CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- swooleThe unpack implementation in Swoole version 4.0.4 lacks correct size checks in the...7.5 High
- cryo project cryoCode Injection in cryo9.8 Critical
- microsoft windows 10, windows 10 servers, windows 7 +7 more +9 moreA remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to...8.8 High
- eclipse openj9, the eclipse foundation eclipse openj9, oracle enterprise manager base platform +2 moreIn Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach...7.8 High
- jetbrains dotpeek, resharper ultimate +1 moreJetBrains dotPeek before 2018.2 and ReSharper Ultimate before 2018.1.4 allow attackers to execute...7.8 High
- laravel, laravel framework +1 moreLaravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior8.1 High
- hp business service management, hewlett packard enterprise hp business service manager +1 moreA remote code execution vulnerability was identified in HP Business Service Management (BSM)...8.8 High
- hp network node manager i, hewlett packard enterprise hp network node manager (nnmi) +1 moreA remote arbitrary code execution vulnerability was identified in HP Network Node Manager i (NNMi...8.8 High
- [unknown] fuse, redhat jboss fuse, jboss a-mq +2 moreIt was found that the JMX endpoint of Red Hat JBoss Fuse 6, and Red Hat A-MQ 6 deserializes the...5.3 Medium
- apache karaf, redhat jboss a-mq, jboss fuse +2 moreIt was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x,...7.2 High
- google chrome, debian linux, redhat enterprise linux desktop +2 more +4 moreImproper deserialization in WebGL in Google Chrome on Mac prior to 68.0.3440.75 allowed a remote...8.8 High
- zte zxiptv-epg, zxiptv-epg firmware +1 moreAll versions prior to V5.09.02.02T4 of the ZTE ZXIPTV-EPG product use the Java RMI service in...9.8 Critical
- apache igniteCode execution via deserialization in org.apache.ignite:ignite-core9.8 Critical
- manageengine applications manager, zohocorp manageengine applications manager +1 moreManageEngine Applications Manager 12 and 13, allows unserialization of unsafe Java objects9.8 Critical
- jqueryform php formmail generator, php formmail generator +1 morePHP FormMail Generator generates PHP code for standard web forms, and the code generated is vulnerable to unsafe deserialization of untrusted data9.8 Critical
- yamldotnet project yamldotnetHigh severity vulnerability that affects YamlDotNet and YamlDotNet.Signed7.8 High
- bouncycastle bc-java, netapp oncommand workflow automation, opensuse leap +21 more +23 moreDeserialization of Untrusted Data in Bouncy castle9.8 Critical
- pyyaml, fedoraproject fedora +1 morePyYAML insecurely deserializes YAML strings leading to arbitrary code execution9.8 Critical
- froxlorFroxlor PHP Object Injection vulnerability7.2 High
- openpsa2 openpsaopenpsa contains a PHP Object Injection vulnerability in Form data passed as GET request...9.8 Critical
- redirectionRedirection version 2.7.1 contains a Serialisation vulnerability possibly allowing ACE...7.2 High
- micro focus cms server, universal cmdb server, microfocus universal cmbd server +2 moreMFSBGN03810 rev.1 - Universal CMDB, Deserialization Java Objects and CSRF7.5 High
- micro focus ucmdb browser, microfocus universal cmbd browser +1 moreMFSBGN03809 rev.1 - Universal CMDB, Deserialization Java Objects and CSRF7.5 High
- midnight coders weborb for javaWebORB for Java by Midnight Coders, version 5.1.1.0, Action Message Format (AMF3) Java implementation is vulnerable to insecure deserialization9.8 Critical
- pivotal spring-flexPivotal/Spring Spring-flex's Action Message Format (AMF3) Java implementation is vulnerable to insecure deserialization8.1 High
- exadel flamingo, flamingo amf-serializer +1 moreThe implementation of Action Message Format (AMF3) deserializers in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes due to improper code control9.8 Critical
- exadel flamingo amf-serializerFlamingo amf-serializer by Exadel, version 2.2.0, Action Message Format (AMF3) Java implementation is vulnerable to insecure deserialization8.1 High
- graniteds, flarum framework +1 moreThe implementation of Action Message Format (AMF3) deserializers in GraniteDS, version 3.1.1.GA, may allow instantiation of arbitrary classes due to improper code control8.1 High
- graniteds, flarum framework +1 moreGraniteDS, version 3.1.1.GA, Action Message Format (AMF3) Java implementation is vulnerable to insecure deserialization8.1 High
- citrix xenmobile serverThere is a Hazelcast Library Java Deserialization Vulnerability in Citrix XenMobile Server 10.8...8.1 High
- apache nifiApache NiFi JMS Deserialization issue7.5 High
- apache batik, canonical ubuntu linux, debian linux +18 more +20 moreDeserialization of Untrusted Data in Apache Batik9.8 Critical
- adobe coldfusionAdobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have...9.8 Critical
- [unknown] jenkinsDeserialization of Untrusted Data in Jenkins8.8 High
- infinispan, redhat jboss data grid +1 moreDeserialization of Untrusted Data in Infinispan8.8 High
- microsoft windows, windows 10, windows 7 +12 more +14 moreA remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to...8.8 High
- milestonesys xprotect, siemens siveillance vms +1 moreThe Milestone XProtect Video Management Software (Corporate, Expert, Professional+, Express+,...8.1 High
- google guava, oracle banking payments, communications ip service activator +14 more +16 moreDenial of Service in Google Guava5.9 Medium
- oracle weblogic serverVulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent:...9.8 Critical
- oisf suricata-updateOISF suricata-update unsafely deserializes YAML data7.8 High
- cmsmadesimple cms made simpleCMS Made Simple (CMSMS) through 2.2.6 allows PHP object injection because of an unserialize call...9.8 Critical
- cyberark password vaultThe REST API in CyberArk Password Vault Web Access before 9.9.5 and 10.x before 10.1 allows...9.8 Critical
- google androidIn writeToParcel and readFromParcel of OutputConfiguration.java, there is a permission bypass due...7.8 High
- apache igniteApache serialization mechanism does not have a list of classes allowed for serialization/deserialization9.8 Critical
- myscriptThe MyScript SDK before 1.3 for Android might allow attackers to execute arbitrary code by...9.8 Critical
- ibm db2, db2 for linux, unix and windows +1 moreIBM Data Server Driver for JDBC and SQLJ (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5,...7.4 High
- osisoft pi data archiveA Deserialization of Untrusted Data issue was discovered in OSIsoft PI Data Archive versions 2017...7.5 High
- rubygemsRubyGems Deserialization of Untrusted Data vulnerability7.8 High
- red hat, inc. eap-5, redhat jboss enterprise application platform +1 moreRed Hat JBoss EAP version 5 is vulnerable to a deserialization of untrusted data in the JMX...5.3 Medium
- calibre-ebook calibregui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data,...7.8 High
- Show moreLoading…