CVE-2022-35411

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header is sent. In other words, although JSON (not Pickle) is the default data format, an unauthenticated client can cause the data to be processed with unpickle.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published: Jul 8, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-354125.1Digital Guardian Agent 7.7.4.0042 allows an administrator (who ordinarily does not have a supported way to uninstall the product) to disable CVE-2022-354139.8WAPPLES through 6.0 has a hardcoded systemi account. A threat actor could use this account to access the system configuration and confidenti CVE-2022-354148.8softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex cr CVE-2022-354157.8An improper input validation in NI System Configuration Manager before 22.5 may allow a privileged user to potentially enable escalation of CVE-2022-354166.1H3C SSL VPN through 2022-07-10 allows wnm/login/login.json svpnlang cookie XSS.CVE-2022-354217.2Online Tours And Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the pname parameter at /admin/op CVE-2022-354229.8Web Based Quiz System v1.0 was discovered to contain a SQL injection vulnerability via the qid parameter at update.php.CVE-2022-354269.8UCMS 1.6 is vulnerable to arbitrary file upload via ucms/sadmin/file PHP file.CVE-2022-35435.5A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function unix_sock_destructor/u CVE-2022-354336.5ffjpeg commit caade60a69633d74100bd3c2528bddee0b6a1291 was discovered to contain a memory leak via /src/jfif.c.CVE-2022-354345.5jpeg-quantsmooth before commit 8879454 contained a floating point exception (FPE) via /jpeg-quantsmooth/jpegqs+0x4f5d6c.CVE-2022-35445.5A vulnerability, which was classified as problematic, was found in Linux Kernel. Affected is the function damon_sysfs_add_target of the file