Emergency Patch Plan
Attackers Hijack Staples and Dell Order Notifications for Voice Phishing
aiohttp multipart requests cause unbounded file descriptor retention in versions up to 3.14.3
Eclipse ioFog WebSocket Authentication Bypass Leaves Admin Control Unprotected in Unpatched Versions
Argo CD JSONnet Flaw Risks Server Crash and File Read for Low-Priv Users Up to 3.6.0
Argo CD Kustomize Injection Bug Lets Read-Only Users Run Code on Repo Servers
PHP Remote Code Execution Flaws Rated 9.2 Trigger Emergency Patch Plan

Deserialization

Everything RedTeam Tribune has reported about Deserialization: 2 stories, newest first. Part of our Vulnerabilities coverage.

14 Oct
Vulnerabilities

.NET WPF Patch Fixes High-Severity RCE Flaw in Framework 8-11 Preview Requiring User Interaction

Microsoft patches a high-severity vulnerability in .NET WPF that allows attackers to run arbitrary code if users engage with crafted content.

11 Oct
Vulnerabilities

Why is insecure deserialization dangerous: The hidden execution risk

Insecure deserialization allows attackers to execute arbitrary code by tricking applications into loading crafted data structures as active objects.