CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- plex media serverDeserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated...7.2 High
- mozilla firefoxIncorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security...9.8 Critical
- jenkins project scm filter jervis plugin, jenkins source code management filter jervis +1 moreRCE vulnerability in SCM Filter Jervis Plugin8.8 High
- intelliants subrionSubrion CMS PHP Object Injection6.5 Medium
- mono monoxMonoX through 5.1.40.5152 allows remote code execution via HTML5Upload.ashx or Pages...9.8 Critical
- farukawa electric consciousmapThe Apros Evolution, ConsciusMap, and Furukawa provisioning systems through 2.8.1 allow remote...9.8 Critical
- veeam one, one agent +1 moreThis vulnerability allows remote attackers to execute arbitrary code on affected installations of...9.8 Critical
- veeam one, one agent +1 moreThis vulnerability allows remote attackers to execute arbitrary code on affected installations of...9.8 Critical
- google androidIn ExternalVibration of ExternalVibration.java, there is a possible activation of an arbitrary...7.8 High
- apache heronDeserialization of Untrusted Data in Apache Heron9.8 Critical
- jenkins project aws sam plugin, jenkins amazon web services serverless application model +1 moreRCE vulnerability in Jenkins AWS SAM Plugin8.8 High
- jenkins yaml axis, jenkins project yaml axis plugin +1 moreRCE vulnerability in Jenkins Yaml Axis Plugin8.8 High
- ibm qradar, qradar security information and event manager +1 moreIBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow a remote attacker to include arbitrary files. A...5.5 Medium
- ibm qradar, qradar security information and event manager +1 moreIBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow an authenticated user to send a specially crafted...6.3 Medium
- oracle corporation java, canonical ubuntu linux, debian linux +19 more +21 moreVulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component:...3.7 Low
- oracle corporation java, canonical ubuntu linux, debian linux +18 more +20 moreVulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component:...3.7 Low
- sap se crystal reports for vs, business objects business intelligence platform (crystalreports webform viewer), sap businessobjects business intelligence platform +1 more +3 moreSAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1...9.1 Critical
- primekey ejbcaAn issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. In several sections of...9.8 Critical
- fasterxml jackson-databind, debian linux, netapp active iq unified manager +15 more +17 morejackson-databind mishandles the interaction between serialization gadgets and typing8.1 High
- fasterxml jackson-databind, debian linux, netapp active iq unified manager +18 more +20 morejackson-databind mishandles the interaction between serialization gadgets and typing8.1 High
- apache dubboDeserialization of Untrusted Data in Apache Dubbo9.8 Critical
- deskproAn issue was discovered in Deskpro before 2019.8.0. This product enables administrators to modify...9.1 Critical
- mongodb js-bsonJS-bson may incorrectly serialise some requests4.2 Medium
- fasterxml jackson-databind, debian linux, netapp steelstore cloud integrated storage +29 more +31 morejackson-databind mishandles the interaction between serialization gadgets and typing8.8 High
- fasterxml jackson-databind, debian linux, netapp steelstore cloud integrated storage +29 more +31 morejackson-databind mishandles the interaction between serialization gadgets and typing8.8 High
- fasterxml jackson-databind, debian linux, netapp steelstore cloud integrated storage +30 more +32 morejackson-databind mishandles the interaction between serialization gadgets and typing8.8 High
- mongodb bsonDeserialization of Untrusted Data in bson9.8 Critical
- fasterxml jackson-databind, debian linux, netapp steelstore cloud integrated storage +29 more +31 morejackson-databind mishandles the interaction between serialization gadgets and typing8.8 High
- fasterxml jackson-databind, debian linux, netapp steelstore cloud integrated storage +29 more +31 morejackson-databind mishandles the interaction between serialization gadgets and typing8.8 High
- jenkins azure container service, jenkins project azure container service plugin +1 moreRCE vulnerability in Jenkins Azure Container Service Plugin8.8 High
- jenkins openshift pipeline, jenkins project openshift pipeline plugin +1 moreRCE vulnerability in Jenkins OpenShift Pipeline Plugin8.8 High
- jenkins project pipeline: aws steps plugin, jenkins pipeline\ +1 moreRCE vulnerability in Jenkins Pipeline: AWS Steps Plugin8.8 High
- rockwellautomation factorytalk services platformIn Rockwell Automation all versions of FactoryTalk Diagnostics software, a subsystem of the...9.8 Critical
- liferay portalDeserialization of Untrusted Data in Liferay Portal9.8 Critical
- fasterxml jackson-databind, debian linux, netapp steelstore cloud integrated storage +29 more +31 morejackson-databind mishandles the interaction between serialization gadgets and typing8.8 High
- fasterxml jackson-databind, debian linux, netapp steelstore cloud integrated storage +29 more +31 morejackson-databind mishandles the interaction between serialization gadgets and typing8.8 High
- pydioA problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object...8.8 High
- pydioA problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object...8.8 High
- apache shardingsphere, apache software foundation shardingsphere(incubator) +1 moreDeserialization of Untrusted Data in Apache ShardingSphere9.8 Critical
- hp storage essentialsIn HPE Storage Essentials 9.5.0.142, there is Unauthenticated Java Deserialization with remote...9.8 Critical
- lexmark markvision enterpriseLexmark Markvision Enterprise before 2.3.0 misuses the Apache Commons Collections Library,...8.8 High
- jenkins literate, jenkins project literate plugin +1 moreRemote Code Execution vulnerability in Jenkins Literate Plugin8.8 High
- dell security management server, encryption enterprise +1 moreDell Security Management Server versions prior to 10.2.10 contain a Java RMI Deserialization of...8.1 High
- zoho manageengine, zohocorp manageengine desktop central +1 moreZoho ManageEngine Desktop Central 10 allows remote code execution because of deserialization of...9.8 Critical
- fasterxml jackson-databind, netapp oncommand api services, steelstore cloud integrated storage +1 more +3 morePolymorphic deserialization of malicious object in jackson-databind7.5 High
- fasterxml jackson-databind, apache geode, redhat decision manager +5 more +7 morePolymorphic deserialization of malicious object in jackson-databind7.5 High
- fasterxml jackson-databind, debian linux, netapp active iq unified manager +28 more +30 morejackson-databind mishandles the interaction between serialization gadgets and typing9.8 Critical
- fasterxml jackson-databind, debian linux, netapp active iq unified manager +13 more +15 morejackson-databind mishandles the interaction between serialization gadgets and typing9.8 Critical
- fasterxml jackson-databind, debian linux, netapp active iq unified manager +22 more +24 morejackson-databind mishandles the interaction between serialization gadgets and typing9.8 Critical
- arubanetworks airwaveAn administrative application user of or application user with write access to Aruba Airwave...7.2 High
- Show moreLoading…