https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 07:16:37 +0000 https://cve.radiocsirt.org/vuln/cnvd-2018-07224 cnvd-2018-07224 https://cve.radiocsirt.org/vuln/cnvd-2018-07224 https://cve.radiocsirt.org/vuln/euvd-2026-179355 EUVD-2026-179355 https://cve.radiocsirt.org/vuln/euvd-2026-179355 https://cve.radiocsirt.org/vuln/fkie_cve-2018-1295 <p>In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a specially prepared form of a serialized object to one of the deserialization endpoints of some Ignite components - discovery SPI, Ignite persistence, Memcached endpoint, socket steamer.</p> <p>In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a specially prepared form of a serialized object to one of the deserialization endpoints of some Ignite components - discovery SPI, Ignite persistence, Memcached endpoint, socket steamer.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2018-1295 https://cve.radiocsirt.org/vuln/ghsa-chp4-rv79-68j3 <p><strong>Affected:</strong> Maven: org.apache.ignite:ignite-core</p> <p>In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a specially prepared form of a serialized object to one of the deserialization endpoints of some Ignite components - discovery SPI, Ignite persistence, Memcached endpoint, socket steamer.</p> <p><strong>Affected:</strong> Maven: org.apache.ignite:ignite-core</p> <p>In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a specially prepared form of a serialized object to one of the deserialization endpoints of some Ignite components - discovery SPI, Ignite persistence, Memcached endpoint, socket steamer.</p> https://cve.radiocsirt.org/vuln/ghsa-chp4-rv79-68j3 https://cve.radiocsirt.org/vuln/gsd-2018-1295 gsd-2018-1295 https://cve.radiocsirt.org/vuln/gsd-2018-1295 https://cve.radiocsirt.org/vuln/rhsa-2018:2405 <p>spring-boot: Malicious PATCH requests submitted to servers can use specially crafted JSON data to run arbitrary Java code undertow: Client can use bogus uri in Digest authentication spring-framework: Improper URL path validation allows for bypassing of security checks on static resources ignite: Possible Execution of Arbitrary Code Within Deserialization Endpoints spark: Absolute and relative pathnames allow for unintended static file disclosure</p> <p>spring-boot: Malicious PATCH requests submitted to servers can use specially crafted JSON data to run arbitrary Java code undertow: Client can use bogus uri in Digest authentication spring-framework: Improper URL path validation allows for bypassing of security checks on static resources ignite: Possible Execution of Arbitrary Code Within Deserialization Endpoints spark: Absolute and relative pathnames allow for unintended static file disclosure</p> https://cve.radiocsirt.org/vuln/rhsa-2018:2405