PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2019-18935] Các lỗ hổng bảo mật được khai thác nhiều trong 6 tháng đầu năm 2023 - Phần 2

blog.viettelcybersecurity.com | vulnerability | CVE-2019-18935 | #rce | #deserialization | #exploitation | #vulnerability | #telerik | #cve-2019-18935
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Part II examines CVE-2019-18935, insecure JSON deserialization in Telerik UI's RadAsyncUpload that yields RCE, chained with CVE-2017-11317 file upload to plant malicious DLLs.
CVE
CVE-2019-18935
Published
Collected

Related coverage

vulnerability · bishopfox.com
CVE-2019-18935: Remote Code Execution via Insecure Deserialization in Telerik UI
Caleb Gross details CVE-2019-18935: insecure JSON deserialization in Telerik UI for ASP.NET AJAX yields remote code execution; includes the CVE-2017-11317 upload chain and patching.
vulnerability · wiz.io
[CVE-2026-111497] Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
vulnerability · bugpwn.com
open62541: Integer Overflow → Heap Overflow → RCE.
Original research: how a 16 bit size field overflow in open62541's custom DataType machinery lets a malicious OPC UA server corrupt a connecting client's heap, up to remote code execution. CVE-2026-116014, CVSS 9.2. Root cause, networked PoC, and the official fix. By BUG|PWN.
research · lab.ctbb.show
Write Path Traversal to a RCE Art Department
# Write Path Traversal to a RCE Art Department ~/authors/fsi - profile fsi * * * Diyan Apostolov Nov 28, 2025 CriticalThinking Research members are treated as artists thus here is my small and...
vulnerability · blog.viettelcybersecurity.com
CVE-2026-33112: SharePoint XmlValidator Bypass Enables Low-Privilege RCE
CVE-2026-33112: a network-imported XSD schema bypasses SharePoint's XmlValidator, and the PerformancePoint PPSAuthoringService revives ExcelDataSet deserialization for low-privilege RCE.
Back