Known Exploited Vulnerabilities Deserialization of Untrusted Data Capability Group

Zero-day .NET deserialization vulnerability that allows an adversary to make an HTTP POST request to a vulnerable WS_FTP Server and execute commands.

Zero-day .NET deserialization vulnerability that allows an adversary to make an HTTP POST request to a vulnerable WS_FTP Server and execute commands.

This vulnerability is utilized by exploiting a public-facing server.

CVE 2019-18935 is a Insecure Deserialization vulnerability with the Telerik UI, which does not properly sanitize serialized data inputs from the user. This vulnerability leads to the application being vulnerable to RCE attacks that may lead to a full system compromise.

CVE 2019-18935 is a Insecure Deserialization vulnerability with the Telerik UI, which does not properly sanitize serialized data inputs from the user. This vulnerability leads to the application being vulnerable to RCE attacks that may lead to a full system compromise.

CVE 2019-18935 is a Insecure Deserialization vulnerability with the Telerik UI, which does not properly sanitize serialized data inputs from the user. This vulnerability leads to the application being vulnerable to RCE attacks that may lead to a full system compromise.

CVE 2019-18935 is a Insecure Deserialization vulnerability with the Telerik UI, which does not properly sanitize serialized data inputs from the user. This vulnerability leads to the application being vulnerable to RCE attacks that may lead to a full system compromise.

This vulnerability gives an adversary access through exploitation of a public-facing server.

This vulnerability gives an adversary access through exploitation of a public-facing server.

This vulnerability gives an adversary access through exploitation of a public-facing server.

This vulnerability gives an adversary access through exploitation of a public-facing server.

This vulnerability gives an adversary access through exploitation of a public-facing server.

This vulnerability gives an adversary access through exploitation of a public-facing server.

This vulnerability gives an adversary access through exploitation of a public-facing server.

This vulnerability gives an adversary access through exploitation of a public-facing server.

This vulnerability gives an adversary access through exploitation of a public-facing server.

CVE-2017-9805 is a deserialization vulnerability in the Apache Struts REST Plugin that could allow an attacker to execute arbitrary commands remotely on the affected systems by sending a specially crafted web request to the application.

CVE-2017-9805 is a deserialization vulnerability in the Apache Struts REST Plugin that could allow an attacker to execute arbitrary commands remotely on the affected systems by sending a specially crafted web request to the application.

As referenced in the attached report, T1190 is a known impact of this exploit.

As referenced in the attached report, T1133 is a known impact of this exploit.

This deserialization vulnerability allows adversaries to insert their own objects into client software for potential execution.

This vulnerability can be utilized by exploited a public-facing application. APT groups have used this exploit to deploy webshells.

This vulnerability can be utilized by exploited a public-facing application. APT groups have used this exploit to deploy webshells.

This vulnerability can be utilized by exploited a public-facing application. APT groups have used this exploit to deploy webshells.

This vulnerability can be utilized by exploited a public-facing application. APT groups have used this exploit to deploy webshells.

This vulnerability is utilized by exploiting a public-facing server.

CVE-2023-29492 is an insecure deserialization vulnerability. Exploitation of this vulnerability gives remote attackers arbitrary code execution in the context of the service account.

Zero-day .NET deserialization vulnerability that allows an adversary to make an HTTP POST request to a vulnerable WS_FTP Server and execute commands.

CVE 2021-45046 is a Log4J-related vulnerability that has been seen to be used in cryptomining and ransomware operations.

CVE 2021-45046 is a Log4J-related vulnerability that could enable enables an attacker to cause Remote Code Execution or other effects in certain non-default configurations. This specific vulnerability has been reported to have been leveraged in cryptomining and ransomware operations.

This vulnerability is exploited by a remote attacker who manipulates serialized class types in the OpenWire protocol to run arbitrary shell commands. This allows the adversary to execute remote code, leading to the download and installation of malware, such as the Kinsing malware and cryptocurrency miners, on Linux systems. Additionally, attackers have attempted to deploy ransomware, attributed to the HelloKitty ransomware family, on target systems.

This vulnerability is exploited by a remote attacker who manipulates serialized class types in the OpenWire protocol to run arbitrary shell commands. This allows the adversary to execute remote code, leading to the download and installation of malware, such as the Kinsing malware and cryptocurrency miners, on Linux systems. Additionally, attackers have attempted to deploy ransomware, attributed to the HelloKitty ransomware family, on target systems.

This vulnerability is exploited by a remote attacker who manipulates serialized class types in the OpenWire protocol to run arbitrary shell commands. This allows the adversary to execute remote code, leading to the download and installation of malware, such as the Kinsing malware and cryptocurrency miners, on Linux systems. Additionally, attackers have attempted to deploy ransomware, attributed to the HelloKitty ransomware family, on target systems.