Vulnerabilities
Insecure Deserialization
Also known as: Unsafe deserialization, Object deserialization vulnerability
Definition
A vulnerability where an application deserialises untrusted data, letting attackers instantiate arbitrary objects and frequently achieve remote code execution.
Examples
- A Java app deserialising a session cookie with Commons Collections on the classpath, leading to RCE.
- A Python service running pickle.loads on user-controlled bytes.
Related terms
Prototype Pollution
A JavaScript vulnerability where untrusted input modifies Object.prototype, injecting properties into every object and changing application behaviour or leading to RCE.
Mass Assignment
A vulnerability where an application blindly binds client-supplied request fields to internal object properties, letting attackers set fields they should not control.
Remote Access Trojan (RAT)
Malware that gives an attacker covert, interactive control of an infected device, similar to a hidden remote-administration tool.
Command Injection
Command Injection — definition coming soon.
Broken Access Control
A class of vulnerabilities where authorization rules are missing or incorrectly enforced, letting users perform actions or reach data outside their privileges.
OWASP Top 10
OWASP Top 10 — definition coming soon.