CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- apache jena sdbApache Jena SDB allows arbitrary deserialisation via JDBC9.8 Critical
- vmware hyperic agent** UNSUPPORTED WHEN ASSIGNED ** A remote insecure deserialization vulnerability exixsts in VMWare...9.9 Critical
- vmware hyperic server** UNSUPPORTED WHEN ASSIGNED ** A remote unauthenticated insecure deserialization vulnerability...10.0 Critical
- huawei emui, harmonyos +1 moreThe system framework layer has a vulnerability of serialization/deserialization mismatch....9.8 Critical
- huawei emui, harmonyos +1 moreThe AMS module has a vulnerability of serialization/deserialization mismatch. Successful...9.8 Critical
- huawei emui, harmonyos +1 moreThe AMS module has a vulnerability of serialization/deserialization mismatch. Successful...9.8 Critical
- sap businessobjects business intelligence, sap se businessobjects business intelligence platform (central management console and bi launchpad) +1 moreIn some workflow of SAP BusinessObjects BI Platform (Central Management Console and BI LaunchPad)...9.9 Critical
- netwrix auditorRemote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording...9.8 Critical
- addify role based pricing for woocommerceRole Based Pricing for WooCommerce < 1.6.3 - Subscriber+ PHAR Deserialization8.8 High
- splunk, splunk enterprise, cloud platform +2 moreRemote Code Execution via the Splunk Secure Gateway application Mobile Alerts feature8.8 High
- python, fedoraproject fedora +1 morePython 3.9.x and 3.10.x through 3.10.8 on Linux allows local privilege escalation in a non...7.8 High
- fluent fluentd, fedoraproject fedora +1 moreFluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)3.1 Low
- lesspipe project lesspipelesspipe before 2.06 allows attackers to execute code via Perl Storable (pst) files, because of...9.8 Critical
- google android, mediatek, inc. mt6739, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6789, mt6833, mt6853, mt6853t, mt6855, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6889, mt6891, mt6893, mt6895, mt6983, mt8321, mt8385, mt8666, mt8675, mt8765, mt8766, mt8768, mt8786, mt8788, mt8789, mt8795t, mt8797, mt8798 +1 moreIn telephony, there is a possible permission bypass due to a parcel format mismatch. This could...7.8 High
- delta electronics infrasuite device masterDelta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize network...8.8 High
- delta electronics infrasuite device masterDelta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied...9.8 Critical
- unknown customizer export/import, fastlinemedia customizer export\/import +1 moreCustomizer Export/Import < 0.9.5 - Admin+ PHP Objection Injection7.2 High
- oceanwp ocean extraOcean Extra < 2.0.5 - Admin+ PHP Objection Injection7.2 High
- publishpress capabilities, unknown publishpress capabilities pro, publishpress capabilities – user role access, editor permissions, admin menus +2 morePublishPress Capabilities < 2.5.2 - Admin+ PHP Objection Injection7.2 High
- thimpress learnpress, learnpress – wordpress lms plugin +1 moreLearnPress < 4.1.7.2 - Unauthenticated PHP Object Injection via REST API8.1 High
- nextendweb smart slider 3Smart Slider 3 < 3.5.1.11 - PHP Object Injection8.8 High
- unknown easy wp smtpEasy WP SMTP < 1.5.0 - Admin+ PHP Objection Injection7.2 High
- cert vince, cert/cc vince - the vulnerability information and coordination environment +1 moreA Remote Code Injection vulnerability exists in CERT software prior to version 1.50.58.8 High
- apache flumeApache Flume prior to 1.11.0 has an Improper Input Validation (JNDI Injection) in JMSSource9.8 Critical
- apache linkisThe Apache Linkis JDBC EngineConn module has a RCE Vulnerability8.8 High
- kadencewp kadence woocommerce email designerKadence WooCommerce Email Designer < 1.5.7 - Admin+ PHP Objection Injection7.2 High
- solarwinds platform, orion platform +1 moreSolarWinds Platform Deserialization of Untrusted Data7.2 High
- solarwinds platform, orion platform +1 moreSolarWinds Platform Deserialization of Untrusted Data8.8 High
- solarwinds platform, orion platform +1 moreSolarWinds Platform Deserialization of Untrusted Data7.2 High
- opencatsOpenCATS v0.9.6 was discovered to contain a remote code execution (RCE) vulnerability via the...9.8 Critical
- github enterprise serverDeserialization of Untrusted Data vulnerability in GitHub Enterprise Server leading to Remote Code Execution8.8 High
- dataeaseDataease Mysql Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability9.8 Critical
- juniper junos, juniper networks junos os +1 moreJunos OS: Vulnerability in J-Web may allow deserialization without authentication8.1 High
- phpokPhpok 6.1 has a deserialization vulnerability via framework/phpok_call.php.9.8 Critical
- apache dubboApache Dubbo Hession Deserialization Vulnerability Gadgets Bypass9.8 Critical
- oracle graalvm, azul zulu, fedoraproject fedora +13 more +15 moreVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE ...3.7 Low
- gitlabSerialization of sensitive data in GitLab EE affecting all versions from 14.9 prior to 15.2.5, 15...6.5 Medium
- gocdCompromised agents may be able to execute remote code on GoCD Server9.1 Critical
- dotpdn paint.netdotPDN Paint.NET before 4.1.2 allows Deserialization of Untrusted Data (issue 2 of 2).9.8 Critical
- dotpdn paint.netdotPDN Paint.NET before 4.1.2 allows Deserialization of Untrusted Data (issue 1 of 2).9.8 Critical
- melisplatform melis-cms, melistechnology meliscms +1 moreDeserialization of untrusted data in MelisCms7.7 High
- melisplatform melis-front, melistechnology meliscms +1 moreDeserialization of untrusted data in MelisFront7.7 High
- vmware vcenter serverThe vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services...9.1 Critical
- microsoft exchange server, exchange server 2013 cumulative update 23, exchange server 2016 cumulative update 22 +3 more +5 moreMicrosoft Exchange Server Remote Code Execution Vulnerability8.0 High
- fasterxml jackson-databind, debian linux, netapp oncommand workflow automation +1 more +3 moreUncontrolled Resource Consumption in FasterXML jackson-databind7.5 High
- fasterxml jackson-databind, debian linux, netapp oncommand workflow automation +1 more +3 moreUncontrolled Resource Consumption in Jackson-databind7.5 High
- google android, mediatek, inc. mt6739, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6789, mt6833, mt6853, mt6853t, mt6855, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6889, mt6891, mt6893, mt6895, mt6983, mt8321, mt8385, mt8666, mt8675, mt8765, mt8766, mt8768, mt8786, mt8788, mt8789, mt8791, mt8797 +1 moreIn ims, there is a possible escalation of privilege due to a parcel format mismatch. This could...7.8 High
- google android, mediatek, inc. mt6580, mt6739, mt6761, mt6765, mt6768, mt6781, mt6785, mt6789, mt6833, mt6853, mt6853t, mt6855, mt6873, mt6877, mt6879, mt6883, mt6885, mt6889, mt6893, mt6895, mt6983, mt8321, mt8385, mt8666, mt8675, mt8765, mt8766, mt8768, mt8786, mt8788, mt8789, mt8791, mt8797 +1 moreIn telephony, there is a possible escalation of privilege due to a parcel format mismatch. This...7.8 High
- moodleMoodle remote code execution9.8 Critical
- orckestra c1 cms, c1-cms-foundation +1 moreOrckestra C1 CMS's deserialization of untrusted data allows for arbitrary code execution.9.0 Critical
- Show moreLoading…