CVE-2024-23052
An issue in WuKongOpenSource WukongCRM v.72crm_9.0.1_20191202 allows a remote attacker to execute arbitrary code via the parseObject() function in the fastjson component.
CVSS9.8EPSS 77.9%
共找到 12 条公开漏洞记录
An issue in WuKongOpenSource WukongCRM v.72crm_9.0.1_20191202 allows a remote attacker to execute arbitrary code via the parseObject() function in the fastjson component.
Fastjson 1.2.80 is susceptible to a deserialization remote code execution vulnerability.
Fastjson 1.2.47 is susceptible to a deserialization remote code execution vulnerability.
Fastjson 1.2.24 is susceptible to a deserialization remote code execution vulnerability.
The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).
Fastjson 1.2.68 is susceptible to a deserialization remote code execution vulnerability.
Fastjson 1.2.67 is susceptible to a remote code execution vulnerability.
Fastjson 1.2.62 is susceptible to a deserialization remote code execution vulnerability.
Fastjson 1.2.43 is susceptible to a deserialization remote code execution vulnerability.
Fastjson 1.2.42 is susceptible to a deserialization remote code execution vulnerability
Fastjson 1.2.41 is susceptible to a deserialization remote code execution vulnerability.
parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.