CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- thimpress wp hotel bookingThe wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute...9.8 Critical
- tenable tenable.scTenable.sc and Tenable.sc Core versions 5.13.0 through 5.17.0 were found to contain a...8.8 High
- microsoft exchange server, exchange server 2010 service pack 3, exchange server 2013 cumulative update 21 +24 more +26 moreMicrosoft Exchange Server Remote Code Execution Vulnerability7.8 High
- apache tomcat, debian linux, oracle agile product lifecycle management +9 more +11 moreIncomplete fix for CVE-2020-94847.0 High
- microsoft sharepoint enterprise server 2016, sharepoint foundation 2010 service pack 2, sharepoint foundation 2013 service pack 1 +4 more +6 moreMicrosoft SharePoint Remote Code Execution Vulnerability8.8 High
- kollectapp kollectKollectApps before 4.8.16c is affected by insecure Java deserialization, leading to Remote Code...9.8 Critical
- hr portal project portal, soar cloud hr portal +1 moreSoar Cloud System Co., Ltd. HR Portal - Arbitrary Code Execution9.8 Critical
- microsoft qlibDeserialization of Untrusted Data6.6 Medium
- pystemon project pystemonconfig.py in pystemon before 2021-02-13 allows code execution via YAML deserialization because...9.8 Critical
- qognify ocularisThis vulnerability allows remote attackers to execute arbitrary code on affected installations of...9.8 Critical
- netmotionsoftware netmotion mobilityNetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to...8.1 High
- netmotionsoftware netmotion mobilityNetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to...8.1 High
- netmotionsoftware netmotion mobilityNetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to...8.1 High
- netmotionsoftware netmotion mobilityNetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to...8.1 High
- solarwinds orion platformThe Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ (Microsoft Message...9.8 Critical
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2020.3, potentially insecure deserialization of the workspace...7.8 High
- aca assuwebDeserialization of untrusted data in the login page of ASSUWEB 359.3 build 1 subcomponent of ACA...9.8 Critical
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar SIEM 7.4.0 to 7.4.2 Patch 1 and 7.3.0 to 7.3.3 Patch 7 could allow a remote attacker...6.3 Medium
- ibm mq, mq appliance, websphere mq +2 moreIBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary...8.1 High
- apache software foundation servicecomb-java-chassis, apache java chassis +1 moreApache ServiceComb Yaml remote deserialization vulnerability8.8 High
- m&m software fdtcontainer component, emerson rosemount transmitter interface software, m&m software dtmlinspector +5 more +7 moreWAGO/M&M Software Deserialization of untrusted data in fdtCONTAINER component7.3 High
- ibm infosphere information server** UNSUPPORTED WHEN ASSIGNED ** IBM InfoSphere Information Server 8.5.0.0 is affected by...9.8 Critical
- raw-cpuid project raw-cpuidOptional `Deserialize` implementations lacking validation9.8 Critical
- fasterxml jackson-databind, apache nifi, debian linux +6 more +8 moreDeserialization of untrusted data in jackson-databind8.1 High
- opencatsOpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote...9.8 Critical
- onedev project onedevPost-Auth Unsafe Deserialization on BasePage (AJAX)9.6 Critical
- onedev project onedevPost-Auth Unsafe Yaml deserialization9.6 Critical
- onedev project onedevPre-Auth Unsafe Deserialization on AttachmentUploadServet10.0 Critical
- onedev project onedevPre-Auth Unsafe Deserialization on KubernetesResource10.0 Critical
- arubanetworks airwave glassThere is a vulnerability caused by unsafe Java deserialization that allows for arbitrary command...9.8 Critical
- thinkadminThinkAdmin insecure unserialize vulnerability9.8 Critical
- jenkinsImproper handling of REST API XML deserialization errors in Jenkins8.0 High
- smartbear collaboratorIn SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit (GWT) API...8.8 High
- apache dubboApache Dubbo default deserialization protocol Hessian2 cause CRE9.8 Critical
- fasterxml jackson-databind, debian linux, netapp cloud backup +54 more +56 moreUnsafe Deserialization in jackson-databind8.1 High
- fasterxml jackson-databind, debian linux, netapp cloud backup +56 more +58 moreUnsafe Deserialization in jackson-databind8.1 High
- fasterxml jackson-databind, debian linux, netapp cloud backup +56 more +58 moreUnsafe Deserialization in jackson-databind8.1 High
- fasterxml jackson-databind, debian linux, netapp cloud backup +42 more +44 moreUnsafe Deserialization in jackson-databind8.1 High
- fasterxml jackson-databind, debian linux, netapp cloud backup +56 more +58 moreUnsafe Deserialization in jackson-databind8.1 High
- fasterxml jackson-databind, debian linux, netapp cloud backup +42 more +44 moreUnsafe Deserialization in jackson-databind8.1 High
- fasterxml jackson-databind, debian linux, netapp cloud backup +42 more +44 moreUnsafe Deserialization in jackson-databind8.1 High
- fasterxml jackson-databind, debian linux, netapp cloud backup +42 more +44 moreUnsafe Deserialization in jackson-databind8.1 High
- fasterxml jackson-databind, debian linux, netapp cloud backup +42 more +44 moreUnsafe Deserialization in jackson-databind8.1 High
- fasterxml jackson-databind, debian linux, netapp cloud backup +37 more +39 moreUnsafe Deserialization in jackson-databind8.1 High
- fasterxml jackson-databind, debian linux, netapp service level manager +55 more +57 moreUnsafe Deserialization in jackson-databind8.1 High
- proofpoint insider threat managementrcdsvc in the Proofpoint Insider Threat Management Windows Agent (formerly ObserveIT Windows...8.8 High
- proofpoint insider threat management serverThe Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains...9.8 Critical
- proofpoint insider threat management serverThe Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains...7.2 High
- proofpoint insider threat management serverThe Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains...9.8 Critical
- proofpoint insider threat management serverThe Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains...9.8 Critical
- Show moreLoading…