CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- singoo singoocms.utilityDeserialization of Untrusted Data7.4 High
- siemens sinec nms, sinema server v14, sinec network management system +2 moreA vulnerability has been identified in SINEC NMS (All versions). The affected system allows to...7.2 High
- salesagility suitecrmSuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. Authenticated users...8.8 High
- ivanti incapptic connectA user with high privilege access to the Incapptic Connect web console can remotely execute code...7.2 High
- airspan networks mmp, ptmp c-series and a5x, ptp c-series +5 more +7 moreAirspan Networks Mimosa Deserialization of Untrusted Data7.5 High
- magnolia-cms magnolia cmsDeserialization of Untrusted Data in Magnolia CMS7.8 High
- apache cayenneDeserialization of untrusted data in the Hessian Component of Apache Cayenne 4.1 with older Java versions8.8 High
- microsoft sharepoint server, sharepoint enterprise server 2013 service pack 1, sharepoint enterprise server 2016 +4 more +6 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability8.8 High
- jenkinsDoS vulnerability in bundled XStream library in Jenkins Core7.5 High
- x-stream xstream, debian linux, fedoraproject fedora +8 more +10 moreDenial of Service by injecting highly recursive collections or maps in XStream7.5 High
- google androidIn writeThrowable of AndroidFuture.java, there is a possible parcel serialization/deserialization...7.8 High
- printerlogic web stack, virtual appliance +1 morePrinterLogic Web Stack versions 19.1.1.13 SP9 and below deserializes attacker controlled leading...8.1 High
- salesagility suitecrmSuiteCRM before 7.12.3 and 8.x before 8.0.2 allows PHAR deserialization that can lead to remote...9.8 Critical
- apache karafInsecure Java Deserialization in Apache Karaf8.1 High
com.hazelcast:hazelcastMaven,com.hazelcast.jet:hazelcast-jetMaven +1 moreSecurity Advisory for "Log4Shell"10.0 Critical- oracle access manager, fusion middleware +1 moreVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component:...9.8 Critical
- oracle graalvm, debian linux, netapp 7-mode transition tool +17 more +19 moreVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE ...5.3 Medium
- apache chainsaw, log4j, apache software foundation log4j 1.x +24 more +26 moreA deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.8.8 High
- apache log4j, apache software foundation log4j 1.x, broadcom brocade sannav +24 more +26 moreDeserialization of untrusted data in JMSSink in Apache Log4j 1.x8.8 High
- html2pdf project html2pdfCross-site Scripting in HTML2PDF8.8 High
- apache dubboDubbo Hessian cause RCE when parse error9.8 Critical
- h2database h2, debian linux, oracle communications cloud native core policy +2 moreRCE in H2 Console9.8 Critical
- wordpress, debian linux, fedoraproject fedora +1 more +3 moreAuthenticated Object Injection in Multisites in WordPress6.6 Medium
org.powernukkit:powernukkitMavenRemote code injection, Improper Input Validation and Uncontrolled Recursion in Log4j library10.0 Critical- codeigniter, codeigniter4 +1 moreDeserialization of Untrusted Data in Codeigniter47.7 High
- redhat jboss enterprise application platformThe HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A...7.2 High
- pytorchlightning pytorchlightning/pytorch-lightning, lightningai pytorch lightning +1 moreDeserialization of Untrusted Data in pytorchlightning/pytorch-lightning7.8 High
- ajax.net professional project professional, michaelschwarz ajax.net-professional +1 moreCross-Site Scripting in AjaxNetProfessional8.7 High
- quest kace desktop authorityAn issue was discovered in Quest KACE Desktop Authority before 11.2. This vulnerability allows...9.8 Critical
- dell wyse management suiteWyse Management Suite 3.3.1 and below versions contain a deserialization vulnerability that could...9.8 Critical
ru.yandex.clickhouse:clickhouse-jdbc-bridgeMavenUsing JMSAppender in log4j configuration may lead to deserialization of untrusted data8.1 High- qos logback, netapp cloud manager, service level manager +3 more +5 moreRCE from attacker with configuration edit priviledges through JNDI lookup6.6 Medium
- apache log4j, log4j2, cvat computer vision annotation tool +53 more +55 moreApache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack9.0 Critical
- apache log4j, apache software foundation log4j 1.x, fedoraproject fedora +44 more +46 moreDeserialization of untrusted data in JMSAppender in Apache Log4j 1.27.5 High
- nocean totop linkToTop Link <= 1.7.1 - Unauthenticated PHP Object Injection9.8 Critical
- apache log4j, log4j2, apple xcode +141 more +143 moreApache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints10.0 Critical
- ivanti avalancheA deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 allows...8.8 High
- ivanti avalancheA deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 using...9.8 Critical
- ivanti avalancheAn unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an...8.8 High
- veritas enterprise vaultAn issue (1 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the...9.8 Critical
- veritas enterprise vaultAn issue (2 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the...9.8 Critical
- veritas enterprise vaultAn issue (3 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the...9.8 Critical
- veritas enterprise vaultAn issue (4 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the...9.8 Critical
- veritas enterprise vaultAn issue (5 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the...9.8 Critical
- veritas enterprise vaultAn issue (6 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the...9.8 Critical
- thinkphpDeserialization of Untrusted Data in topthink/framework9.8 Critical
- thinkphpDeserialization of Untrusted Data in topthink/framework9.8 Critical
- ajaxpro.2 project ajaxpro.2, ajax.net professional professional, michaelschwarz ajax.net professional +2 moreDeserialization of Untrusted Data8.1 High
- sun ehrdSunnet eHRD - Insecure Deserialization8.8 High
- google androidIn createFromParcel of GpsNavigationMessage.java, there is a possible Parcel serialization...7.8 High
- Show moreLoading…