CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- ninjaforms ninja forms, unknown ninja forms contact form – the drag and drop form builder for wordpress +1 moreNinjaForms < 3.6.13 - Admin+ PHP Objection Injection7.2 High
- scala-lang scala, fedoraproject fedora, scala-lang scala-collection-compat +2 moreScala subject to file deletion, code execution due to Java deserialization chain with LazyList object deserialization9.8 Critical
autogluon-multimodalPyPIautogluon.multimodal vulnerable to unsafe YAML deserializationNo score- jenkins dotci, jenkins project dotci plugin +1 moreRCE vulnerability in Jenkins DotCi Plugin9.8 Critical
- apache inlongDeserialization attack in Apache InLong prior to version 1.3.0 allows RCE via JDBC8.8 High
- huawei emui, harmonyos +1 moreThe NFC module has bundle serialization/deserialization vulnerabilities. Successful exploitation...9.1 Critical
- x-stream xstreamStack Buffer Overflow in xstream6.5 Medium
- thinkphpThinkPHP deserialization vulnerability9.8 Critical
- circuitverseCircuitVerse potential RCE vulnerability via Oj.load8.8 High
- wpvivid migration\, backup\, staging, wpvividplugins wpvivid — backup, migration & staging +1 moreMigration, Backup, Staging – WPvivid <= 0.9.74 - Authenticated (Admin+) PHAR Deserialization7.2 High
- managewp broken link checkerBroken Link Checker <= 1.11.16 - Authenticated (Admin+) PHAR Deserialization7.2 High
- codename065 download managerDownload Manager <= 3.2.49 - Authenticated (Contributor+) PHAR Deserialization8.8 High
- instawp string locatorString Locator <= 2.5.0 - Cross-Site Request Forgery to PHAR Deserialization8.8 High
- connekthq ajax load more, dcooney ajax load more – infinite scroll, load more, & lazy load +1 moreWordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Cross-Site Request Forgery to PHAR Deserialization7.5 High
- bitdefender gravityzone, gravityzone cloud console, gravityzone console on-premise +2 moreDeserialization of Untrusted Data in GravityZone Console On-Premise (VA-10573)8.8 High
- apache ofbizJava Deserialization via RMI Connection from the Solr plugin of Apache OFBiz9.8 Critical
- apache geodeApache Geode deserialization of untrusted data flaw when using REST API on Java 8 or Java 116.5 Medium
- apache geodeApache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 118.8 High
- apache geodeApache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8.9.8 Critical
- nvidia nvflare, flare +1 moreNVFLARE unsafe deserialization due to Pickle9.8 Critical
- ssctech blue prismAn issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment...8.8 High
- rockwell automation isagraf workbenchISaGRAF Workbench Deserialization of Untrusted Data CWE-5028.6 High
- apache hadoopApache Hadoop YARN remote code execution in ZKConfigurationStore of capacity scheduler8.8 High
- redhat openshiftIt was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift...8.1 High
- awesomemotive easy digital downloads, easy digital downloads digital downloads +1 moreWordPress Easy Digital Downloads plugin <= 3.0.1 - PHP Object Injection vulnerability4.1 Medium
- laravelLaravel deserialization5.0 Medium
- fishbowlinventory fishbowlA Java Deserialization vulnerability in the Fishbowl Server in Fishbowl Inventory before 2022.4.1...9.8 Critical
- laravellaravel deserialization4.1 Medium
- arvadosAuthenticated remote code execution due to insecure deserialization (GHSL-2022-063)7.9 High
- f5 big-ip dns, big-ip domain name system +1 moreBIG-IP DNS TMUI Vulnerability CVE-2022-339475.4 Medium
- devexpressThis vulnerability allows remote attackers to execute arbitrary code on affected installations of...8.8 High
- easyuse mailhunter ultimateEasyUse MailHunter Ultimate - Deserialization of Untrusted Data9.8 Critical
- horde groupware, debian linux +1 moreHorde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which...8.0 High
- inductive automation ignitionThis vulnerability allows remote attackers to execute arbitrary code on affected installations of...7.8 High
- inductive automation ignitionThis vulnerability allows remote attackers to execute arbitrary code on affected installations of...8.8 High
- iconics genesis64, mitsubishi electric genesis32, iconics suite +1 more +3 moreDeserialization of Untrusted Data vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior...9.8 Critical
- iconics genesis64, mitsubishi electric iconics suite, mc works64 +2 moreDeserialization of Untrusted Data vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior...7.8 High
- iconics genesis64, mitsubishi electric iconics suite, mc works64 +2 moreDeserialization of Untrusted Data vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior...7.8 High
- iconics genesis64, mitsubishi electric iconics suite, mc works64 +2 moreDeserialization of Untrusted Data vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior...7.8 High
- sick safety designerA deserialization vulnerability in a .NET framework class used and not properly checked by Safety...7.8 High
- sick flexi soft designerA deserialization vulnerability in a .NET framework class used and not properly checked by Flexi...7.8 High
- zoho manageengine, zohocorp manageengine access manager plus, manageengine password manager pro +1 more +3 moreZoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to...9.8 Critical
- hypr windows wfa, workforce access +1 moreThis issue affects: HYPR Windows WFA versions prior to 7.2; Unsafe Deserialization vulnerability...4.5 Medium
- pega infinity, pegasystems pega infinity +1 moreIf an on-premise installation of the Pega Platform is configured with the port for the JMX...9.8 Critical
- oracle graalvm, azul zulu, debian linux +12 more +14 moreVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE ...5.3 Medium
- slickremix feed them social, feed them social – social media feeds, video, and photo galleries +1 moreFeed Them Social – for Twitter feed, Youtube and more <= 2.9.8.5 - Unauthenticated PHAR Deserialization9.8 Critical
- themeisle visualizer, visualizer: tables and charts manager for wordpress +1 moreVisualizer: Tables and Charts Manager for WordPress <= 3.7.9 - Authenticated (Contributor+) PHAR Deserialization8.8 High
- qvis dvr firmware, nvr firmware +1 moreQVIS NVR DVR before 2021-12-13 is vulnerable to Remote Code Execution via Java deserialization.9.8 Critical
- gentics cmsAn issue was discovered in Gentics CMS before 5.43.1. By uploading a malicious ZIP file, an...8.8 High
- redhat a-mq streams, build of quarkus, descision manager +6 more +8 morefabric8 kubernetes-client vulnerable6.7 Medium
- Show moreLoading…