CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- spring amqp, vmware spring advanced message queuing protocol +1 moreDeserialization of Untrusted Data in Spring AMQP6.5 Medium
- orckestra c1 cmsThis vulnerability allows remote attackers to execute arbitrary code on affected installations of...8.8 High
- apache shardingsphere-uiDeserialization of Untrusted Data7.5 High
- microsoft exchange, exchange server, exchange server 2016 cumulative update 21 +3 more +5 moreMicrosoft Exchange Server Remote Code Execution Vulnerability8.8 High
- azeotech daqfactoryAzeoTech DAQFactory7.8 High
- sitecore xp, experience platform +1 moreSitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure...9.8 Critical
- google androidIn createFromParcel of OutputConfiguration.java, there is a possible parcel serialization...7.8 High
- spring amqp, vmware spring advanced message queuing protocol +1 moreDeserialization of Untrusted Data in Spring AMQP6.5 Medium
- eleveo call recordingZoom Call Recording 6.3.1 from ZOOM International is vulnerable to Java Deserialization attacks...10.0 Critical
- apache stormUnsafe Pre-Authentication Deserialization In Workers9.8 Critical
- heateor sassy social share, sassy social share social share +1 moreSassy Social Share 3.3.23 PHP Object Injection8.8 High
- adobe connectAdobe Connect Deserialization of Untrusted Data Remote Code Execution9.8 Critical
- solarwinds access rights managerInsecure Web Configuration for RabbitMQ Management Plugin in SolarWinds ARM4.7 Medium
- namekoNameko Arbitrary code execution due to YAML deserialization7.8 High
- adobe ops-cliOps CLI Deserialization of Untrusted Data leads to Abritrary Code Execution9.8 Critical
- proofpoint insider threat management serverProofpoint Insider Threat Management Server contains an unsafe deserialization vulnerability in...7.3 High
- siemens sinec nmsA vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected...7.2 High
- kubernetes java, java client +1 moreCode exec via yaml parsing6.7 Medium
- zammadAn issue was discovered in Zammad before 4.1.1. The Form functionality allows remote code...9.8 Critical
- convoypanel panelAuthentication bypass in Pterodactyl8.1 High
- common-workflow-language cwlviewerCWL Viewer: deserialization of untrusted data can lead to complete takeover by an attacker9.1 Critical
- apache ddlutils, apache software foundation db ddlutils +1 moreApache ddlutils 1.0 readobject vulnerability9.8 Critical
- concretecms concrete cmsAn issue was discovered in Concrete CMS through 8.5.5. Arbitrary File deletion can occur via PHAR...9.1 Critical
- gradleIn Gradle Enterprise before 2021.1.3, a crafted request can trigger deserialization of arbitrary...8.1 High
- octopus halibutRemote Code Execution in Halibut9.8 Critical
- mylittletools mylittlebackupThe management tool in MyLittleBackup up to and including 1.7 allows remote attackers to execute...9.8 Critical
- siemens cerberus dms v4.0, cerberus dms v4.1, cerberus dms v4.2 +12 more +14 moreA vulnerability has been identified in Cerberus DMS V4.0 (All versions), Cerberus DMS V4.1 (All...10.0 Critical
- facebook parlaiDeserialization of Untrusted Data in parlai8.4 High
- facebook parlaiDeserialization of Untrusted Data in ParlAI9.8 Critical
- apache dubboBypass deserialization checks in Apache Dubbo9.8 Critical
- zstackPre-auth unsafe deserialization in ZStack7.5 High
- solarwinds orion platform, patch manager +1 moreInsecure Deserialization of untrusted data causing Remote code execution vulnerability.8.9 High
- apache dubboUnsafe deserialization in providers using the Hessian protocol9.8 Critical
- mrdoc, zmister2016 zmister2016/mrdoc +1 moreDeserialization of Untrusted Data in zmister2016/mrdoc7.5 High
- solarwinds patch manager, orion platform +1 moreChart Endpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability8.9 High
- solarwinds patch managerDeserialization of Untrusted Data in Resource Controls Remote Code Execution8.9 High
- solarwinds orion platformActionPluginBaseView Deserialization of Untrusted Data RCE8.9 High
- google androidIn ParsedIntentInfo of ParsedIntentInfo.java, there is a possible parcel serialization...7.8 High
- unit4 mik.starlightDeserialization of untrusted data in multiple functions in MIK.starlight 7.9.5.24363 allows...8.8 High
- jenkins code coverage api, jenkins project code coverage api plugin +1 moreRCE vulnerability in Jenkins Code Coverage API Plugin8.8 High
- sernet veriniceIn the server in SerNet verinice before 1.22.2, insecure Java deserialization allows remote authenticated attackers to execute arbitrary code.8.8 High
- pagerduty rundeckYAML deserialization can run untrusted code8.8 High
- edgegallery developer-beAn issue was discovered in EdgeGallery/developer before v1.0. There is a "Deserialization of yaml...9.8 Critical
- bold-themes bold page builderBold Page Builder < 3.1.6 - PHP Object Injection8.8 High
- zte zxv10 m910 firmwareA conference management system of ZTE is impacted by a command execution vulnerability. Since the...9.8 Critical
- 3s-smart software solutions codesysAn unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation...8.8 High
- apple ios, macos, watchos, ipados, macos +3 more +5 moreApple iOS, macOS, watchOS Sandbox Bypass Vulnerability7.5 High
- x-stream xstream, debian linux, fedoraproject fedora +12 more +14 moreA Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshaling8.5 High
- x-stream xstream, debian linux, fedoraproject fedora +12 more +14 moreA Server-Side Forgery Request vulnerability in XStream via HashMap unmarshaling8.5 High
- x-stream xstream, debian linux, fedoraproject fedora +12 more +14 moreXStream can cause a Denial of Service6.5 Medium
- Show moreLoading…