CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- kvf-admin project kvf-adminkvf-admin through 2022-02-12 allows remote attackers to execute arbitrary code because...9.8 Critical
- activerecord project activerecord, rails https://github.com/rails/rails +1 moreActive Record RCE bug with Serialized Columns9.8 Critical
- druva insync clientAn issue was discovered in Druva 6.9.0 for macOS, allows attackers to gain escalated local...7.8 High
- rpc.py project rpc.pyrpc.py vulnerable to Deserialization of Untrusted Data9.8 Critical
- amazon opensearch, opensearch-project opensearch-ruby +1 moreUnsafe YAML deserialization in opensearch-ruby8.8 High
- thinkphpDeserialization of Untrusted Data in topthink/framework9.8 Critical
- nvidia nvflare, flare +1 moreUnsafe yaml deserialization in NVFlare9.8 Critical
- nvidia nvflare, flare +1 moreUnsafe deserialisation in the PKI implementation scheme of NVFlare9.8 Critical
- apache hadoopApache Hadoop Privilege escalation vulnerability8.8 High
- sap netweaver developer studio, sap se netweaver developer studio (nwds) +1 moreSAP NetWeaver Developer Studio (NWDS) - version 7.50, is based on Eclipse, which contains the...3.4 Low
- alibaba fastjson, oracle communications cloud native core unified data repository +1 moreDeserialization of Untrusted Data8.1 High
- jmespath, fedoraproject fedora +1 moreJMESPath for Ruby uses unsafe JSON.load when safe JSON.parse is preferable9.8 Critical
- gatsbyjs gatsby-plugin-mdxDeserialization of Untrusted Data8.1 High
- siemens biograph horizon pet/ct systems, magnetom family, mammomat revelation +37 more +39 moreA vulnerability has been identified in Biograph Horizon PET/CT Systems (All VJ30 versions < VJ30C...9.8 Critical
- google androidIn the keystore library, there is a possible prevention of access to system Settings due to...5.0 Medium
- keysight n6854a geolocation server and n6841a rf sensor software, n6841a rf firmware, n6854a firmware +2 moreKeysight N6854A Geolocation server and N6841A RF Sensor software9.8 Critical
- cognex in-sight opc serverCognex In-Sight OPC Server - Deserialization of Untrusted Data8.8 High
- yaml project yaml, netapp astra trident +1 moregopkg.in/yaml.v3 Denial of Service7.5 High
- rockwell automation isagraf workbench, connected component workbench, safety instrumented systems workstation +2 moreRockwell Automation ISaGRAF Deserialization of Untrusted Data8.6 High
- skyoftech so listing tabsThe Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a...9.8 Critical
- jfrog artifactoryJFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of...8.8 High
- phpokPhpok v6.1 was discovered to contain a deserialization vulnerability via the update_f() function...9.8 Critical
- booking calendar project calendar, wpdevelop booking calendar +1 moreBooking Calendar <= 9.1 - PHP Object Injection via Shortcode8.8 High
- thinkphpDeserialization of Untrusted Data7.7 High
- squire-technologies svi ms management systemThe Java Remote Management Interface of all versions of SVI MS Management System was discovered...9.8 Critical
- orlansoft erpThe Java Remote Management Interface of all versions of Orlansoft ERP was discovered to contain a...9.8 Critical
- ureport2 project ureport2Remote Code Execution9.8 Critical
- google gson, debian linux, netapp active iq unified manager +3 more +5 moreDeserialization of Untrusted Data7.7 High
- usu oracle optimizationUSU Oracle Optimization before 5.17 allows authenticated quantum users to achieve remote code...8.8 High
- atlassian bitbucket data centerSharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later...9.8 Critical
- misp-project mispAn issue was discovered in MISP before 2.4.158. PHAR deserialization can occur.9.8 Critical
- oracle adf faces, application development framework, jdeveloper +1 more +3 moreVulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces)...9.8 Critical
- php pearwebpearweb < 1.32 suffers from Deserialization of Untrusted Data.9.8 Critical
- geoserver geowebcacheUnchecked JNDI lookups in GeoWebCache9.1 Critical
- cloudlinux imunify360A php unserialize vulnerability exists in the Ai-Bolit functionality of CloudLinux Inc Imunify360...8.2 High
- vmware identity manager, vrealize automation, workspace one access +2 more +4 moreVMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code...7.2 High
- vmware identity manager, vrealize automation, workspace one access +2 more +4 moreVMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code...7.2 High
- siemens simatic energy manager basic, simatic energy manager pro +1 moreA vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1...9.8 Critical
- cisco webex meetings, webex meetings online +1 moreCisco Webex Meetings Java Deserialization Vulnerability5.4 Medium
- jeesiteJeesite 1.2.7 uses the apache shiro version 1.2.3 affected by CVE-2016-4437. Because of this...9.8 Critical
- softwareag mashzone nextgenThe HTTP client in MashZone NextGen through 10.7 GA deserializes untrusted data when it gets an...9.8 Critical
- qualcomm, inc. snapdragon connectivity, snapdragon mobile, qualcomm ar8035 firmware, qca8081 firmware +8 more +10 moreImproper serialization of message queue client registration can lead to race condition allowing...8.4 High
- crater-invoice crater-invoice/crater, craterapp crater +1 moreInsecure deserialization of not validated module file in crater-invoice/crater7.2 High
- schneider-electric software update, schneider electric software update (sesu) – sut service component +1 moreA CWE-502: Deserialization of Untrusted Data vulnerability exists which could allow an attacker...7.3 High
- rockwell automation connected components workbenchRockwell Automation Connected Components Workbench Deserialization of Untrusted Data8.6 High
- rockwell automation factorytalk assetcentreRockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data10.0 Critical
- rockwell automation factorytalk assetcentreRockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data10.0 Critical
- rockwell automation factorytalk assetcentreRockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data10.0 Critical
- rockwell automation factorytalk assetcentreRockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data10.0 Critical
- veeamDeserialization of untrusted data in Veeam Agent for Windows 2.0, 2.1, 2.2, 3.0.2, 4.x, and 5.x...7.8 High
- Show moreLoading…