CVSS: 9.8EPSS: 89%CPEs: 2EXPL: 6CVE-2022-25845 – Deserialization of Untrusted Data
https://notcve.org/view.php?id=CVE-2022-25845
10 Jun 2022 — The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode). El paquete com.alibaba:fastjson versiones anteriores a 1.2.83, es vulnerable a una Deserialización de Datos No Confiable... • https://github.com/nerowander/CVE-2022-25845-exploit • CWE-502: Deserialization of Untrusted Data •
CVSS: 10.0EPSS: 76%CPEs: 2EXPL: 2CVE-2017-18349
https://notcve.org/view.php?id=CVE-2017-18349
23 Oct 2018 — parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java. parseObject en Fastjson en versiones anteriores a la 1.2.25, tal y como se emplea en FastjsonEngine en Pippo 1.11.0 y otros productos, permite que atacantes remotos ejecuten códi... • https://github.com/h0cksr/Fastjson--CVE-2017-18349- • CWE-20: Improper Input Validation •