CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- spring by vmware integration, vmware spring integration, oracle banking corporate lending process management +6 more +8 moreKryo Configuration Allows Code Execution with Unknown "Serialization Gadgets"9.8 Critical
- vmware gemfire, vmware tanzu gemfire for vms, vmware tanzu gemfire for virtual machines +2 moreJMX Credential Deserialization in GemFire9.0 Critical
- typo3, typo3 cms +1 moreMissing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS8.8 High
- friendsoftypo3 mediacePotential Remote Code Execution in TYPO3 with mediace extension9.8 Critical
- nec esmpro managerThis vulnerability allows remote attackers to execute arbitrary code on affected installations of...9.8 Critical
- adobe magentoMagento php object injection vulnerability9.8 Critical
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP have Insecure Deserialization Vulnerability8.1 High
- ibm websphere application serverIBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker...8.8 High
- apache airflowInsecure default config of Celery worker in Apache Airflow9.8 Critical
- iconics genbroker32, genbroker64, platform services, workbench, frameworx server, mitsubishi electric mc works32 +11 more +13 moreA specially crafted communication packet sent to the affected devices could allow remote code...9.8 Critical
- iconics genbroker32, genbroker64, platform services, workbench, frameworx server, mitsubishi electric mc works32 +11 more +13 moreA specially crafted communication packet sent to the affected systems could cause a denial-of...7.5 High
- iconics genbroker32, genbroker64, platform services, workbench, frameworx server, mitsubishi electric mc works32 +11 more +13 moreA specially crafted communication packet sent to the affected device could cause a denial-of...7.5 High
- mit scratch-vmRemote Code Execution in scratch-vm9.8 Critical
- apache ofbizXML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in...6.1 Medium
- microsoft sharepoint server, sharepoint enterprise server, sharepoint foundation +2 moreA remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server...8.8 High
- apache dubboDeserialization of Untrusted Data in Apache Dubbo9.8 Critical
- ibm infosphere information server, infosphere information server on cloud +1 moreIBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow a remote attacker to execute...8.1 High
- atlassian jira, jira server, jira software data center +2 moreAffected versions of Atlassian Jira Server and Data Center allow remote attackers to achieve...9.8 Critical
- jenkins kubernetes ci, jenkins project elasticbox jenkins kubernetes ci/cd plugin +1 moreRCE vulnerability in ElasticBox Jenkins Kubernetes CI/CD Plugin8.8 High
- beakerbrowser beakerDeserialization of Untrusted Data in Beaker6.8 Medium
- [unknown] wildflyWildfly Unsafe Deserialization Vulnerability6.6 Medium
- tendenciDeserialization of Untrusted Data in Tendenci9.8 Critical
- squirrelmailcompose.php in SquirrelMail 1.4.22 calls unserialize for the $mailtodata value, which originates...9.8 Critical
- squirrelmailcompose.php in SquirrelMail 1.4.22 calls unserialize for the $attachments value, which originates...8.8 High
- fasterxml jackson-databind, debian linux, netapp active iq unified manager +11 more +13 moreDeserialization of untrusted data in Jackson Databind8.1 High
- fasterxml jackson-databind, netapp active iq unified manager, steelstore cloud integrated storage +9 more +11 moreDeserialization of untrusted data in Jackson Databind8.1 High
- fasterxml jackson-databind, debian linux, netapp active iq unified manager +12 more +14 moreDeserialization of untrusted data in Jackson Databind8.1 High
- fasterxml jackson-databind, debian linux, netapp active iq unified manager +10 more +12 moreDeserialization of untrusted data in Jackson Databind8.1 High
- broadcom spring batch, spring by vmware batch +1 moreJackson Configuration Allows Code Execution with Unknown "Serialization Gadgets"8.1 High
- google androidIn BnAAudioService::onTransact of IAAudioService.cpp, there is a possible out of bounds read due...5.5 Medium
- phpmusselPhar unserialization vulnerability in phpMussel7.7 High
- inductive automation ignition 8 gateway, inductiveautomation ignition gateway +1 moreThe affected product is vulnerable to the handling of serialized data. The issue results from the...7.5 High
- inductive automation ignition 8 gateway, inductiveautomation ignition gateway +1 moreThe affected product lacks proper validation of user-supplied data, which can result in...7.5 High
- ibm websphere application serverIBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute...9.8 Critical
- ibm websphere application serverIBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker...7.5 High
- ibm websphere application server, websphere virtual enterprise +1 moreIBM WebSphere Application Server Network Deployment 7.0, 8.0, 8.5, and 9.0 could allow a remote...9.8 Critical
- verizon serialize-javascriptInsecure serialization leading to RCE in serialize-javascript8.1 High
- rubyonrails rails, debian linux, opensuse backports sle +2 more +4 morePossible Strong Parameters Bypass in ActionPack7.5 High
- rubyonrails rails, debian linux, opensuse leap +1 more +3 moreActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore9.8 Critical
- cisco unified contact center expressCisco Unified Contact Center Express Remote Code Execution Vulnerability9.8 Critical
- jodd, apache hive +1 moreDeserialization of Untrusted Data in Jodd9.8 Critical
- smartbear readyapiAn issue was discovered in SmartBear ReadyAPI SoapUI Pro 3.2.5. Due to unsafe use of an Java RMI...9.8 Critical
- numfocus pandaspandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed...9.8 Critical
- scikit-learnscikit-learn Deserialization of Untrusted Data9.8 Critical
- apache camel, oracle communications diameter signaling router, enterprise manager base platform +1 more +3 moreDeserialization of Untrusted Data in Apache Camel RabbitMQ9.8 Critical
- apache camel, oracle communications diameter signaling router, enterprise manager base platform +1 more +3 moreApache Camel Netty enables Java deserialization by default9.8 Critical
- typo3, typo3 cms +1 moreDeserialization of Untrusted Data in TYPO3 CMS8.8 High
- tylertech eagleTylerTech Eagle 2018.3.11 deserializes untrusted user input, resulting in remote code execution...8.8 High
- opennms horizon, meridian +1 moreOpenNMS Horizon RCE via Unsafe Deserialization8.8 High
- apache tomcat, canonical ubuntu linux, debian linux +23 more +25 morePotential remote code execution in Apache Tomcat7.0 High
- Show moreLoading…