CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- cisco secure access control system (acs), secure access control system +1 moreA vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to...9.8 Critical
- apache geodeApache Geode unsafe deserialization of application objects7.5 High
- apache geodeApache Geode unsafe deserialization in TcpServer9.8 Critical
- fasterxml jackson-databind, debian linux, oracle communications billing and revenue management +2 more +4 moreFasterXML jackson-databind allows unauthenticated remote code execution9.8 Critical
- hewlett packard enterprise intelligent management center (imc) plat, hp intelligent management center +1 moreA Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent...8.8 High
- hewlett packard enterprise intelligent management center (imc) plat, hp intelligent management center +1 moreA Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent...8.8 High
- hewlett packard enterprise intelligent management center (imc) plat, hp intelligent management center +1 moreA Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent...8.8 High
- hewlett packard enterprise intelligent management center (imc) plat, hp intelligent management center +1 moreA Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent...8.8 High
- hewlett packard enterprise intelligent management center (imc) plat, hp intelligent management center +1 moreA Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent...8.8 High
- hewlett packard enterprise intelligent management center (imc) plat, hp intelligent management center +1 moreA Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent...8.8 High
- hewlett packard enterprise intelligent management center (imc) plat, hp intelligent management center +1 moreA Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3...9.8 Critical
- hewlett packard enterprise intelligent management center (imc) plat, hp intelligent management center +1 moreA remote deserialization of untrusted data vulnerability in HPE Intelligent Management Center ...9.8 Critical
- hewlett packard enterprise intelligent management center (imc) plat, hp intelligent management center +1 moreA Remote Code Execution vulnerability in HPE intelligent Management Center (iMC) PLAT version IMC...9.8 Critical
- hewlett packard enterprise intelligent management center (imc) plat, hp intelligent management center +1 moreA Remote Code Execution vulnerability in HPE intelligent Management Center (iMC) PLAT version IMC...9.8 Critical
- hewlett packard enterprise intelligent management center (imc) plat, hp intelligent management center +1 moreA Remote Code Execution vulnerability in HPE intelligent Management Center (iMC) PLAT version IMC...9.8 Critical
- hewlett packard enterprise operations orchestrationA remote code execution vulnerability in HPE Operations Orchestration Community edition and...9.8 Critical
- hewlett packard enterprise network automationA Remote Code Execution vulnerability in HPE Network Automation using RPCServlet and Java...9.8 Critical
- infinispanDeserialization of Untrusted Data in Infinispan8.8 High
- validformbuilder validform builderValidFormBuilder version 4.5.4 contains a PHP Object Injection vulnerability in Valid Form...9.8 Critical
- jenkins pipeline supporting apisArbitrary code execution due to incomplete sandbox protection in Pipeline: Supporting APIs Plugin8.8 High
- nasa rtretrievalframeworkNASA RtRetrievalFramework version v1.0 contains a CWE-502 vulnerability in Data retrieval...8.8 High
- nasa kodiakNASA Kodiak version v1.0 contains a CWE-502 vulnerability in Kodiak library's data processing...8.8 High
- nasa pyblockNASA Pyblock version v1.0 - v1.3 contains a CWE-502 vulnerability in Radar data parsing library...7.8 High
- nasa singledopNASA Singledop version v1.0 contains a CWE-502 vulnerability in NASA Singledop library (Weather...7.8 High
- web2pyThe secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to...9.8 Critical
- jenkinsDeserialization of Untrusted Data in Jenkins6.5 Medium
- jenkins, oracle communications cloud native core automated test suite +1 moreDeserialization of Untrusted Data in Jenkins9.8 Critical
- vmware vrealize automation, vsphere integrated containers +1 moreVMware Realize Automation (7.3 and 7.2) and vSphere Integrated Containers (1.x before 1.3)...9.8 Critical
- apache nifiDenial of service via deserialization attack in nifi5.0 Medium
- red hat resteasyDeserialization of Untrusted Data in org.jboss.resteasy:resteasy-yaml-provider8.1 High
- netgain systems enterprise managerThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations...9.8 Critical
- fasterxml jackson-databind, debian linux, netapp e-series santricity os controller +6 more +8 moreDeserialization of Untrusted Data in jackson-databind8.1 High
- fasterxml jackson-databind, debian linux, netapp e-series santricity os controller +5 more +7 morejackson-databind vulnerable to remote code execution due to incorrect deserialization and blocklist bypass9.8 Critical
- dozer project dozerDozer improperly uses a reflection-based approach to type conversion, which might allow remote...9.8 Critical
- apache flex blazeds, apache software foundation flex blaze ds, hp xp command view advanced edition +2 moreApache Flex BlazeDS unsafe deserialization9.8 Critical
- vbulletinIn vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads...9.8 Critical
- apache synapse, oracle financial services market risk measurement and management, peoplesoft enterprise peopletools +2 moreRemote Code Execution in Apache Synapse9.8 Critical
- adobe coldfusionAdobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and...9.8 Critical
- adobe coldfusionAdobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and...9.8 Critical
- swagger swagger-codegen, swagger-parser +1 moreDeserialization of Untrusted Data in swagger-codegen8.8 High
- pivotal software spring advanced message queuing protocolDeserialization of Untrusted Data in Spring AMQP9.8 Critical
- vmware spring securityDeserialization of Untrusted Data in Spring Security8.1 High
- redis-storeredis-store deserializes untrusted data9.8 Critical
- swagger swagger-codegen, swagger-parser +1 moreDeserialization of Untrusted Data in swagger-parser8.8 High
- octobercms octoberOctober CMS build 412 is vulnerable to PHP object injection in asset move functionality resulting...7.5 High
- fasterxml jackson-databind, debian linux, netapp oncommand balance +21 more +23 morejackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution9.8 Critical
- apache camelCamel-castor component in Apache Camel is vulnerable to Java object de-serialisation9.8 Critical
- apache camelApache Camel camel-hessian component vulnerable to Java object deserialization9.8 Critical
- owlmixin project owlmixinUnsafe deserialization in owlmixin9.8 Critical
- pyanyapi project pyanyapiUnsafe pyyaml load usage in PyAnyAPI9.8 Critical
- Show moreLoading…