#Deserialization

Apache ActiveMQ (Java OpenWire brokers and clients) ✓Patched

A deserialization flaw in ActiveMQ's Java OpenWire protocol marshaller let anyone who could reach a broker run shell commands on it. Within days of the fix, attackers were deploying HelloKitty ransomware through it.

Progress WS_FTP Server ✓Patched

Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system. Added to CISA KEV on 2023-10-05. CISA lists known use in ransomware campaigns.

Adobe ColdFusion ✓Patched

Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user. Added to CISA KEV on 2023-08-21.

Netwrix Auditor ✓Patched

Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\SYSTEM user. Successful exploitation requires that the attacker is able to reach port 9004/TCP, which is commonly blocked by standard enterprise firewalling. Added to CISA KEV on 2023-07-11. CISA lists known use in ransomware campaigns.

Novi Survey ✓Patched

Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context of the service account. Added to CISA KEV on 2023-04-13.

Adobe ColdFusion ✓Patched

Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution. Added to CISA KEV on 2023-03-15.

IBM Aspera Faspex ✓Patched

IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw. Added to CISA KEV on 2023-02-21. CISA lists known use in ransomware campaigns.