CVE-2020-27583

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

IBM InfoSphere Information Server 8.5.0.0 is affected by deserialization of untrusted data which could allow remote unauthenticated attackers to execute arbitrary code. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://n4nj0.github.io/advisories/ibm-infosphere-java-deserialization/Exploit, Third Party Advisory
https://n4nj0.github.io/advisories/ibm-infosphere-java-deserialization/Exploit, Third Party Advisory

Timeline

Published: Jan 26, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-275854.4Quick Heal Total Security before 19.0 allows attackers with local admin rights to modify sensitive anti virus settings via a brute-attack on CVE-2020-275865.9Quick Heal Total Security before version 19.0 transmits quarantine and sysinfo files via clear text.CVE-2020-275876.7Quick Heal Total Security before 19.0 allows attackers with local admin rights to obtain access to files in the File Vault via a brute-force CVE-2020-275897.5Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases.CVE-2020-27594.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.19 CVE-2020-27605.5Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.29 and prior and CVE-2020-276009.8HNAP1/control/SetMasterWLanSettings.php in D-Link D-Link Router DIR-846 DIR-846 A1_100.26 allows remote attackers to execute arbitrary comma CVE-2020-276013.5In BigBlueButton before 2.2.7, lockSettingsProps.disablePrivateChat does not apply to already opened chats. This occurs in bigbluebutton-htm CVE-2020-276029.8BigBlueButton before 2.2.7 does not have a protection mechanism for separator injection in meetingId, userId, and authToken.CVE-2020-276037.5BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access external files.CVE-2020-276046.5BigBlueButton before 2.3 does not implement LibreOffice sandboxing. This might make it easier for remote authenticated users to read the API CVE-2020-276059.8BigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents, and consequently may be subject to attacks related t