CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- serialize-to-js project serialize-to-jsCode Execution Through IIFE in serialize-to-js9.8 Critical
- node-serialize project node-serializeCode Execution through IIFE in node-serialize9.8 Critical
- gradleObjectSocketWrapper.java in Gradle 2.12 allows remote attackers to execute arbitrary code via a...9.8 Critical
- apache groovy, redhat enterprise linux server +1 moreDeserialization of Untrusted Data in Groovy9.8 Critical
- synacor zimbra collaboration suiteZimbra Collaboration before 8.7.0 allows remote attackers to conduct deserialization attacks via...9.1 Critical
- phpmyadminAn issue was discovered in phpMyAdmin. Due to a bug in serialized string parsing, it was possible...9.8 Critical
- redhat enterprise linux desktop, enterprise linux hpc node, enterprise linux server +1 more +3 moreSerializableProvider in RESTEasy in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux...9.8 Critical
- redhat jboss enterprise application platformThe JMX servlet in Red Hat JBoss Enterprise Application Platform (EAP) 4 and 5 allows remote...8.8 High
- apache myfaces trinidadApache MyFaces Trinidad Deserialization Vulnerability9.8 Critical
- hp network automationThe RMI service in HP Network Automation Software 9.1x, 9.2x, 10.0x before 10.00.02.01, and 10.1x...7.3 High
- redhat jboss operations networkThe server in Red Hat JBoss Operations Network (JON), when SSL authentication is not configured...9.8 Critical
- apache artemis, redhat jboss enterprise application platform +1 moreApache ActiveMQ Artemis RCE Via Deserialization Gadget Chain7.2 High
- phpext/standard/var_unserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain...9.8 Critical
- phpmyadminAn issue was discovered in phpMyAdmin. Some data is passed to the PHP unserialize() function...9.8 Critical
- adobe coldfusionAdobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 allows remote...9.8 Critical
- xmlsoft libxml2, debian linux, oracle solaris +2 moreThe xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent...7.5 High
- jenkins, redhat openshift +1 moreJenkins allows Deserialization of Untrusted Data via an XML File8.8 High
- jenkins, redhat openshift +1 moreJenkins allows Execution of Code by Opening a JRMP Listener9.8 Critical
- redhat data grid, jboss a-mq, openshift +12 more +14 moreDeserialization of Untrusted Data in Apache commons collections9.8 Critical
- ibm sterling b2b integrator, sterling integrator, tivoli common reporting +5 more +7 moreSerialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT...9.8 Critical
- apache commons collectionsInsecure Deserialization in Apache Commons Collection9.8 Critical
- jenkins, redhat openshift container platform +1 moreJenkins CLI Deserialization of Untrusted Data vulnerability9.8 Critical
- oracle weblogic server, storagetek tape analytics sw tool, virtual desktop infrastructure +2 moreThe WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0...9.8 Critical
- apache tapestryApache Tapestry Unsafe Object Storage7.8 High
- rope project ropeCode injection in rope9.8 Critical
- djangoproject tastypieDjango Tastypie Improper Deserialization of YAML Data7.5 High
- apache camelApache Camel's XSLT component allows remote attackers to execute arbitrary Java methods7.5 High
- apache tomcat, redhat jboss enterprise application platform, jboss enterprise portal platform +2 moreDeserialization of Untrusted Data in Apache Tomcat7.5 High
- typo3TYPO3 vulnerable to Insecure Unserialize via Content Editing Wizards component6.5 Medium
- restletRestlet Arbitrary Java Code Execution via a serialized object7.5 High
- apache openjpaDeserialization of Untrusted Data in Apache OpenJPA7.5 High
- rubyonrails rails, ruby on rails +1 moreActive Record contains deserialization of arbitrary YAML10.0 High
- cubecartThe Cubecart::_basket method in classes/cubecart.class.php in CubeCart 5.0.0 through 5.2.0 allows...9.8 Critical
- openstack swift, redhat storage, fedoraproject fedora +4 more +6 moreOpenStack Object Storage (swift) Code Injection vulnerability9.8 Critical
- silverstripeSilverstripe CMS Arbitrary Code Execution6.8 Medium
- typo3Typo3 Extbase Framework Unsafe Deserialization5.0 Medium
- typo3, debian linux +1 moreTYPO3 allows remote authenticated backend users to unserialize arbitrary objects4.6 Medium
- tiki tikiwiki cms\/groupwareTikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary...9.8 Critical
- vmware spring framework, spring security +1 moreSpring Framework and Spring Security vulnerable to Deserialization of Untrusted Data6.8 Medium
- redhat system-config-firewall, fedoraproject fedora +1 morefw_dbus.py in system-config-firewall 1.2.29 and earlier uses the pickle Python module unsafely...7.8 High
- google chrome, chrome os +1 moreThe Pickle::Pickle function in base/pickle.cc in Google Chrome before 8.0.552.224 and Chrome OS...7.5 High
- google chromeThe sandbox implementation in Google Chrome before 6.0.472.53 does not properly deserialize...9.3 High
- phpPHP 4 before 4.4.5, and PHP 5 before 5.2.1, when register_globals is enabled, allows context...6.8 Medium
- py2playPy2Play Unpickles Untrusted Objects7.5 High
- mozilla, sco openserver +1 moreThe Script.prototype.freeze/thaw functionality in Mozilla 1.4 and earlier allows attackers to...9.8 Critical