CVE-2021-36483

概要

参考情報

• gist.github.com/tree-chtsec/27013ed6cb297b24e44f6359439b678e · Third Party Advisory
• supportcenter.devexpress.com/ticket/details/t1031535/reporting-unsafe-data-type-deserialization · Permissions Required
• supportcenter.devexpress.com/ticket/details/t708194/net-web-controls-unsafe-data-type-deserialization · Permissions Required
• supportcenter.devexpress.com/ticket/details/t714296/net-desktop-controls-unsafe-data-type-deserialization · Permissions Required
• chtsecurity.com/news/a01d1bc6-19c8-4187-b343-6bc685efe64f · Third Party Advisory
• zerodayinitiative.com/advisories/ZDI-22-341 · Third Party Advisory

devexpress のその他の脆弱性

• CVE-2023-35817緊急 9.8DevExpress before 23.1.3 allows AsyncDownloader SSRF.
• CVE-2023-35816中 5.3DevExpress before 23.1.3 allows arbitrary TypeConverter conversion.
• CVE-2023-35815緊急 9.8DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data.
• CVE-2023-35814緊急 9.8DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.
• CVE-2022-28684高 8.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to …