CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- redis wrapper project wrapperUncontrolled deserialization of a pickled object in rediswrapper allows attackers to execute arbitrary scripts9.8 Critical
- liferay portalLiferay Portal Allows RCE via Deserialization of a JSON Payload9.8 Critical
- cisco security managerCisco Security Manager Java Deserialization Vulnerability6.5 Medium
- linuxmint mintinstallmintinstall (aka Software Manager) 7.9.9 for Linux Mint allows code execution if a REVIEWS_CACHE...7.8 High
- fasterxml jackson-databind, debian linux, fedoraproject fedora +23 more +25 morejackson-databind polymorphic typing issue9.8 Critical
- fasterxml jackson-databind, debian linux, fedoraproject fedora +25 more +27 morePolymorphic Typing in FasterXML jackson-databind9.8 Critical
- redhat codehaus, jboss enterprise application platform +1 moreDeserialization of Untrusted Data in org.codehaus.jackson:jackson-mapper-asl8.1 High
- google androidIn JobStore, there is a mismatched serialization/deserialization for the "battery-not-low" job...5.5 Medium
- google androidIn Bluetooth, there is a possible deserialization error due to missing string validation. This...9.8 Critical
- bmc myit digital workplaceA vulnerability was discovered in BMC MyIT Digital Workplace DWP before 18.11. The DWP component...9.8 Critical
- inoideas inoerpdownload.php in inoERP 4.15 allows SQL injection through insecure deserialization.9.8 Critical
- micro focus service managerInsecure deserialization of untrusted data in Micro Focus Service Manager product versions 9.30,...8.8 High
- apache tapestryDeserialization of Untrusted Data in Apache Tapestry9.8 Critical
- fasterxml jackson-databind, debian linux, fedoraproject fedora +14 more +16 morePolymorphic Typing issue in FasterXML jackson-databind9.8 Critical
- fasterxml jackson-databind, debian linux, fedoraproject fedora +16 more +18 morePolymorphic Typing issue in FasterXML jackson-databind9.8 Critical
- pimcorePimcore RCE via PHAR upload8.8 High
- apache ofbizThe java.io.ObjectInputStream is known to cause Java serialisation issues. This issue here is...9.8 Critical
- gravitatedesign gravitate qa trackerThe gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection.9.8 Critical
- sitebuilder dynamic components project dynamic componentsThe sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via...7.5 High
- alfrescoAn issue was discovered in Alfresco Community Edition 5.2 201707. By leveraging multiple...7.2 High
- epignosishq efront lmsA code execution vulnerability exists in Epignosis eFront LMS v5.2.12. A specially crafted web...8.8 High
- eventum project eventumController/ListController.php in Eventum 3.5.0 is vulnerable to Deserialization of Untrusted Data...9.8 Critical
- gosa project gosa, debian linux +1 moreThe GOsa_Filter_Settings cookie in GONICUS GOsa 2.7.5.2 is vulnerable to PHP objection injection,...6.5 Medium
- strategy11 formidable form builderThe formidable plugin before 4.02.01 for WordPress has unsafe deserialization.9.8 Critical
- fork-cms fork cms, spoon-library spoon library +1 moreSpoon Library as used in Fork CMS allows PHP object injection9.8 Critical
- tribulant newslettersThe newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection.9.8 Critical
- mirasys vmsMirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Mirasys.Common.Utils.Security...9.8 Critical
- patreon wordpressThe patreon-connect plugin before 1.2.2 for WordPress has Object Injection.9.8 Critical
- optiontree project optiontreeThe option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes...9.8 Critical
- optiontree project optiontreeThe option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is...9.8 Critical
- optiontree project optiontreeThe option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce.9.8 Critical
- apache commons beanutils, nifi, debian linux +57 more +59 moreInsecure Deserialization in Apache Commons Beanutils7.3 High
- sap commerce cloud, sap se commerce cloud (virtualjdbc extension) +1 moreDue to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6...9.8 Critical
- fasterxml jackson-databind, apache drill, debian linux +15 more +17 moreDeserialization of untrusted data in FasterXML jackson-databind7.5 High
- apache stormDeserialization of Untrusted Data in Apache Storm9.8 Critical
- x-stream xstream, oracle banking platform, business activity monitoring +7 more +9 moreDeserialization of Untrusted Data and Code Injection in xstream7.3 High
- slangerSlanger Arbitrary command execution9.8 Critical
- osbs-client project osbs-clientA flaw was found in the yaml.load() function in the osbs-client versions since 0.46 before 0.56.1...7.2 High
- typo3TYPO3 Vulnerable to Insecure Deserialization8.8 High
- akamai cloudtestAkamai CloudTest before 58.30 allows remote code execution.9.8 Critical
- fasterxml jackson-databind, debian linux, redhat enterprise linux +2 moreDeserialization of Untrusted Data in FasterXML jackson-databind5.9 Medium
- ethereum ethereumjDeserialization of Untrusted Data in EthereumJ9.8 Critical
- fasterxml jackson-databind, debian linux +1 moreDeserialization of untrusted data in FasterXML jackson-databind5.9 Medium
- misp-project mispapp/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator...7.2 High
- shopwareShopware Insecure Deserialization Vulnerability6.5 Medium
- adobe coldfusionColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a...9.8 Critical
- sap netweaver process integration, sap se netweaver process integration(sap xiesr and sap xitool) +1 moreJava Server Pages (JSPs) provided by the SAP NetWeaver Process Integration (SAP_XIESR and...4.3 Medium
- parso project parsoDeserialization vulnerability exists in parso7.5 High
- sitecore experience platformSitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via...8.8 High
- hewlett packard enterprise hpe intelligent management center (imc) plat, hp intelligent management center +1 moreA remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC)...8.8 High
- Show moreLoading…