CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- ibm sterling b2b integratorIBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2,...8.8 High
- nxlogThe fileop module of the NXLog service in NXLog Community Edition 2.10.2150 allows remote...7.5 High
- getlaminas laminas-http, zend framework +1 moreRemote code execution in zendframework and laminas-http9.8 Critical
- pickplugins team showcase, post grid +1 morePHP Object injection vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress...7.5 High
- pickplugins post grid, team showcase +1 morePHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow...7.5 High
- tribulant newsletterInsecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated...7.5 High
- qdpmqdPM through 9.1 allows PHP Object Injection via timeReportActions::executeExport in core/apps...8.8 High
- nukevietDeserialization of Untrusted Data in NukeViet9.8 Critical
- fasterxml jackson-databind, debian linux, netapp service level manager +37 more +39 moreSerialization gadget exploit in jackson-databind8.1 High
- apache dolphinschedulerRemote code execution in DolphinScheduler9.8 Critical
- fasterxml jackson-databind, debian linux, netapp service level manager +22 more +24 moreSerialization gadgets exploit in jackson-databind8.1 High
- fasterxml jackson-databind, debian linux, netapp service level manager +23 more +25 moreSerialization gadgets exploit in jackson-databind8.1 High
- jsonpickle project jsonpicklejsonpickle unsafe deserialization9.8 Critical
- quantconnect leanQuantConnect Lean vulnerable to insecure deserialization9.8 Critical
- linuxfoundation spinnakerNolan Ray from Apple Information Security identified a security vulnerability in Spinnaker, all...8.8 High
- microsoft exchange server, exchange server 2010 service pack 3 update rollup 31 +1 moreMicrosoft Exchange Remote Code Execution Vulnerability8.4 High
- apache tapestryDeserialization flaw in EOL Tapestry 4.9.8 Critical
- debian linux, drupal, fedoraproject fedora +1 more +3 moreDeserialization of Untrusted Data in Archive_Tar7.8 High
- debian linux, drupal, fedoraproject fedora +1 more +3 moreMultiple vulnerabilities through filename manipulation in Archive_Tar7.8 High
- cisco security managerCisco Security Manager Java Deserialization Vulnerabilities8.1 High
- neuroinformatics unit, integrative computational brain science collaboration division, riken center for brain science xoonipsDeserialization of untrusted data vulnerability in XooNIps 3.49 and earlier allows remote...9.8 Critical
- welcart e-commerceThe usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object...7.5 High
- databaseschemareader project dbschemareaderUnsafe deserialization in DatabaseSchemaViewer8.0 High
- wordpress, debian linux, fedoraproject fedora +2 moreWordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility...9.8 Critical
- redhat fabric8-mavenfabric8-maven-plugin: insecure way to construct Yaml Object leading to remote code execution7.8 High
- openmage magento, magento-lts +1 moreRCE in Magento8.0 High
- hp intelligent management center, hpe intelligent management center (imc) +1 moreA accessmgrservlet classname deserialization of untrusted data remote code execution...9.8 Critical
- arc informatique pcvueARC Informatique PcVue Deserialization of Untrusted Data9.8 Critical
- samsung updateSamsung Update Local Privilege Escalation Vulnerability6.2 Medium
- mybatis"Deserialization errors in MyBatis"8.1 High
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar SIEM 7.3 and 7.4 could allow a remote attacker to execute arbitrary commands on the...6.3 Medium
- ozeki ng sms gatewayAn issue was discovered in Ozeki NG SMS Gateway through 4.17.6. It stores SMS messages in .NET...7.2 High
- brassica soy cms, inunosinsi soycms +1 moreUnauthenticated Remote Code Execution in SOY CMS10.0 Critical
- fasterxml jackson-databind, debian linux, oracle agile product lifecycle management +23 more +25 moreUnsafe Deserialization in jackson-databind8.1 High
- schneider-electric scadapack x70 security administratorA CWE-502 Deserialization of Untrusted Data vulnerability exists in SCADAPack x70 Security...7.8 High
- schneider-electric scadapack 7x remote connectA CWE-502 Deserialization of Untrusted Data vulnerability exists in SCADAPack 7x Remote Connect ...7.8 High
- fluffycogs project fluffycogsRemote Code Execution in Act module8.7 High
- yiiframework yii, yiisoft yii2 +1 moreUnsafe deserialization in Yii 28.9 High
- ibm maximo asset managementIBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote authenticated attacker to...8.8 High
- taoensso nippyGadget chain attack in Nippy7.8 High
- hyland onbaseAn issue was discovered in Hyland OnBase through 18.0.0.32 and 19.x through 19.8.9.1000. It uses...9.8 Critical
- hyland onbaseAn issue was discovered in Hyland OnBase through 18.0.0.32 and 19.x through 19.8.9.1000. It uses...9.8 Critical
- hyland onbaseAn issue was discovered in Hyland OnBase through 18.0.0.32 and 19.x through 19.8.9.1000. It...9.8 Critical
- canonical ubuntu-ui-toolkitInsecure temp file usage in Ubuntu UI toolkit3.8 Low
- senstar symphonyThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected...8.8 High
- sagemcom f\@st 5280 router firmwareSagemcom F@ST 5280 routers using firmware version 1.150.61 have insecure deserialization that...8.8 High
- gradle mavenMaven Extension plugin for Gradle Enterprise vulnerable to Deserialization of Untrusted Data7.8 High
- fasterxml jackson-databind, debian linux, netapp active iq unified manager +22 more +24 moreCode Injection in jackson-databind8.1 High
- open robotics ros, openrobotics robot operating system +1 moreRVD#2401: Use of unsafe yaml load, ./src/actionlib/tools/library.py:1328.0 High
- ibm websphere application serverIBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute...8.1 High
- Show moreLoading…