CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- maharaMahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to...8.8 High
- apache ws-xmlrpcApache XML-RPC vulnerable to Deserialization of Untrusted Data9.8 Critical
- openmrsThe Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference...9.8 Critical
- apache software foundation james, apache james server +1 moreApache James Privilege Escalation7.8 High
- pulpproject qpidThe Qpid server on Red Hat Satellite 6 does not properly restrict message types, which allows...7.2 High
- apache openmeetingsApache OpenMeetings RCE9.8 Critical
- hackerone rubygems, canonical ubuntu linux, debian linux +6 more +8 moreRubyGems vulnerable to Deserialization of Untrusted Data9.8 Critical
- red hat jboss application server, red hat, inc. jbossas, redhat jboss enterprise application platform +2 moreIn Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was...9.8 Critical
- google androidAn elevation of privilege vulnerability in the Android framework (gatekeeperresponse). Product:...7.8 High
- branaghgroup ers data systemERS Data System 1.8.1.0 allows remote attackers to execute arbitrary code, related to "com...9.8 Critical
- zte nr8000 series, nr8000tr firmware, nr8120 firmware +4 more +6 moreAll versions prior to V12.17.20 of the ZTE Microwave NR8000 series products - NR8120, NR8120A,...9.8 Critical
- kaltura serverThe wiki_decode Developer System Helper function in the admin panel in Kaltura before 13.2.0...7.2 High
- apache struts, cisco digital media manager, hosted collaboration solution +4 more +6 moreREST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filtering8.1 High
- apache sparkApache Spark Deserialization of Untrusted Data vulnerability7.8 High
- apache brooklynDeserialization of Untrusted Data in Apache Brooklyn8.8 High
- crushftpCrushFTP 8.x before 8.2.0 has a serialization vulnerability.9.8 Critical
- fasterxml jackson-databind, debian linux, netapp oncommand balance +18 more +20 morejackson-databind is vulnerable to a deserialization flaw9.8 Critical
- synology photo stationDeserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3...9.8 Critical
- nancyfx nancy, framework up to 2.0.0 +1 moreDeserialization of Untrusted Data in NancyFX Nancy9.8 Critical
- apache wicketThe DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote...9.1 Critical
- plug project plugArbitrary Code Execution in Cookie Serialization8.1 High
- akkaAkka Java Serialization vulnerability8.1 High
- sap netweaverSAP NetWeaver 7400.12.21.30308 allows remote attackers to cause a denial of service and possibly...7.5 High
- phpIn PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be...7.5 High
- odooIn Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0,...6.5 Medium
- puppet mcollective, mcollective, puppet, puppet enterprise +1 moreVersions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safe_load,...9.0 Critical
- code42 crashplanRemote Code Execution is possible in Code42 CrashPlan 5.4.x via the org.apache.commons.ssl.rmi...9.8 Critical
- ideablade breeze.server.netIdeaBlade Breeze Breeze.Server.NET before 1.6.5 allows remote attackers to execute arbitrary code...9.8 Critical
- jython project jython, debian linux +1 moreDeserialization of Untrusted Data in Jython9.8 Critical
- redhat jboss enterprise application platformThe PooledInvokerServlet in JBoss EAP 4.x and 5.x allows remote attackers to execute arbitrary...9.8 Critical
- red5 media serverThe AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it...9.8 Critical
- vmware vsphere data protection (vdp), vsphere data protection +1 moreVMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization...9.8 Critical
- soffid iamUntrusted Java serialization in Soffid IAM console before 1.7.5 allows remote attackers to...9.8 Critical
- puppet, puppet server, debian linux +2 moreVersions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the...8.2 High
- red hat, inc. jboss, redhat jboss enterprise application platform +1 moreHTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which...9.8 Critical
- debian lintianDeserialization vulnerability in lintian through 2.5.50.3 allows attackers to trigger code...7.8 High
- gnu glibc** DISPUTED ** The xdr_bytes and xdr_string functions in the GNU C Library (aka glibc or libc6) 2...7.5 High
- adobe coldfusionAdobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10...9.8 Critical
- dolby audio x2, audio x3 +1 moreThe Dolby DAX2 and DAX3 API services are vulnerable to a privilege escalation vulnerability that...7.8 High
- apache log4j, netapp oncommand api services, oncommand insight +76 more +78 moreDeserialization of Untrusted Data in Log4j9.8 Critical
- apache tomeeThe EjbObjectInputStream class in Apache TomEE before 1.7.4 and 7.x before 7.0.0-M3 allows remote...9.8 Critical
- atlassian jiraThe JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML...9.8 Critical
- sap netweaver application server javaThe SAP EP-RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to...6.5 Medium
- apache tika, nutch +1 moreApache Tika allows Java code execution for serialized objects embedded in MATLAB files9.8 Critical
- apache camelApache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks9.8 Critical
- phpmemcachedadmin project phpmemcachedadminPHPMemcachedAdmin 1.2.2 and earlier allows remote attackers to execute arbitrary PHP code via...9.8 Critical
- qos logback, redhat satellite, satellite capsule +2 moreQOS.ch Logback vulnerable to Deserialization of Untrusted Data9.8 Critical
- apache camelApache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization9.8 Critical
- revive-adserver revive adserverRevive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized...9.8 Critical
- ibm websphere mq, websphere mq jms +1 moreIBM Websphere MQ JMS 7.0.1, 7.1, 7.5, 8.0, and 9.0 client provides classes that deserialize...9.8 Critical
- Show moreLoading…