CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- hewlett packard enterprise hpe intelligent management center (imc) plat, hp intelligent management center +1 moreA remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC)...8.8 High
- hewlett packard enterprise hpe intelligent management center (imc) plat, hp intelligent management center +1 moreA remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC)...9.8 Critical
- hewlett packard enterprise hpe intelligent management center (imc) plat, hp intelligent management center +1 moreA remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC)...9.8 Critical
- hewlett packard enterprise hpe intelligent management center (imc) plat, hp intelligent management center +1 moreA remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC)...8.8 High
- godotengine godotIn Godot through 3.1, remote code execution is possible due to the deserialization policy not...9.8 Critical
- sitecore cms, cms and experience platform (xp) +1 moreDeserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an...8.8 High
- sitecore cms, cms and experience platform (xp), experience platform +2 moreDeserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in...9.8 Critical
- synacor zimbra collaboration suiteSynacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in...9.8 Critical
- adobe coldfusionColdFusion versions Update 1 and earlier, Update 7 and earlier, and Update 15 and earlier have a...9.8 Critical
- ampacheAmpache 3.8.3 allows PHP Object Instantiation via democratic.ajax.php and democratic.class.php.8.8 High
- e107e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php...8.8 High
- hazelcastDeserialization of Untrusted Data in Hazelcast8.1 High
- carts.guru carts guruThe Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source...9.8 Critical
- virim project virimThe Virim plugin 0.4 for WordPress allows Insecure Deserialization via s_values, t_values, or...9.8 Critical
- fasterxml jackson-databind, debian linux +1 moreInformation exposure in FasterXML jackson-databind7.5 High
- ibm websphere application serverIBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary...9.0 Critical
- siemens logo! soft comfort, logo\! soft comfort +1 moreA vulnerability has been identified in LOGO! Soft Comfort (All versions). The vulnerability could...7.8 High
- sensiolabs symfonyDeserialization of untrusted data in Symfony7.1 High
- typo3 pharstreamwrapperPharStreamWrapper for Typo3 unsafe deserialization vulnerability9.8 Critical
- cakephpUnsafe deserialization in SmtpTransport in CakePHP7.5 High
- typo3 pharstreamwrapper, debian linux, drupal +2 more +4 moreDirectory Traversal in typo3/phar-stream-wrapper9.8 Critical
- revive adserver, revive-sas revive adserver +1 moreAn attacker could send a specifically crafted payload to the XML-RPC invocation script and...9.8 Critical
- smartertools smartermailSmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An...9.8 Critical
- cmsmadesimple cms made simpleAn issue was discovered in CMS Made Simple 2.2.8. In the module FrontEndUsers (in the file class...8.8 High
- autodesk advance steel, autocad, autocad architecture +9 more +11 moreAn attacker may convince a victim to open a malicious action micro (.actm) file that has...7.8 High
- pimcorePimcore Unserialize Remote Code Execution8.8 High
- coapthon project coapthonCoAPthon DoS due to Exceptions7.5 High
- coapthon3 project coapthon3CoAPthon3 vulnerable to Deserialization of Untrusted Data7.5 High
- githubThe Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that...9.8 Critical
- kentico xperienceAn issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10...9.8 Critical
- cmsmadesimple cms made simpleAn issue was discovered in CMS Made Simple 2.2.8. In the module ModuleManager (in the file action...8.8 High
- cmsmadesimple cms made simpleAn issue was discovered in CMS Made Simple 2.2.8. In the module FilePicker, it is possible to...8.8 High
- cmsmadesimple cms made simpleAn issue was discovered in CMS Made Simple 2.2.8. In the module DesignManager (in the files...8.8 High
- ipycache project ipycacheipycache is vulnerable to Code Injection8.8 High
- openmrsOpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows...10.0 Critical
- deltek ajeraSecure/SAService.rem in Deltek Ajera Timesheets 9.10.16 and prior are vulnerable to remote code...8.8 High
- apache solr, netapp storage automation store +1 moreCritical severity vulnerability that affects org.apache.solr:solr-core9.8 Critical
- apache jmeterUnauthenticated Remote Code Execution in Apache JMeter9.8 Critical
- fasterxml jackson-databind, debian linux, fedoraproject fedora +8 more +10 moreDeserialization of Untrusted Data7.5 High
- fasterxml jackson-databind, debian linux, fedoraproject fedora +8 more +10 morejackson-databind Deserialization of Untrusted Data vulnerability7.5 High
- fasterxml jackson-databind, oracle clusterware, communications instant messaging server +4 more +6 moreDeserialization of Untrusted Data in jackson-databind9.8 Critical
- antfin sofa-hessianIncomplete List of Disallowed Inputs in SOFA-Hessian9.8 Critical
- drupal core, drupal +1 moreDrupal core - Highly critical - Remote Code Execution8.1 High
- joomla joomla\!Joomla! Object Injection Vulnerability9.8 Critical
- mpdf project mpdfmPDF Unsafe Deserialization8.8 High
- chatopera cosinThere is a deserialization vulnerability in Chatopera cosin v3.10.0. An attacker can execute...9.8 Critical
- sas web infrastructure platformSAS Web Infrastructure Platform before 9.4M6 allows remote attackers to execute arbitrary code...9.8 Critical
- drupal, drupal core, debian linux +2 morethird-party PEAR Archive_Tar library updates8.0 High
- numpy, fedoraproject fedora +1 moreNumpy Deserialization of Untrusted Data9.8 Critical
- pydioIn Pydio before 8.2.2, an attack is possible via PHP Object Injection because a user is allowed...9.8 Critical
- Show moreLoading…