early signals Full Disclosure infra

Continued Apache Struts2 JSON Plugin Insecure Deserialisation

// AI summary

Apache Struts2 JSON Plugin has a continued insecure deserialisation flaw related to JSON deserialisers, demonstrated by a proof of concept script.

// from the source

Posted by Daniel Owens via Fulldisclosure on Oct 28 Summary Thus far we have written extensively about the rampant number of insecure JavaScript Object Notation (JSON) deserialisers available today, like in Struts2 and Related Framework Array/Collection DoS (26 October 2025) and JSON Deserialiser Unconstrained Resource Consumption Quick Overview (07 March 2026), along with a naïve proof of concept script that demonstrated what we were talking about -- JSON...
Read at seclists.org ↗ More from Full Disclosure

# more from Full Disclosure

  1. Full Disclosure infra

    [0day-rubbish] NETGEAR RAX120 V1.2.5.18 authenticated SOAP InstallApp OS command injection to root-configured web-stack execution (6.8 Medium; conditionally 7.2 High with management exposure)

    seclists.org
  2. Full Disclosure infra

    [0day-rubbish] Raritan PX3 PDU G4 firmware 4.3.14 command injection in the ping and traceroute diagnostics through an inverted hostname-validation return check (8.8)

    seclists.org
  3. Full Disclosure infra

    [0day-rubbish] NUUO Crystal Server 3.19.0.85 unauthenticated upload.php PHP web-root write with fastcgi execution into server-side code execution as the web service account (9.8 Critical)

    seclists.org
  4. Full Disclosure infra

    [0day-rubbish] Moxa MAR-2000 firmware FWR_MAR2000_V1.0_Build_15010909 scenario ping condition command injection through the auto-executing ping thread (7.2)

    seclists.org
  5. Full Disclosure infra

    [0day-rubbish] Moxa MAR-2000 firmware FWR_MAR2000_V1.0_Build_15010909 IPsec tunnel address command injection through the route-management shell commands (7.2)

    seclists.org