CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- techreborn reborncoreThe RebornCore library before 4.7.3 allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as part of reborncore.common.network.ExtendedPacketBuffer. An at…9.8 Critical
- apache dubboDubbo Zookeeper does not check serialization id9.8 Critical
- checkbox surveyDeserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an...9.8 Critical
- re-logic terrariaRe-Logic Terraria before 1.4.2.3 performs Insecure Deserialization.9.8 Critical
- aioseo all in one seo, all in one seo team in one seo – best wordpress seo plugin – easily improve your seo rankings +1 moreAll in One SEO Pack < 4.1.0.2 - Admin RCE via unserialize8.8 High
- nationalsecurityagency emissaryDeserialization of Untrusted Data in Emissary7.2 High
- solarwinds network performance monitorThis vulnerability allows remote attackers to execute arbitrary code on affected installations of...9.8 Critical
- x-stream xstream, debian linux, fedoraproject fedora +14 more +16 moreXStream is vulnerable to a Remote Command Execution attack7.5 High
- query solutions redirection for contact form 7Redirection for Contact Form 7 < 2.3.4 - Authenticated PHP Object Injection8.8 High
- flask-caching project flask-cachingDeserialization of Untrusted Data in Flask-Caching9.8 Critical
- asynkron wireInsecure deserialization in Wire9.1 Critical
- artica pandora fmsArtica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization.9.8 Critical
- arubanetworks airwaveA remote insecure deserialization vulnerability was discovered in Aruba AirWave Management...7.2 High
- arubanetworks airwaveA remote insecure deserialization vulnerability was discovered in Aruba AirWave Management...8.8 High
- phpmailer project phpmailer, wordpress +1 moreObject injection in PHPMailer/PHPMailer9.8 Critical
- psf requestsInsecure Deserialization of untrusted data in rmccue/requests9.8 Critical
- apache ofbizUnsafe deserialization in Apache OFBiz9.8 Critical
- apache ofbizRCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI9.8 Critical
- rapid7 metasploit, metasploit framework +1 moreMetasploit Framework 'drb_remote_codeexec' code execution8.1 High
- solarwinds orion virtual infrastructure monitor, orion platform +1 moreThis vulnerability allows local attackers to escalate privileges on affected installations of...7.8 High
- zohocorp manageengine opmanagerZoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a...9.8 Critical
- openmage magento, magento-lts +1 moreFixes a bug in Zend Framework's Stream HTTP Wrapper9.8 Critical
- palo alto networks bridgecrew checkovBridgecrew Checkov: Unsafe deserialization of Terraform files allows code execution6.7 Medium
- apache tapestryBypass of the fix for CVE-2019-01959.8 Critical
- stackpath ajaxsearchproAjaxSearchPro before 4.20.8 allows Deserialization of Untrusted Data (in the import database...7.2 High
- dell emc storage monitoring and reporting, storage monitoring and reporting, storage resource manager +2 moreDell SRM versions prior to 4.5.0.1 and Dell SMR versions prior to 4.5.0.1 contain an Untrusted...9.8 Critical
- facebook, unknown facebook for wordpress +1 moreFacebook for WordPress < 3.0.0 - PHP Object Injection with POP Chain8.1 High
- cisco small business rv series router firmware, rv340 firmware, rv340w firmware +2 more +4 moreCisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Authenticated Remote Code Execution Vulnerabilities6.3 Medium
- cisco small business rv series router firmware, rv340 firmware, rv340w firmware +2 more +4 moreCisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Authenticated Remote Code Execution Vulnerabilities6.3 Medium
- cisco small business rv series router firmware, rv340 firmware, rv340w firmware +2 more +4 moreCisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Authenticated Remote Code Execution Vulnerabilities6.3 Medium
- fasterxml jackson-databind, debian linux, netapp active iq unified manager +2 more +4 morejackson-databind vulnerable to unsafe deserialization8.1 High
- solarwinds patch managerThis vulnerability allows local attackers to escalate privileges on affected installations of...7.8 High
- x-stream xstream, apache activemq, jmeter +13 more +15 moreXStream is vulnerable to an Arbitrary Code Execution attack5.4 Medium
- x-stream xstream, apache activemq, jmeter +13 more +15 moreXStream is vulnerable to an Arbitrary Code Execution attack5.3 Medium
- x-stream xstream, apache activemq, jmeter +14 more +16 moreA Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host6.1 Medium
- x-stream xstream, apache activemq, jmeter +13 more +15 moreXStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos)5.3 Medium
- x-stream xstream, apache activemq, jmeter +13 more +15 moreXStream is vulnerable to an Arbitrary Code Execution attack6.1 Medium
- x-stream xstream, apache activemq, jmeter +13 more +15 moreXStream is vulnerable to an Arbitrary Code Execution attack6.1 Medium
- x-stream xstream, apache activemq, jmeter +13 more +15 moreXStream is vulnerable to a Remote Command Execution attack5.8 Medium
- x-stream xstream, apache activemq, jmeter +13 more +15 moreXStream is vulnerable to an Arbitrary Code Execution attack5.3 Medium
- x-stream xstream, apache activemq, jmeter +12 more +14 moreXStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights5.3 Medium
- x-stream xstream, apache activemq, jmeter +12 more +14 moreA Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host5.3 Medium
- x-stream xstream, apache activemq, jmeter +10 more +12 moreXStream can cause a Denial of Service7.5 High
- apache ofbizRCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI9.8 Critical
- rabbitmq jms clientUnsafe Deserialization that can Result in Code Execution9.8 Critical
- fivestarplugins five star restaurant menuThe food-and-drink-menu plugin through 2.2.0 for WordPress allows remote attackers to execute...9.8 Critical
- tenable jira cloud, integration-jira-cloud +1 moreExecution of untrusted code through config file5.0 Medium
- sap netweaver knowledge managementKnowledge Management versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 allows a remote attacker with...6.5 Medium
- qcubedqcubed PHP object injection9.8 Critical
- fork-cms fork cmsPHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an...8.8 High
- Show moreLoading…