CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- fasterxml jackson-databind, debian linux, oracle business process management suite +9 more +11 morecom.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data9.8 Critical
- fasterxml jackson-databind, debian linux, oracle business process management suite +9 more +11 moreDeserialization of Untrusted Data in jackson-databind9.8 Critical
- fasterxml jackson-databind, debian linux, oracle business process management suite +9 more +11 moreDeserialization of Untrusted Data in jackson-databind due to polymorphic deserialization9.8 Critical
- fasterxml jackson-databind, debian linux, oracle banking platform +9 more +11 moreXML External Entity Reference (XXE) in jackson-databind9.8 Critical
- fasterxml jackson-databind, debian linux, netapp oncommand workflow automation +17 more +19 moreArbitrary Code Execution in jackson-databind9.8 Critical
- fasterxml jackson-databind, debian linux, netapp oncommand workflow automation +22 more +24 moreArbitrary Code Execution in jackson-databind9.8 Critical
- facebook buckBuck parser-cache command loads/saves state using Java serialized object. If the state...9.8 Critical
- canonical ubuntu linux, debian linux, php pear archive tar +2 moreArchive_Tar contains Potential RCE if filename starts with phar://8.8 High
- zoneminderZoneMinder version <= 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter...9.8 Critical
- zoneminderZoneMinder version <= 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter...9.8 Critical
- ubillingUbilling version <= 0.9.2 contains a Other/Unknown vulnerability in user-controlled parameter...9.8 Critical
- megamekMegaMek version < v0.45.1 contains a Other/Unknown vulnerability in Object Stream Connection that...9.8 Critical
- wordpress, debian linux +1 moreIn WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection...9.8 Critical
- ibm websphere application serverIBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute...8.1 High
- jenkins, jenkins stapler web framework, redhat openshift container platform +2 moreDeserialization of Untrusted Data in Jenkins9.8 Critical
- rails https://github.com/rails/rails, redhat cloudforms, rubyonrails rails +2 moreImproper Access Control in activejob7.5 High
- invt vt-designerVT-Designer Version 2.1.7.31 is vulnerable by the program populating objects with user supplied...8.8 High
- vanillaforums vanillaVanilla before 2.5.5 and 2.6.x before 2.6.2 allows Remote Code Execution because authenticated...7.2 High
- phpext/standard/var_unserializer.c in PHP 5.x through 7.1.24 allows attackers to cause a denial of...7.5 High
- phpbb, debian linux +1 morephpBB Remote Code Execution7.2 High
- phpmailer project phpmailer, debian linux, fedoraproject fedora +1 more +3 morePhar object injection in PHPMailer8.8 High
- cisco unity expressCisco Unity Express Arbitrary Command Execution Vulnerability9.8 Critical
- apache supersetDeserialization of Untrusted Data in superset9.8 Critical
- ibm websphere application serverIBM WebSphere Application Server Liberty OpenID Connect could allow a remote attacker to execute...7.3 High
- systemd, canonical ubuntu linux, debian linux +1 more +3 moresystemd: reexec state injection: fgets() on overlong lines leads to line splitting7.0 High
- citrix xenmobile server** DISPUTED *** Xen Mobile through 10.8.0 includes a service listening on port 5001 within its...7.8 High
- pippoDeserialization of Untrusted Data in Pippo9.8 Critical
- micro focus microfocus real user monitoring, microfocus real user monitoring +1 moreMFSBGN03827 rev.1 - Microfocus Real User Monitoring 9.4.0 BPRDownload Java Deserialization Vulnerability6.3 Medium
- avaya aura system platform, aura® system platform +1 moreSystem Platform Web UI Deserialization9.0 Critical
- oracle weblogic serverVulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent:...9.8 Critical
- pippoPippo RCE Vulnerability9.8 Critical
- cisco identity services engine, identity services engine software +1 moreMultiple Vulnerabilities in Cisco Identity Services Engine4.7 Medium
- zohocorp manageengine applications managerA serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows...8.1 High
- getmonero monero, https://github.com/sabelnikov epee +1 moreAn exploitable code execution vulnerability exists in the Levin deserialization functionality of...10.0 Critical
- adobe coldfusionAdobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14...9.8 Critical
- adobe coldfusionAdobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14...9.8 Critical
- adobe coldfusionAdobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14...9.8 Critical
- adobe coldfusionAdobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14...9.8 Critical
- processmaker, processmaker enterprise +1 moreA code execution vulnerability exists in ProcessMaker Enterprise Core 3.0.1.7-community. A...8.8 High
- tecnick tcpdf, limesurvey +1 moreTCPDF vulnerable to attackers triggering deserialization of arbitrary data9.8 Critical
- infinispanInfinispan: Deserialization of untrusted data in the Hot Rod Java client via automatic byte-array deserialization4.2 Medium
- ibm websphere application serverIBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute...9.8 Critical
- gluster glusterfs, debian linux, opensuse leap +5 more +7 moreA flaw was found in the way dic_unserialize function of glusterfs does not handle negative key...6.5 Medium
- dockerHandleRequestAsync in Docker for Windows before 18.06.0-ce-rc3-win68 (edge) and before 18.06.0-ce...8.8 High
- trend micro security (consumer), trend micro, inc. micro security (consumer), trendmicro antivirus \+ security +3 more +5 moreA Deserialization of Untrusted Data Privilege Escalation vulnerability in Trend Micro Security...7.8 High
- broadcom release automationInsecure deserialization of a specially crafted serialized object, in CA Release Automation 6.5...9.8 Critical
- pyconuk conference-scheduler-cliconference-scheduler-cli Arbitrary Code Execution7.8 High
- hazzardweb easylogin proAn issue was discovered in EasyLogin Pro through 1.3.0. Encryptor.php contains an unserialize...8.1 High
- jenkinsDeserialization of Untrusted Data in Jenkins5.3 Medium
- yeswikiYesWiki version <= cercopitheque beta 1 contains a PHP Object Injection vulnerability in...9.8 Critical
- Show moreLoading…