CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- x-stream xstream, debian linux, fedoraproject fedora +12 more +14 moreXStream is vulnerable to an Arbitrary Code Execution attack8.5 High
- x-stream xstream, debian linux, fedoraproject fedora +12 more +14 moreXStream is vulnerable to an Arbitrary Code Execution attack8.5 High
- x-stream xstream, debian linux, fedoraproject fedora +12 more +14 moreXStream is vulnerable to an Arbitrary Code Execution attack8.5 High
- x-stream xstream, debian linux, fedoraproject fedora +12 more +14 moreXStream is vulnerable to an Arbitrary Code Execution attack8.5 High
- x-stream xstream, debian linux, fedoraproject fedora +12 more +14 moreXStream is vulnerable to an Arbitrary Code Execution attack8.5 High
- x-stream xstream, debian linux, fedoraproject fedora +12 more +14 moreXStream is vulnerable to an Arbitrary Code Execution attack8.5 High
- x-stream xstream, debian linux, fedoraproject fedora +10 more +12 moreXStream is vulnerable to an Arbitrary Code Execution attack8.5 High
- x-stream xstream, debian linux, fedoraproject fedora +12 more +14 moreXStream is vulnerable to an Arbitrary Code Execution attack8.5 High
- x-stream xstream, debian linux, fedoraproject fedora +12 more +14 moreXStream is vulnerable to an Arbitrary Code Execution attack8.5 High
- x-stream xstream, debian linux, fedoraproject fedora +12 more +14 moreXStream is vulnerable to an Arbitrary Code Execution attack8.5 High
- x-stream xstream, debian linux, fedoraproject fedora +12 more +14 moreXStream is vulnerable to a Remote Command Execution attack8.5 High
- 3s-smart software solutions codesysA unsafe deserialization vulnerability exists in the ObjectManager.plugin Project...8.8 High
- 3s-smart software solutions codesysA unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream...8.8 High
- google tensorflowArbitrary code execution due to YAML deserialization9.3 Critical
- cpanelThe WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).7.2 High
- codeceptionDeserialization of Untrusted Data7.7 High
- jetbrains teamcityIn JetBrains TeamCity before 2020.2.4, there was an insecure deserialization.9.8 Critical
- config lib project lib, supermartijn642 supermartijn642sconfiglib +1 moreDeserialization of Untrusted Data in com.supermartijn642.configlib.ConfigSyncPacket8.1 High
- 3s-smart software solutions codesys, codesys development system +1 moreA unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile()...8.8 High
- neo4jDeserialization of Untrusted Data in Neo4j9.8 Critical
- devexpressDevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure...8.8 High
- 3s-smart software solutions codesys, codesys development system +1 moreA unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation...8.8 High
- 3s-smart software solutions codesys, codesys development system +1 moreA unsafe deserialization vulnerability exists in the PackageManagement.plugin ExtensionMethods...8.8 High
- 3s-smart software solutions codesys, codesys development system +1 moreA unsafe deserialization vulnerability exists in the ComponentModel ComponentManager...7.8 High
- ibm partner engagement managerIBM Partner Engagement Manager 2.0 could allow a remote attacker to execute arbitrary code on the...9.8 Critical
- apache juddiRemote code execution via RMI9.8 Critical
- dell emc avamar server, avamar virtual edition, emc integrated data protection appliance firmware +2 moreDeserialization of Untrusted Data Vulnerability Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7...9.8 Critical
- concretecms concrete cmsConcrete5 through 8.5.5 deserializes Untrusted Data. The vulnerable code is located within the...7.2 High
- forgerock openam, access management (am), access management +2 moreForgeRock AM server 6.x before 7, and OpenAM 14.6.3, has a Java deserialization vulnerability in...9.8 Critical
- schneider-electric sosafe configurableA CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause code execution...7.8 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint foundation 2013 service pack 1 +2 more +4 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability8.1 High
- vaporUntrusted data fed into `Data.init(base32Encoded:)` can result in exposing server memory and/or crash7.5 High
- arubanetworks clearpass policy manager, hewlett packard enterprise (hpe) aruba clearpass policy manager +1 moreA remote insecure deserialization vulnerability was discovered in Aruba ClearPass Policy Manager...7.2 High
- beardev joomsport, joomsport – for sports: team & league, football, hockey & more +1 moreJoomSport < 5.1.8 - Unauthenticated PHP Object Injection9.8 Critical
- veeam backup \& replicationVeeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507...9.8 Critical
- huawei anyofficeThere is a deserialization vulnerability in Huawei AnyOffice V200R006C10. An attacker can...8.1 High
- ratpackRemote Code Execution Vulnerability in Session Storage9.9 Critical
- jfinalJFinal Java Deserialization Vulnerability9.8 Critical
- nvidia jetson linux, jetson tx2 series, tx2 nx, agx xavier series, xavier nx +1 moreTrusty contains a vulnerability in all TAs whose deserializer does not reject messages with...4.2 Medium
- nvidia jetson linux, jetson tx2 series, tx2 nx, agx xavier series, xavier nx +1 moreTrusty contains a vulnerability in TSEC TA which deserializes the incoming messages even though...4.2 Medium
- theologeek manuskript** DISPUTED ** Manuskript through 0.12.0 allows remote attackers to execute arbitrary code via a...7.8 High
- apache chainsaw, log4j, qos reload4j +2 moreJava deserialization in Chainsaw9.8 Critical
- palo alto networks bridgecrew checkovBridgecrew Checkov: Unsafe deserialization of Terraform files allows code execution6.7 Medium
- octavolabs vernemqVerneMQ MQTT Broker versions prior to 1.12.0 are vulnerable to a denial of service attack as a...7.5 High
- emq technologies x broker, emqx emq x broker +1 moreEMQ X Broker versions prior to 4.2.8 are vulnerable to a denial of service attack as a result of...7.5 High
- invoiceninja invoice ninjaIn Invoice Ninja before 4.4.0, there is an unsafe call to unserialize() in app/Ninja/Repositories...8.1 High
- bdew bdlibThe BDew BdLib library before 1.16.1.7 for Minecraft allows remote code execution because it...9.8 Critical
- mcafee database security, mcafee,llc mcafee database security (dbsec) +1 moreAuthorized deserialization of untrusted data in McAfee DBSec9.0 Critical
- mcafee database security, mcafee,llc mcafee database security (dbsec) +1 moreUnauthorized deserialization of untrusted data in McAfee DBSec9.6 Critical
- apache dubboApache Dubbo Pre-auth RCE via Java deserialization in the Generic filter9.8 Critical
- Show moreLoading…