PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2019-18935: Remote Code Execution via Insecure Deserialization in Telerik UI

bishopfox.com | vulnerability | #rce | #deserialization | #patching | #telerik | #cve-2019-18935
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Caleb Gross details CVE-2019-18935: insecure JSON deserialization in Telerik UI for ASP.NET AJAX yields remote code execution; includes the CVE-2017-11317 upload chain and patching.
Published
Collected

Related coverage

vulnerability · blog.viettelcybersecurity.com
[CVE-2019-18935] Các lỗ hổng bảo mật được khai thác nhiều trong 6 tháng đầu năm 2023 - Phần 2
Part II examines CVE-2019-18935, insecure JSON deserialization in Telerik UI's RadAsyncUpload that yields RCE, chained with CVE-2017-11317 file upload to plant malicious DLLs.
vulnerability · netspi.com
CVE-2025-26399 SolarWinds Web Help Desk Overview and Takeaways
CVE-2025-26399 is a critical unauthenticated deserialization flaw (CVSS 9.8) in SolarWinds Web Help Desk, a patch bypass now actively exploited and listed in CISA's KEV catalog.
vulnerability · bishopfox.com
Mind the Config: Detecting and Weaponizing NetScaler CVE-2026-19490
Bishop Fox maps NetScaler CVE-2026-19490, a CVSS 9.3 SAML bypass: one request runs post-login code, impact ranges from crash to internal proxy to root, plus a safe patch-state checker.
vulnerability · bishopfox.com
Master Key Included: Detecting SolarWinds ARM CVE-2026-28326
CVE-2026-28326 is an unauthenticated RCE in SolarWinds ARM where a hardcoded shared secret on TCP 55555 leads to SYSTEM-level code execution. Patch now.
Critical · vulnerability · aikido.dev
Node2Shell Evolves to HTTP2Shell: Google Brotli Flaw (CVE-2026-111497) Affects HTTP Ecosystem
Brotli is ubiquitous across the modern HTTP ecosystem for web asset compression. Because the flaw allows unauthenticated remote code execution in both directions, any service or client automatically decompressing untrusted Brotli payloads is at critical risk until patched.
vulnerability · aikido.dev
Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)
Node.js shipped a security update on Wednesday for a flaw in how it decompresses Brotli data, a bug people are already calling Node2Shell (CVE-2026-111497). If an attacker can get a malicious payload in front of your app, the flaw can crash the process, leak part of its memory, or potentially let them run their own code.
Back