CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- jyaml project jyamlDeserialization of Untrusted Data in JYaml9.8 Critical
- pyyaml, fedoraproject fedora +1 moreDeserialization of Untrusted Data in PyYAML9.8 Critical
- sygnoos popup builderThe Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection (in...9.8 Critical
- salesagility suitecrmSuiteCRM through 7.11.11 allows PHAR Deserialization.7.2 High
- jenkins radargun, jenkins project radargun plugin +1 moreRCE vulnerability in RadarGun Plugin8.8 High
- jenkins google kubernetes engine, jenkins project google kubernetes engine plugin +1 moreRCE vulnerability in Google Kubernetes Engine Plugin8.8 High
- microsoft exchange server, exchange server 2010 service pack 3 update rollup 30, exchange server 2013 +4 more +6 moreA remote code execution vulnerability exists in Microsoft Exchange software when the software...8.8 High
- microsoft sql server, sql server 2014 service pack 3 for 32-bit systems (cu), sql server 2014 service pack 3 for 32-bit systems (gdr) +3 more +5 moreA remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it...8.8 High
- fasterxml jackson-databind, debian linux, huawei oceanstor 9000 firmware +5 more +7 moreDeserialization of Untrusted Data in jackson-databind9.8 Critical
- bosch bvms mobile video service, divar ip 3000, divar ip 7000 +3 more +5 moreDeserialization of Untrusted Data in Bosch BVMS Mobile Video Service10.0 Critical
- nuxeo, nuxeo platform +1 moreRichFaces implementation in Nuxeo Platform 5.6.0 before HF27 and 5.8.0 before HF-01 does not...9.8 Critical
- adobe magentoMagento deserialization vulnerability9.8 Critical
- apache xml-rpc, canonical ubuntu linux, debian linux +2 more +4 moreInsecure Deserialization in Apache XML-RPC9.8 Critical
- honeywell hnmswvms firmware, hnmswvmslt firmware, maxpro nvr pe firmware +3 more +5 moreThe following versions of MAXPRO VMS and NVR, MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build...9.8 Critical
- eclipse memory analyzer, the eclipse foundation eclipse memory analyzer +1 moreEclipse Memory Analyzer version 1.9.1 and earlier is subject to a deserialization vulnerability...7.8 High
- oracle graalvm, oracle corporation java, canonical ubuntu linux +25 more +27 moreVulnerability in the Oracle GraalVM Enterprise Edition product of Oracle GraalVM (component: Java...8.1 High
- oracle coherence, access manager, commerce platform +7 more +9 moreVulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching...9.8 Critical
- jamfAn issue was discovered in Jamf Pro 9.x and 10.x before 10.15.1. Deserialization of untrusted...9.8 Critical
- contao cmsContao CMS through 3.2.4 has PHP Object Injection Vulnerabilities9.8 Critical
- fasterxml jackson-databind, debian linux, netapp active iq unified manager +27 more +29 moreDeserialization of Untrusted Data in jackson-databind9.8 Critical
- vmware spring frameworkPivotal Spring Framework contains unsafe Java deserialization methods9.8 Critical
- tinywallAn attacker who has already compromised the local system could use TinyWall Controller to gain...7.8 High
- orckestra c1 cmsAn issue was discovered in Orckestra C1 CMS through 6.6. The EntityTokenSerializer class in...8.8 High
- apache log4j, bookkeeper, canonical ubuntu linux +14 more +16 moreDeserialization of Untrusted Data in Log4j9.8 Critical
- sfu open journal systemAn issue was discovered in Public Knowledge Project (PKP) pkp-lib before 3.1.2-2, as used in Open...8.8 High
- apple ios, macos, tvos +3 more +5 moreThis issue was addressed with improved checks. This issue is fixed in iOS 12.4, macOS Mojave 10...9.8 Critical
- typo3TYPO3 Insecure Deserialization in Query Generator & Query View8.8 High
- divisait dv2eemvc, proxia phr, proxia suite +1 more +3 moreDivisa Proxia Suite 9 < 9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.8.43 and 9.7.10, 10.0 < 10.0.32, and...9.8 Critical
- drupal views dynamic fieldThe Views Dynamic Fields module through 7.x-1.0-alpha4 for Drupal makes insecure unserialize...8.1 High
- edeploy, redhat jboss enterprise web server +1 moreeDeploy has RCE via cPickle deserialization of untrusted data9.8 Critical
- phpfastcacheObject injection in cookie driver4.4 Medium
- siemens sppa-t3000 application serverA vulnerability has been identified in SPPA-T3000 Application Server (All versions). An attacker...9.8 Critical
- siemens sppa-t3000 application serverA vulnerability has been identified in SPPA-T3000 Application Server (All versions). The...9.8 Critical
- squiz matrixAn issue was discovered in Squiz Matrix CMS 5.5.0 prior to 5.5.0.3, 5.5.1 prior to 5.5.1.8, 5.5.2...7.5 High
- progress telerik ui for asp.net ajax, telerik ui for asp.net ajax +1 moreProgress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization...9.8 Critical
- cacti, debian linux, opensuse leap +2 moreCacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization...8.1 High
- broadcom nolio, ca technologies, a broadcom company release automation +1 moreAn unsafe deserialization vulnerability exists in CA Release Automation (Nolio) 6.6 with the...9.8 Critical
- apache olingoDeserialization of Untrusted Data in Apache Olingo9.8 Critical
- dell emc storage monitoring and reporting, emc storage m&r +1 moreDell EMC Storage Monitoring and Reporting version 4.3.1 contains a Java RMI Deserialization of...9.8 Critical
- cisco rv series routers, small business rv series router firmware, rv016 multi-wan vpn firmware +3 more +5 moreCisco Small Business RV016, RV042, RV042G, and RV082 Routers Arbitrary Command Execution Vulnerability8.8 High
- ibm security identity managerIBM Security Identity Manager 6.0.0 could allow a remote attacker to execute arbitrary code on...8.0 High
- microsoft exchange server, exchange server 2013, exchange server 2016 +3 more +5 moreA remote code execution vulnerability exists in Microsoft Exchange through the deserialization of...9.8 Critical
- adobe systems incorporated magento 2, magento +1 moreMagento 2 Community Edition RCE Vulnerability7.2 High
- centrify privilege elevation service, authentication service +1 moreThe Windows component of Centrify Authentication and Privilege Elevation Services 3.4.0, 3.4.1, 3...7.8 High
- jetbrains teamcityIn JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow...9.8 Critical
- openafsOpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to denial of service from unserialized data...7.5 High
- maprA remote code execution vulnerability exists in MapR CLDB code, specifically in the JSON...9.8 Critical
- mulesoft mule runtimeMulesoft Mule Unsafe Deserialization9.8 Critical
- fasterxml jackson-databind, debian linux, netapp oncommand workflow automation +19 more +21 morejackson-databind polymorphic typing issue9.8 Critical
- fasterxml jackson-databind, debian linux, netapp active iq unified manager +9 more +11 moreImproper Input Validation in jackson-databind9.8 Critical
- Show moreLoading…